Ciao r16
la pagina wikisend non funziona, non quando clicco upload file nella pagina successiva dice siamo spiacenti ma si è verificato un errore durante il caricamento.
Ho ripetuto diverse volte, niente sempre lo stesso errore.
Comunque ti mandop il file report che c'è nella cartella "suspectfile"
SystemScan - www.suspectfile.com - ver. 3.6.7 (code: holifay & bReAkdOWn)

Running on: Windows XP PROFESSIONAL Edition, Service Pack 3 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Biagio\Desktop\sys84308.exe
Running in: User mode
Date: 12/01/2010
Time: 22.40.19

Output limited to:
-PC accounts
-Recent files
-Duplicates in BAK folders
-Registry Run Keys
-Autoplay settings (autorun.inf)
-Scheduled jobs
-Services and Drivers (all)
-Svchost.exe instances
-Loaded Dlls
-Alternate Data Streams
-Encrypted Files
-Hidden objects
-Master Boot Record
-Network settings
-Include HOSTS file
-Suspicious Files
-Installed Applications

===================== ACCOUNTS ON THIS PC =====================


Users on this computer:
Is Admin? | Username

---

Yes | Administrator
Yes | Biagio
| Guest
| HelpAssistant (Disabled)
| SUPPORT_388945a0 (Disabled)

### users folders

20/01/2009 15.36.06 (DIR) 0 byte 357 days old -- LocalService
16/08/2009 22.27.45 (DIR) 0 byte 149 days old -- Default User
22/11/2009 23.16.01 (DIR) 0 byte 51 days old -- Biagio
29/12/2009 12.48.52 (DIR) 0 byte 14 days old -- All Users
11/01/2010 20.20.58 (DIR) 0 byte 1 days old -- NetworkService

### startup files in users folders

C:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\BTTray.lnk
C:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini
C:\documents and settings\Biagio\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini
C:\documents and settings\Default User\Menu Avvio\Programmi\Esecuzione automatica\desktop.ini

===================== RECENT FILES =====================
Listing files newer than 60 days

---- recent files in C:\
12/01/2010 22:23:30 -- 12/01/2010 22:23:30 (DIR) HS-- 0 days old -- C:\RECYCLER
14/12/2008 16:23:51 -- 11/01/2010 21:08:07 (DIR) ---A 1 days old -- C:\WINDOWS
10/01/2010 19:22:39 -- 11/01/2010 19:05:51 (DIR) ---- 1 days old -- C:\Qoobox
14/12/2008 16:30:17 -- 11/01/2010 18:54:33 (DIR) --R- 1 days old -- C:\Programmi
12/01/2010 22:24:38 -- 12/01/2010 22:24:38 327 ---A 0 days old -- C:\mbr.log
12/01/2010 22:08:59 -- 12/01/2010 22:09:19 3318 H--A 0 days old -- C:\aaw7boot.cmd
14/12/2008 16:23:51 -- 12/01/2010 18:43:081610612736 HS-A 0 days old -- C:\pagefile.sys
12/01/2010 18:35:45 -- 12/01/2010 18:35:49 77312 ---A 0 days old -- C:\mbr.exe

---- recent files in C:\DOCUME~1\Biagio\IMPOST~1\Temp\
12/01/2010 22:35:01 -- 12/01/2010 22:40:19 (DIR) ---- 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\nsw5DE.tmp
12/01/2010 13:18:44 -- 12/01/2010 18:43:46 (DIR) ---- 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\Acrobat Distiller 9
12/01/2010 18:43:24 -- 12/01/2010 18:43:24 (DIR) ---- 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\WPDNSE
11/01/2010 20:39:20 -- 11/01/2010 20:39:20 (DIR) ---- 1 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\hsperfdata_Biagio
12/01/2010 22:31:34 -- 12/01/2010 22:37:20 16384 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\~DF15B.tmp
12/01/2010 22:34:28 -- 12/01/2010 22:35:01 53 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\systemscan.ini
12/01/2010 22:35:01 -- 12/01/2010 22:35:01 16384 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\~DFEEAD.tmp
12/01/2010 22:28:45 -- 12/01/2010 22:32:56 16384 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\~DF5A55.tmp
12/01/2010 22:08:34 -- 12/01/2010 22:09:19 16384 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\~DF5F23.tmp
12/01/2010 22:08:32 -- 12/01/2010 22:08:32 0 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\~DF4A8C.tmp
11/01/2010 20:39:19 -- 12/01/2010 19:39:22 1661 ---A 0 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\jusched.log
11/01/2010 20:39:20 -- 11/01/2010 20:39:20 291 ---A 1 days old -- C:\DOCUME~1\Biagio\IMPOST~1\Temp\java_install_reg.log

---- recent files in C:\WINDOWS\
15/12/2008 20:42:21 -- 12/01/2010 22:40:19 (DIR) ---- 0 days old -- C:\WINDOWS\Prefetch
14/12/2008 16:23:51 -- 12/01/2010 22:34:03 (DIR) ---- 0 days old -- C:\WINDOWS\Temp
14/12/2008 15:44:42 -- 12/01/2010 18:46:44 (DIR) -S-- 0 days old -- C:\WINDOWS\Tasks
14/12/2008 16:23:51 -- 12/01/2010 18:34:05 (DIR) ---- 0 days old -- C:\WINDOWS\system32
11/01/2010 21:08:07 -- 11/01/2010 21:08:07 (DIR) HS-- 1 days old -- C:\WINDOWS\ftpcache
29/01/2009 21:39:50 -- 11/01/2010 18:55:15 (DIR) ---- 1 days old -- C:\WINDOWS\ERDNT
14/12/2008 16:23:51 -- 11/01/2010 18:51:31 (DIR) ---- 1 days old -- C:\WINDOWS\AppPatch
12/03/2009 19:59:10 -- 08/01/2010 17:29:58 (DIR) H--- 4 days old -- C:\WINDOWS\$NtUninstallKB960225$
14/12/2008 16:23:51 -- 31/12/2009 12:46:49 (DIR) H--- 12 days old -- C:\WINDOWS\inf
14/12/2008 16:30:24 -- 29/12/2009 13:00:26 (DIR) HS-- 14 days old -- C:\WINDOWS\Installer
14/12/2008 16:23:51 -- 29/12/2009 12:42:52 (DIR) ---- 14 days old -- C:\WINDOWS\Debug
14/12/2008 16:23:51 -- 05/12/2009 20:03:33 (DIR) ---- 38 days old -- C:\WINDOWS\WinSxS
14/12/2008 15:41:54 -- 05/12/2009 20:01:25 (DIR) ---- 38 days old -- C:\WINDOWS\Registration
05/12/2009 19:41:08 -- 05/12/2009 19:41:08 (DIR) H--- 38 days old -- C:\WINDOWS\$NtUninstallWdf01009$
03/12/2009 13:55:12 -- 03/12/2009 13:55:13 (DIR) H--- 40 days old -- C:\WINDOWS\$NtUninstallKB955759$
14/12/2008 15:48:35 -- 03/12/2009 13:54:36 (DIR) H--- 40 days old -- C:\WINDOWS\$hf_mig$
01/12/2009 20:12:42 -- 01/12/2009 20:12:43 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB976098-v2$
01/12/2009 20:12:18 -- 01/12/2009 20:12:19 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB973687$
01/12/2009 18:14:06 -- 01/12/2009 18:14:07 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB970430$
01/12/2009 18:13:50 -- 01/12/2009 18:13:51 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB974318$
01/12/2009 18:12:26 -- 01/12/2009 18:12:27 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB973904$
01/12/2009 18:12:14 -- 01/12/2009 18:12:14 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB974392$
01/12/2009 18:12:02 -- 01/12/2009 18:12:02 (DIR) H--- 42 days old -- C:\WINDOWS\$NtUninstallKB971737$
29/12/2009 12:47:22 -- 12/01/2010 22:39:24 12694 ---A 0 days old -- C:\WINDOWS\setupapi.log
14/12/2008 15:45:48 -- 12/01/2010 19:25:11 1934894 ---A 0 days old -- C:\WINDOWS\WindowsUpdate.log
29/12/2009 12:46:44 -- 12/01/2010 18:43:57 0 ---A 0 days old -- C:\WINDOWS\0.log
25/09/2009 15:00:35 -- 12/01/2010 18:43:53 4188 ---A 0 days old -- C:\WINDOWS\ModemLog_PCI SoftV92 Speakerphone Modem.txt
20/12/2008 14:11:47 -- 12/01/2010 18:43:41 159 ---A 0 days old -- C:\WINDOWS\wiadebug.log
20/12/2008 14:11:46 -- 12/01/2010 18:43:38 50 ---A 0 days old -- C:\WINDOWS\wiaservc.log
14/12/2008 15:51:48 -- 12/01/2010 18:43:11 2048 -S-A 0 days old -- C:\WINDOWS\bootstat.dat
14/12/2008 15:53:51 -- 12/01/2010 18:42:07 32420 ---A 0 days old -- C:\WINDOWS\SchedLgU.Txt
31/08/2001 12:00:00 -- 11/01/2010 18:57:44 246 ---A 1 days old -- C:\WINDOWS\system.ini
10/01/2010 19:26:00 -- 25/10/2009 06:11:34 77312 ---A 2 days old -- C:\WINDOWS\MBR.exe
10/01/2010 19:25:59 -- 20/04/2009 12:56:28 31232 ---A 2 days old -- C:\WINDOWS\NIRCMD.exe
10/01/2010 19:25:51 -- 09/12/2009 22:54:07 261632 ---A 2 days old -- C:\WINDOWS\PEV.exe
10/01/2010 19:25:49 -- 31/08/2000 08:00:00 80412 ---A 2 days old -- C:\WINDOWS\grep.exe
10/01/2010 19:25:49 -- 31/08/2000 08:00:00 161792 ---A 2 days old -- C:\WINDOWS\SWREG.exe
10/01/2010 19:25:49 -- 31/08/2000 08:00:00 68096 ---A 2 days old -- C:\WINDOWS\zip.exe
10/01/2010 19:25:48 -- 31/08/2000 08:00:00 98816 ---A 2 days old -- C:\WINDOWS\sed.exe
10/01/2010 19:25:46 -- 31/08/2000 08:00:00 136704 ---A 2 days old -- C:\WINDOWS\SWSC.exe
10/01/2010 19:25:46 -- 31/08/2000 08:00:00 212480 ---A 2 days old -- C:\WINDOWS\SWXCACLS.exe
14/12/2008 16:21:47 -- 02/12/2009 17:57:46 38 ---A 41 days old -- C:\WINDOWS\avisplitter.ini

---- recent files in C:\WINDOWS\system\

---- recent files in C:\WINDOWS\system32\
14/12/2008 16:29:11 -- 12/01/2010 18:46:46 (DIR) ---- 0 days old -- C:\WINDOWS\system32\CatRoot2
14/12/2008 16:23:51 -- 11/01/2010 19:05:51 (DIR) ---- 1 days old -- C:\WINDOWS\system32\drivers
14/12/2008 16:23:51 -- 11/01/2010 18:55:28 (DIR) ---- 1 days old -- C:\WINDOWS\system32\config
14/12/2008 16:23:51 -- 08/01/2010 12:37:43 (DIR) HSR- 4 days old -- C:\WINDOWS\system32\dllcache
28/01/2009 16:21:53 -- 29/12/2009 12:42:54 (DIR) ---- 14 days old -- C:\WINDOWS\system32\NtmsData
31/12/2008 20:50:00 -- 05/12/2009 20:00:51 (DIR) ---- 38 days old -- C:\WINDOWS\system32\DRVSTORE
31/08/2001 12:00:00 -- 12/01/2010 22:36:27 2206 ---A 0 days old -- C:\WINDOWS\system32\wpa.dbl
29/12/2009 12:14:14 -- 24/08/2009 21:08:08 28160 ---A 14 days old -- C:\WINDOWS\system32\DfSdkBt.exe
05/12/2009 20:00:47 -- 05/12/2009 20:00:47 1579 ---A 38 days old -- C:\WINDOWS\system32\UninitializedDebugLog.txt
05/12/2009 20:00:13 -- 05/12/2009 20:00:13 152 ---A 38 days old -- C:\WINDOWS\system32\LORInstallLog.txt
05/12/2009 19:41:11 -- 07/11/2008 18:55:30 16928 ---- 38 days old -- C:\WINDOWS\system32\spmsgXP_2k3.dll
31/08/2001 12:00:00 -- 02/12/2009 12:53:14 480058 ---A 41 days old -- C:\WINDOWS\system32\perfh010.dat
31/08/2001 12:00:00 -- 02/12/2009 12:53:14 67984 ---A 41 days old -- C:\WINDOWS\system32\perfc009.dat
31/08/2001 12:00:00 -- 02/12/2009 12:53:14 433698 ---A 41 days old -- C:\WINDOWS\system32\perfh009.dat
31/08/2001 12:00:00 -- 02/12/2009 12:53:14 80008 ---A 41 days old -- C:\WINDOWS\system32\perfc010.dat
14/12/2008 16:30:24 -- 02/12/2009 12:53:13 1076050 ---A 41 days old -- C:\WINDOWS\system32\PerfStringBackup.INI
18/12/2008 19:25:45 -- 01/12/2009 21:06:19 25966024 ---A 42 days old -- C:\WINDOWS\system32\MRT.exe
18/12/2008 19:25:30 -- 01/12/2009 20:12:50 217296 ---A 42 days old -- C:\WINDOWS\system32\TZLog.log

---- recent files in C:\WINDOWS\system32\drivers\
14/12/2008 16:23:51 -- 11/01/2010 18:56:57 (DIR) ---- 1 days old -- C:\WINDOWS\system32\drivers\etc
08/01/2010 14:12:27 -- 07/01/2010 16:07:14 38224 ---A 4 days old -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
08/01/2010 14:12:22 -- 07/01/2010 16:07:04 19160 ---A 4 days old -- C:\WINDOWS\system32\drivers\mbam.sys
05/12/2009 19:41:23 -- 05/12/2009 19:41:23 0 H--A 38 days old -- C:\WINDOWS\system32\drivers\Msft_Kernel_GenericMount_01009.Wdf
05/12/2009 19:41:21 -- 05/12/2009 19:41:21 0 H--A 38 days old -- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

---- recent files in C:\WINDOWS\temp\
11/01/2010 19:28:58 -- 12/01/2010 22:05:54 511 ---A 0 days old -- C:\WINDOWS\temp\WGAErrLog.txt
11/01/2010 19:17:53 -- 12/01/2010 19:03:51 3220 ---A 0 days old -- C:\WINDOWS\temp\MpCmdRun.log
12/01/2010 18:43:42 -- 12/01/2010 18:43:42 16384 ---A 0 days old -- C:\WINDOWS\temp\Perflib_Perfdata_85c.dat
12/01/2010 13:19:23 -- 12/01/2010 13:19:23 0 ---A 0 days old -- C:\WINDOWS\temp\T30DebugLogFile.txt

---- recent files in C:\Programmi\
18/12/2008 21:32:19 -- 12/01/2010 18:43:23 (DIR) ---- 0 days old -- C:\Programmi\DNA
14/12/2008 16:30:17 -- 11/01/2010 18:51:25 (DIR) ---- 1 days old -- C:\Programmi\File comuni
08/01/2010 14:12:21 -- 08/01/2010 14:12:34 (DIR) ---- 4 days old -- C:\Programmi\Malwarebytes' Anti-Malware
03/01/2009 16:16:17 -- 06/01/2010 17:02:28 (DIR) ---- 6 days old -- C:\Programmi\eMule
29/12/2009 12:59:30 -- 29/12/2009 12:59:30 (DIR) ---- 14 days old -- C:\Programmi\ESET
29/12/2009 12:14:08 -- 29/12/2009 12:14:08 (DIR) ---- 14 days old -- C:\Programmi\Ashampoo
02/06/2009 14:42:54 -- 03/12/2009 13:50:43 (DIR) ---- 40 days old -- C:\Programmi\Google
14/12/2008 15:43:41 -- 01/12/2009 18:13:22 (DIR) ---- 42 days old -- C:\Programmi\Internet Explorer
15/11/2009 12:41:16 -- 15/11/2009 12:41:39 (DIR) ---- 58 days old -- C:\Programmi\UltraISO

---- recent files in C:\Programmi\File comuni\
25/03/2009 14:17:11 -- 05/12/2009 20:03:48 (DIR) ---- 38 days old -- C:\Programmi\File comuni\Symantec Shared
15/11/2009 12:41:38 -- 15/11/2009 12:41:38 (DIR) ---- 58 days old -- C:\Programmi\File comuni\EZB Systems

---- recent files in C:\Documents and Settings\Biagio\Dati applicazioni\
18/12/2008 21:32:19 -- 12/01/2010 22:33:48 (DIR) ---- 0 days old -- C:\Documents and Settings\Biagio\Dati applicazioni\DNA
08/01/2010 14:12:39 -- 08/01/2010 14:12:39 (DIR) ---- 4 days old -- C:\Documents and Settings\Biagio\Dati applicazioni\Malwarebytes
18/12/2008 21:33:10 -- 29/12/2009 12:42:56 (DIR) ---- 14 days old -- C:\Documents and Settings\Biagio\Dati applicazioni\BitTorrent
05/12/2009 05:53:12 -- 05/12/2009 05:53:12 9586784 ---A 38 days old -- C:\Documents and Settings\Biagio\Dati applicazioni\ashampoo_winoptimizer_2010_6.50_6585.exe

---- recent files in C:\Documents and Settings\Biagio\Impostazioni locali\Dati applicazioni\
14/12/2008 15:57:03 -- 11/01/2010 21:13:37 (DIR) -S-- 1 days old -- C:\Documents and Settings\Biagio\Impostazioni locali\Dati applicazioni\Microsoft
10/01/2010 19:28:05 -- 10/01/2010 19:28:05 (DIR) ---- 2 days old -- C:\Documents and Settings\Biagio\Impostazioni locali\Dati applicazioni\ESET
04/12/2009 10:46:12 -- 03/12/2009 13:46:56 (DIR) ---- 39 days old -- C:\Documents and Settings\Biagio\Impostazioni locali\Dati applicazioni\Temp
15/12/2008 15:00:48 -- 03/12/2009 14:02:59 79872 ---A 40 days old -- C:\Documents and Settings\Biagio\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

===================== DUPLICATE FILES IN BAK FOLDERS =====================

No BAK folders found

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"GrooveMonitor"="\"C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe\""
"CloneCDTray"="\"C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe\" /s"
"Windows Defender"="\"C:\Programmi\Windows Defender\MSASCui.exe\" -hide"
"Adobe Acrobat Speed Launcher"="\"C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe\""
"Acrobat Assistant 8.0"="\"C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe\""
"CARPService"="carpserv.exe"
"TrueImageMonitor.exe"="C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe"
"AcronisTimounterMonitor"="C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe"
"Servizio Acronis Scheduler2"="\"C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe\""
"AliceRE_McciTrayApp"="C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven~1\syncer\MCCITR~1.EXE"
"SunJavaUpdateSched"="\"C:\Programmi\Java\jre6\bin\jusched.exe\""
"egui"="\"C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe\" /hide /waitservice"

[Run\OptionalComponents]
@=""

[Run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[Run\OptionalComponents\MAPI]
"Installed"="1"
@=""
"NoChange"="1"

[Run\OptionalComponents\MSFS]
"Installed"="1"
@=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"MSMSGS"="\"C:\Programmi\Messenger\msmsgs.exe\" /background"
"BitTorrent DNA"="\"C:\Programmi\DNA\btdna.exe\""
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

[Run\AdobeUpdater]
@=""

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"
"DWQueuedReporting"="\"C:\PROGRA~1\FILECO~1\MICROS~1\DW\dwtrig20.exe\" -t"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
"AppInit_DLLs"="C:\WINDOWS\system32\acaptuser32.dll"

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"%Systemroot%\system32\webcheck.dll"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
#### HKCR\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\InprocServer32 @="C:\WINDOWS\system32\wpdshserviceobj.dll"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @=expand:"%systemroot%\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"
#### HKCR\CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD}\InprocServer32 @="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL"
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="ShellExecuteHook antimalware di Microsoft"
#### HKCR\CLSID\{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}\InprocServer32 @="C:\PROGRA~1\WIFD1F~1\MpShHook.dll"
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
"@="Senza fili"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
"@="Folder Redirection"
"DllName"=expand:"fdeploy.dll"

[Winlogon\GPExtensions\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"@="Quota disco Microsoft"
"DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
"@="Utilità di pianificazione pacchetti QoS"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
"@="Script"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
"@="Internet Explorer Zonemapping"
"DllName"="C:\WINDOWS\system32\iedkcs32.dll"

[Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}]
"@="Internet Explorer User Accelerators"
"DllName"="C:\WINDOWS\system32\iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"@="Internet Explorer Branding"
"DllName"="C:\WINDOWS\system32\iedkcs32.dll"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="EFS recovery"

[Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}]
"@="802.3 Group Policy"
"DllName"=expand:"dot3gpclnt.dll"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
"@="Microsoft Offline Files"
"DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"@="Installazione software"
"DllName"=expand:"appmgmts.dll"

[Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}]
"@="Internet Explorer Machine Accelerators"
"DllName"="C:\WINDOWS\system32\iedkcs32.dll"

[Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
"@="Protezione IP"
"DllName"=expand:"gptext.dll"

[Winlogon\Notify]

[Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"

[Winlogon\Notify\dimsntfy]
"DllName"=expand:"%SystemRoot%\System32\dimsntfy.dll"

[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
"DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"

[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\WgaLogon]
"DllName"=expand:"WgaLogon.dll"

[Winlogon\Notify\WgaLogon\Settings]
@=""

[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"ParseAutoexec"="1"
"ExcludeProfileDirs"="Impostazioni locali;Temporary Internet Files;Cronologia;Temp"
"BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
"BootExecute"=multi:"autocheck autochk *\00lsdelete\00\00"

[Session Manager\SubSystems]
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
"cmdline"=expand:"%SystemRoot%\system32\ntvdm.exe"
"wowcmdline"=expand:"%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[runonceex]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Precaricatore Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon di cache delle categorie di componenti"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]

[Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
#### HKCR\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32 @="C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll"
"NoExplorer"=dword:00000001
@="AcroIEHelperStub"

[Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
#### HKCR\CLSID\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\InprocServer32 @="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL"
@=""

[Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}]
#### HKCR\CLSID\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}\InprocServer32 @="C:\Programmi\Epson Software\Easy Photo Print\EPTBL.dll"

[Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
@=""

[Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
#### HKCR\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\InprocServer32 @="c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll"
"NoExplorer"=dword:00000001

[Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
#### HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\InprocServer32 @="C:\Programmi\Java\jre6\bin\jp2ssv.dll"
"NoExplorer"=dword:00000001

[Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
#### HKCR\CLSID\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\InprocServer32 @="C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll"
@="JQSIEStartDetectorImpl"
"NoExplorer"=dword:00000001

[Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
#### HKCR\CLSID\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\InprocServer32 @="C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll"

[Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\EWPP]
"InternetExplore"="Called\00\00l\00e\00d\00\00\00h/ê\02H\00\00\00\00\00\00\00\00\00\00\00h/ê\02H\00\00\00p/ê\02XÚ]\01,…8@t]\17\00XÚ]\01\00\00ê\02¨E\17\004\086@¨ý8@\00\00\00\00xÚ]\01 \07\01\00\09\00\00\00ÀÙ]\01¤ý8@´Ú]\01 é‘|`\00’|ÿÿÿÿ]\00’|Ùõã\02\00\00ê\02\00\00\00\00p/ê\02\01\00\00\00\1cÛ]\01\00\00\00\00à³\18\00ÀÚ]\01DJ\0fwUÐ8@ô_\17\00\01\00\00\00\08Û]\01 \16ä\02ȁä\02ÿÿÿÿ\14Û]\01 êã\02p/ê\02êpã\02p/ê\02\01\00\00\00¿¼ã\024Û]\01\00\00\00\00\08\00\03ExÛ]\01ä³\18\00¨E\17\00\0b\00\00\00\00\00\00\00\01\00\00\00\08¼ã\02Üÿ]\01"
"FileExplorer"="JustInstalled"
"FileBrowser"="Called\00\00\1cî­\04΃õu\08©\02H\00\00\00\15\00\00\00\00\00\00\00€î­\04\00\00\00\00\00\00\00\00\00\00\00\007‡õuÁ@éw\00\00\00\00\00\00´\04€î­\04ìˆ!~\04î­\04~‚óu¸\00\16\00‚\01\00\09\00\00\00Xí­\04\05@\00€Lî­\04 é‘|`\00’|ÿÿÿÿ]\00’|Ùõo\05\00\00´\04\00\00\00\00@\1f´\04\00\00\00\00´î­\04¸\00\16\00¨Ì«\02Xî­\04DJ\0fw•}\"~8\01\13\00\00\00\00\00 î­\04 \16p\05ȁp\05ÿÿÿÿ¬î­\04 êo\05@\1f´\04êpo\05@\1f´\04\01\00\00\00¿¼o\05\01\00\00\00\02\00\00\00\08\00´\04\00\00\00\00¬Ì«\02Ò\"ïw\0b\00­\04\00\00\00\00\00\00\00\00\08¼o\05lñ­\04"

[Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
"NoExplorer"=dword:00000001
@="SmartSelect"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
"SCRNSAVE.EXE"="D:\Download\SCREEN~1\FANFIS~1.SCR"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
@="\"%1\" /S"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
@="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
@="http://"

[URL\Prefixes]
"ftp"="ftp://"
"home"="http://"
"mosaic"="http://"
"www"="http://"
"gopher"="gopher://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
"DependOnGroup"=multi:"\00"
"DependOnService"=multi:"Netman\00WinMgmt\00\00"
"Description"="Fornisce servizi di conversione indirizzi di rete, indirizzamento e risoluzione nomi e/o servizi di prevenzione intrusione per una rete domestica o una piccola rete aziendale."
"DisplayName"="Windows Firewall / Condivisione connessione Internet (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=expand:"%SystemRoot%\System32\svchost.exe -k netsvcs"
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[SharedAccess\Epoch]
"Epoch"=dword:00002ce4

[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enaxxxxx@xxxxxres.dll,-22004"
"445:TCP"="445:TCP:*:Enaxxxxx@xxxxxres.dll,-22005"
"137:UDP"="137:UDP:*:Enaxxxxx@xxxxxres.dll,-22001"
"138:UDP"="138:UDP:*:Enaxxxxx@xxxxxres.dll,-22002"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
"DoNotAllowExceptions"=dword:00000000
"DisableNotifications"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
"C:\Programmi\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Programmi\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Programmi\Microsoft Office\Office12\GROOVE.EXE"="C:\Programmi\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Programmi\Microsoft Office\Office12\ONENOTE.EXE"="C:\Programmi\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Programmi\File comuni\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Programmi\DNA\btdna.exe"="C:\Programmi\DNA\btdna.exe:*:Enabled:DNA"
"C:\Programmi\BitTorrent\bittorrent.exe"="C:\Programmi\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Programmi\eMule\emule.exe"="C:\Programmi\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\system32\fxsclnt.exe"="C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5353:TCP"="5353:TCP:*:Enabled:Adobe CSI CS4"
"1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008"
"139:TCP"="139:TCP:LocalSubNet:Enaxxxxx@xxxxxres.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enaxxxxx@xxxxxres.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enaxxxxx@xxxxxres.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enaxxxxx@xxxxxres.dll,-22002"

[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
"EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

[AU]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\-----

[System]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000
"RestoreStatus"=dword:00000001
"RestoreSafeModeStatus"=dword:00000000

[SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{6086BDFD-627A-4FC9-89EF-9AA61B0C2F13}"

[SystemRestore\SnapshotCallbacks]
@=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

[AdvancedOptions\TABS]
"Text"="Tabbed Browsing"

[AdvancedOptions\TABS\ENABLE]
"Text"="Enable Tabbed Browsing*"

[AdvancedOptions\TABS\FOREGROUND]
"Text"="Always switch to new tabs when they are created"

[AdvancedOptions\TABS\POPUPS]
"Text"="Always open pop-ups in a new window"

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
"@="Internet Explorer - Aggiornamento versione"
"ComponentID"="IEUDINIT"
"StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
"ComponentID"="WMPACCESS"
"@="Windows Media Player"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"@="Browser Customizations"
"ComponentiD"="BRANDING.CAB"
"StubPath"="\"C:\WINDOWS\system32\rundll32.exe\" \"C:\WINDOWS\system32\iedkcs32.dll\",BrandIEActiveSetup SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
"@="Personalizzazione del browser"
"ComponentID"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
"@="Microsoft VM"
"ComponentID"="JAVAVM"
"KeyFileName"="C:\WINDOWS\system32\msjava.dll"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
"@="Rendering grafica vettoriale (VML)"
"ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="NetShow"
"StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"=""
"@="Microsoft Windows Media Player 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
"@="DirectAnimation"
"ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"@="Themes Setup"
"ComponentID"="Theme Component"
"StubPath"=expand:"%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
"@="Binding dati Dynamic HTML per Java"
"ComponentID"="TridataJava"

[Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
"@="Offline Browsing Pack"
"ComponentID"="MobilePk"

[Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
"@="Uniscribe"
"ComponentID"="USP10"

[Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}]
"@="Creazione avanzata"
"ComponentID"="AdvAuth"

[Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"@="Microsoft Outlook Express 6"
"ComponentID"="MailNews"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install"

[Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
"@="NetMeeting 3.01"
"ComponentID"="NetMeeting"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT"

[Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
"@="DirectShow"
"ComponentID"="activemovie"

[Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
"@="DirectDrawEx"
"ComponentID"="DirectDrawEx"

[Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
"@="Internet Explorer Help"
"ComponentID"="HelpCont"

[Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
"@="Classi Java DirectAnimation"
"ComponentID"="DAJava"

[Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
"@="Microsoft Windows Script 5.8"
"ComponentID"="MSVBScript"

[Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
"KeyFileName"="C:\Programmi\Messenger\msmsgs.exe"
"@="Windows Messenger 4.7"
"ComponentID"="Messenger"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser"

[Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
"(Default)"="Internet Connection Wizard"
"ComponentID"="ICW"

[Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
"@="Internet Explorer Setup Tools"
"ComponentID"="GenSetup"

[Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
"@="Browsing Enhancements"
"ComponentID"="ExtraPack"
"KeyFileName"="C:\WINDOWS\system32\msieftp.dll"

[Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
#### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll"
"@="Microsoft Windows Media Player"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub"

[Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
"@="MSN Site Access"
"ComponentID"="MSN_Auth"

[Installed Components\{71CB2612-627C-3D58-8D82-B77444B27B6A}]
"@=".NET Framework"
"ComponentID"=".NETFramework"

[Installed Components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
"@="Web Folders"
"ComponentID"="WebFolders"

[Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"@="Rubrica 6"
"ComponentID"="WAB"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
"@="Windows Desktop Update"
"ComponentID"="IE4Shell_NT"
"StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
"@="Internet Explorer"
"ComponentID"="BASEIE40_W2K"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix]

[Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
"StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install"
"ComponentID"="DOTNETFRAMEWORKS"

[Installed Components\{8b15971b-5355-4c82-8c07-7e181ea07608}]
"@="Fax"
"ComponentID"="Fax"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser"

[Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
"@="Dynamic HTML Data Binding"
"ComponentID"="Tridata"

[Installed Components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}]
"@="Provider fax"
"ComponentID"="Fax Provider"
"StubPath"=""

[Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]

[Installed Components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

[Installed Components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

[Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
"@="Internet Explorer Core Fonts"
"ComponentID"="Fontcore"

[Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
"@="Utilità di pianificazione"
"ComponentID"="MSTASK"

[Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
"ComponentID"="Windows Movie Maker v2.1"

[Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"@="Adobe Flash Player"
"ComponentID"="Flash"

[Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
"@="HTML Help"
"ComponentID"="HTMLHelp"

[Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
"@="Active Directory Service Interface"
"ComponentID"="ADSI"

-----Comparing registry keys CCS1 vs CCS2 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {543D8726-8253-4435-B72F-3487803947CD} REG_BINARY 060000000000000000000000000000000CEC4C4B030000000000000000000000000000000CEC4C4B0F0000000000000000000000000000000CEC4C4B010000000000000000000000000000000CEC4C4B330000000000000000000000000000000CEC4C4B360000000000000000000000000000000CEC4C4B350000000000000000000000000000000CEC4C4B
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {543D8726-8253-4435-B72F-3487803947CD} REG_BINARY FC000000000000000000000000000000C3B44C4B0600000000000000040000000000000012094D4BC0A801010300000000000000040000000000000012094D4BC0A801010F00000000000000180000000000000012094D4B686F6D656E65742E74656C65636F6D6974616C69612E69740100000000000000040000000000000012094D4BFFFFFF003300000000000000040000000000000012094D4B000054603600000000000000040000000000000012094D4BC0A801013500000000000000010000000000000012094D4B05000000
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\Microsoft H.323 Telephony Service Provider
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\ServiceModel 3.0.0.0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\mssmbios\Data
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 11492 (0x2CE4)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 11486 (0x2CDE)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sptd\Cfg
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 192.168.1.1
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpDomain REG_SZ homenet.telecomitalia.it
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} NTEContextList REG_MULTI_SZ \0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} NTEContextList REG_MULTI_SZ 0x00000002\0\0
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpServer REG_SZ 255.255.255.255
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpServer REG_SZ 192.168.1.1
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} Lease REG_DWORD 3600 (0xE10)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} Lease REG_DWORD 21600 (0x5460)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} LeaseObtainedTime REG_DWORD 1263332364 (0x4B4CEC0C)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} LeaseObtainedTime REG_DWORD 1263318194 (0x4B4CB4B2)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} T1 REG_DWORD 1263334164 (0x4B4CF314)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} T1 REG_DWORD 1263328994 (0x4B4CDEE2)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} T2 REG_DWORD 1263335514 (0x4B4CF85A)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} T2 REG_DWORD 1263337094 (0x4B4CFE86)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} LeaseTerminatesTime REG_DWORD 1263335964 (0x4B4CFA1C)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} LeaseTerminatesTime REG_DWORD 1263339794 (0x4B4D0912)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpIPAddress REG_SZ 192.168.1.200
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpSubnetMask REG_SZ 255.255.255.0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpRetryTime REG_DWORD 10798 (0x2A2E)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpRetryStatus REG_DWORD 0 (0x0)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpNameServer REG_SZ 192.168.1.1
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpDefaultGateway REG_MULTI_SZ 192.168.1.1\0\0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpDomain REG_SZ homenet.telecomitalia.it
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{543D8726-8253-4435-B72F-3487803947CD} DhcpSubnetMaskOpt REG_MULTI_SZ 255.255.255.0\0\0
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpIPAddress REG_SZ 0.0.0.0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.200
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpSubnetMask REG_SZ 255.0.0.0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpSubnetMask REG_SZ 255.255.255.0
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpServer REG_SZ 255.255.255.255
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpServer REG_SZ 192.168.1.1
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip Lease REG_DWORD 3600 (0xE10)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip Lease REG_DWORD 21600 (0x5460)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1263332364 (0x4B4CEC0C)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1263318194 (0x4B4CB4B2)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip T1 REG_DWORD 1263334164 (0x4B4CF314)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip T1 REG_DWORD 1263328994 (0x4B4CDEE2)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip T2 REG_DWORD 1263335514 (0x4B4CF85A)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip T2 REG_DWORD 1263337094 (0x4B4CFE86)
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1263335964 (0x4B4CFA1C)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1263339794 (0x4B4D0912)
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpDefaultGateway REG_MULTI_SZ 192.168.1.1\0\0
> Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{543D8726-8253-4435-B72F-3487803947CD}\Parameters\Tcpip DhcpSubnetMaskOpt REG_MULTI_SZ 255.255.255.0\0\0
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\avjirw6i
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\mbr

Result compared: Different


-----Comparing registry keys CCS1 vs CCS3 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services

Result compared: Identical


===================== Advanced startup entries analysis =====================

HKLM\SOFTWARE\Microsoft\windows\currentversion\run

GrooveMonitor = "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe -- 27/10/2006 00:47:42 -- 27/10/2006 00:47:42 -- 31016
MD5: 38d198a2dd54a67120040566a38103ba SHA1: 8741f10d2b9feb500e744ce66d9277cfed209fe5
[1] .text [2] .rdata [3] .data [4] .rsrc

CloneCDTray = "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s
C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe -- 28/09/2006 20:21:04 -- 28/09/2006 20:21:04 -- 57344
MD5: d7779335b0ebc0a7b9c7d0e1105ea078 SHA1: 4c5a4aec5197b070fa4780242f921b37b4cb3fd2
[1] .text [2] .rdata [3] .data [4] .rsrc

Windows Defender = "C:\Programmi\Windows Defender\MSASCui.exe" -hide
C:\Programmi\Windows Defender\MSASCui.exe -- 03/11/2006 19:20:12 -- 03/11/2006 19:20:12 -- 866584
MD5: 77c03bf23ae56b0a31ae4d5bb4b3d0ac SHA1: 6761523a26c96461b4051d6932cb3ade36a2efb2
[1] .text [2] .data [3] .rsrc

Adobe Acrobat Speed Launcher = "C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe -- 12/06/2008 01:25:18 -- 12/06/2008 01:25:18 -- 37232
MD5: 35fd33eae23af69715ee3231a9f15b82 SHA1: db6e1f0d71d482984f68cd3bc04468e04ea4f9bc
[1] .text [2] .rdata [3] .data [4] .rsrc

Acrobat Assistant 8.0 = "C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe -- 11/06/2008 21:43:26 -- 11/06/2008 21:43:26 -- 640376
MD5: 0fe0edf01cea3beb2e65a904bb87525e SHA1: 941596e4c997b16e77f08cea29f5e43c1d609b59
[1] .text [2] .rdata [3] .data [4] .idata [5] .rsrc

CARPService = carpserv.exe
C:\WINDOWS\system32\carpserv.exe -- 25/03/2009 09:32:33 -- 22/12/2001 05:02:06 -- 4608
MD5: 9aaf44fdf3a5517066b286b80c4a149f SHA1: 8eff1364ff6f7258a89358809eac2f5cca3590af
[1] .text [2] .rdata [3] .data [4] .rsrc

TrueImageMonitor.exe = C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe -- 19/05/2009 23:42:48 -- 19/05/2009 23:42:48 -- 4386216
MD5: c3f0d5d0bbb1aa989ea723706a11c6db SHA1: 32b3da6a97bab565a4c2616c38e67cc5a39d8667
Error Opening File

AcronisTimounterMonitor = C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe -- 19/05/2009 23:46:34 -- 19/05/2009 23:46:34 -- 961080
MD5: 83a33949117456a1c115314e700e646b SHA1: 567e978eb2769cc419e1a1a2dcf714ce34ab2c97
Error Opening File

Servizio Acronis Scheduler2 = "C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe"
C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe -- 19/05/2009 23:45:50 -- 19/05/2009 23:45:50 -- 377472
MD5: 8eb4742736b2084242f6be4eca1edecb SHA1: f3d3467934fd87e531410e6d94e2352369212f0a
Error Opening File

AliceRE_McciTrayApp = C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven~1\syncer\MCCITR~1.EXE
C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven~1\syncer\MCCITR~1.EXE -- 29/10/2009 14:37:33 -- 21/11/2006 15:26:22 -- 936960
MD5: 731be35a5e9bd8aa44b15cd3fa927e9f SHA1: 121db870bee19ba3aeb1a2d0d54be80f304724d5
[1] .text [2] .rdata [3] .data [4] .rsrc

SunJavaUpdateSched = "C:\Programmi\Java\jre6\bin\jusched.exe"
C:\Programmi\Java\jre6\bin\jusched.exe -- 07/01/2009 16:39:24 -- 11/10/2009 04:17:36 -- 149280
MD5: 3a0647bded81dbe0bcbb51d70b22c9e0 SHA1: f7390460fad962232af9cd1c0382f5ea053608ee
[1] .text [2] .rdata [3] .data [4] .rsrc

egui = "C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe -- 01/10/2009 15:06:24 -- 01/10/2009 15:06:24 -- 2054360
MD5: ae610c06a68559ef9f29143d19c39564 SHA1: 0c7f3aadc3b2556996be662a7bbc197b3b1c1ec4
[1] .text [2] .rdata [3] .data [4] .tls [5] .rsrc


HKLM\SOFTWARE\Microsoft\windows\currentversion\policies\explorer\run



HKCU\SOFTWARE\Microsoft\windows\currentversion\run

MSMSGS = "C:\Programmi\Messenger\msmsgs.exe" /background
C:\Programmi\Messenger\msmsgs.exe -- 14/12/2008 15:41:03 -- 13/04/2008 19:14:14 -- 1695232
MD5: 0616984d75338427bbe68d30d20e8fa3 SHA1: 2ffebe6d8c96cde0947a97ff3b06ef047dd5b9b9
Error Opening File

BitTorrent DNA = "C:\Programmi\DNA\btdna.exe"
C:\Programmi\DNA\btdna.exe -- 18/12/2008 21:32:19 -- 13/11/2009 18:31:56 -- 323392
MD5: afa1f8cc076ab0462512a78473d86d53 SHA1: 7878d9e0eae7b09e23fe460f0aa5c24cb7e296c2
[1] UPX0 [2] UPX1 [3] .rsrc

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe -- 13/04/2008 18:14:04 -- 13/04/2008 18:14:04 -- 15360
MD5: f53cddef33a4c41336a782be3d170158 SHA1: 964cca35d3109f49a6f6ebaba820637a5943b43b
[1] .text [2] .data [3] .rsrc



HKCU\SOFTWARE\Microsoft\windows\currentversion\policies\explorer\run



===================== AUTOPLAY SETTINGS =====================

~~~~~~~~~~~~~~~~~~~~~ Registry setting ~~~~~~~~~~~~~~~~~~~~~
(note: default values should be 91 or 95)


-----HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer-----

[Explorer]
"NoDriveTypeAutoRun"=dword:00000143

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer-----

[Explorer]
"NoDriveTypeAutoRun"=dword:00000143

Autorun is enabled on:
DRIVE_UNKNOWN = False
DRIVE_NO_ROOT_DIR = False
DRIVE_REMOVABLE = True
DRIVE_FIXED = True
DRIVE_REMOTE = True
DRIVE_CDROM = True
DRIVE_RAMDISK = False
RESERVED = True

~~~~~~~~~~~~~~~~~~~~~ Autorun.inf files ~~~~~~~~~~~~~~~~~~~~~

### D:\Download\Emule\Adobe\Adobe Acrobat 9 Pro Extended + Crack (PTB-ITA-ESP-NL) (iso)\Adobe Acrobat 9 Pro Extended + Crack (PTB-ITA-ESP-NL)\Autorun.inf
open=Autoplay.exe -auto

### D:\Programmi Vari\Adobe\Acrobat Professional 7\Autorun.inf
open=AutoPlay.exe -auto

### D:\Programmi Vari\Adobe\Acrobat Professional 8\Autorun.inf
open=Autoplay.exe -auto

### D:\Programmi Vari\Adobe\Acrobat Professional 9\Autorun.inf
open=Autoplay.exe -auto

### D:\Programmi Vari\Adobe\Adobe Photoshop CS2 v9\AUTORUN.INF
open=Setup.exe -auto

### D:\Programmi Vari\Adobe\Adobe Photoshop Elements 4.0 Ita\AUTORUN.INF
open=Setup.exe -auto

### D:\Programmi Vari\Adobe\Adobe Photoshop Elements 5 It\AUTORUN.INF
open=Setup.exe -auto

### D:\Programmi Vari\Norton System Works 2006 ITALIANO ok!\AutoRun.inf
OPEN=NCDSTART.EXE

; the path to the trialware directory should be relative to the root of the CD
[TrialWare]
Directory=TrialWre

### D:\Programmi Vari\Pinnacle\Studio 10\CD 1\AUTORUN.INF
open = welcome.exe
icon = welcome.exe

### D:\Programmi Vari\Pinnacle\Studio 10\CD 3\AUTORUN.INF
open = autorun.exe
icon = autorun.exe

### D:\Programmi Vari\Programmi per Backup\Acronis True Image\Acronis True Image Home 10 Italiano\autorun.inf

### D:\Programmi Vari\Programmi per Masterizzare\Nero\Nero 7.5.1.1 Premium Suite\Autorun.inf
open=Setupx.exe



### C:\Programmi\File comuni\Adobe\Bridge CS4 Extensions\Adobe Output Module\mediagallery\resources\flashgallery\AUTORUN.inf
open=HawaiiWPG\resources\template.exe

### C:\Programmi\Nero\Nero 9\Nero Burning ROM\SecurDisc\Autorun.inf
open=discinfo.exe

### C:\Programmi\Nero\Nero 9\Nero Express\SecurDisc\Autorun.inf
open=discinfo.exe

===================== SCHEDULED JOBS =====================

jobs found in C:\WINDOWS:

31/08/2001 12.00.00 65 byte 3056 days old -- C:\WINDOWS\tasks\desktop.ini
11/01/2010 18.27.22 444 byte 1 days old -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
12/01/2010 18.43.16 6 byte 0 days old -- C:\WINDOWS\tasks\SA.DAT
12/01/2010 18.43.22 1124 byte 0 days old -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
12/01/2010 18.46.44 322 byte 0 days old -- C:\WINDOWS\tasks\MP Scheduled Scan.job
12/01/2010 21.46.01 1128 byte 0 days old -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
~~~~~~~~~~~~~~~~~~~~~
Active jobs:

~~~~~~~~~~~~~~~~~~~~~
Most recent (50) lines in jobs scheduled log:

Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 13.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 13.46.16
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 14.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 14.46.00
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 15.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 15.46.00
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 16.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 16.46.00
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 17.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 17.46.00
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineCore.job" (GoogleUpdate.exe)
Avviata 12/01/2010 18.43.19
"GoogleUpdateTaskMachineCore.job" (GoogleUpdate.exe)
Terminata 12/01/2010 18.43.22
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 18.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 18.46.13
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 19.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 19.46.03
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 20.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 20.46.01
Esito: Operazione completata con un codice di uscita (0).
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Avviata 12/01/2010 21.46.00
"GoogleUpdateTaskMachineUA.job" (GoogleUpdate.exe)
Terminata 12/01/2010 21.46.01
Esito: Operazione completata con un codice di uscita (0).

===================== LIST OF ALL SERVICES & DRIVERS =====================

-----HKLM\system\currentcontrolset\services-----

000) "Abiosdsk"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

001) "abp480n5"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

002) "ACPI" - Driver ACPI Microsoft
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\ACPI.sys
---> TYPE = KERNEL_DRIVER

003) "ACPIEC"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

004) "adfs"
---> STAT = (RUNNING) Started automatically
---> TYPE = KERNEL_DRIVER

005) "adpu160m"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

006) "aec" - Eliminatore di eco acustico del kernel Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\aec.sys
---> TYPE = KERNEL_DRIVER

007) "AFD" - AFD
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = \SystemRoot\System32\drivers\afd.sys
---> TYPE = KERNEL_DRIVER

008) "Aha154x"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

009) "aic78u2"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

010) "aic78xx"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

011) "AliIde"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

012) "amsint"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

013) "AN983" - Scheda ADMtek 10/100Mbps Fast Ethernet AN983/AN985/ADM951X
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\AN983.sys
---> TYPE = KERNEL_DRIVER

014) "asc"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

015) "asc3350p"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

016) "asc3550"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

017) "AsyncMac" - Driver per supporti asincroni RAS
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\asyncmac.sys
---> TYPE = KERNEL_DRIVER

018) "atapi" - Controller disco rigido IDE/ESDI standard
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\atapi.sys
---> TYPE = KERNEL_DRIVER

019) "Atdisk"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

020) "ati2mtag"
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\ati2mtag.sys
---> TYPE = KERNEL_DRIVER

021) "Atmarpc" - Protocollo client ARP ATM
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\atmarpc.sys
---> TYPE = KERNEL_DRIVER

022) "audstub" - Driver stub audio
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\audstub.sys
---> TYPE = KERNEL_DRIVER

023) "Beep"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

024) "btaudio" - Periferica audio Bluetooth
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\btaudio.sys
---> TYPE = KERNEL_DRIVER

025) "BTDriver" - Driver di comunicazioni virtuali Bluetooth
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\btport.sys
---> TYPE = KERNEL_DRIVER

026) "BTKRNL" - Enumeratore bus Bluetooth
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\btkrnl.sys
---> TYPE = KERNEL_DRIVER

027) "BTSERIAL" - Bluetooth Serial Driver
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\drivers\btserial.sys
---> TYPE = KERNEL_DRIVER

028) "BTSLBCSP" - Bluetooth Port Client Driver
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\drivers\btslbcsp.sys
---> TYPE = KERNEL_DRIVER

029) "BTWDNDIS" - Server di accesso alla rete LAN Bluetooth
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\btwdndis.sys
---> TYPE = KERNEL_DRIVER

030) "btwmodem" - Modem Bluetooth
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\btwmodem.sys
---> TYPE = KERNEL_DRIVER

031) "BTWUSB" - WIDCOMM USB Bluetooth Driver
---> STAT = (NOT RUNNING) Started manually
---> FILE = System32\Drivers\btwusb.sys
---> TYPE = KERNEL_DRIVER

032) "catchme"
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\ComboFix\catchme.sys
---> TYPE = KERNEL_DRIVER

033) "cbidf2k"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

034) "cd20xrnt"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

035) "Cdaudio"
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

036) "Cdfs"
---> STAT = (RUNNING) Disabled
---> TYPE = FILE_SYSTEM_DRIVER

037) "Cdrom" - Driver del CD-ROM
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\cdrom.sys
---> TYPE = KERNEL_DRIVER

038) "Changer"
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

039) "CmdIde"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

040) "cmuda" - C-Media WDM Audio Interface
---> STAT = (RUNNING) Started manually
---> FILE = system32\drivers\cmuda.sys
---> TYPE = KERNEL_DRIVER

041) "Cpqarray"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

042) "dac2w2k"
---> STAT = (RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

043) "dac960nt"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

044) "Disk" - Driver del disco
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\disk.sys
---> TYPE = KERNEL_DRIVER

045) "dmboot"
---> STAT = (NOT RUNNING) Disabled
---> FILE = System32\drivers\dmboot.sys
---> TYPE = KERNEL_DRIVER

046) "dmio" - Driver Gestione dischi logici
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\dmio.sys
---> TYPE = KERNEL_DRIVER

047) "dmload"
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = KERNEL_DRIVER

048) "DMusic" - Sintetizzatore DLS Microsoft Kernel
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\DMusic.sys
---> TYPE = KERNEL_DRIVER

049) "dpti2o"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

050) "drmkaud" - Decodificatore audio DRM del kernel Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\drmkaud.sys
---> TYPE = KERNEL_DRIVER

051) "eamon" - eamon
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\eamon.sys
---> TYPE = FILE_SYSTEM_DRIVER

052) "ehdrv" - ehdrv
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\ehdrv.sys
---> TYPE = KERNEL_DRIVER

053) "ElbyCDFL" - ElbyCDFL
---> STAT = (RUNNING) Started manually
---> FILE = System32\Drivers\ElbyCDFL.sys
---> TYPE = KERNEL_DRIVER

054) "ElbyCDIO" - ElbyCDIO Driver
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = System32\Drivers\ElbyCDIO.sys
---> TYPE = KERNEL_DRIVER

055) "epfwtdir" - epfwtdir
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\epfwtdir.sys
---> TYPE = KERNEL_DRIVER

056) "Fastfat"
---> STAT = (RUNNING) Disabled
---> TYPE = FILE_SYSTEM_DRIVER

057) "Fdc" - Driver controller disco floppy
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\fdc.sys
---> TYPE = KERNEL_DRIVER

058) "Fips"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

059) "Flpydisk" - Driver disco floppy
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\flpydisk.sys
---> TYPE = KERNEL_DRIVER

060) "FltMgr" - FltMgr
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\fltMgr.sys
---> TYPE = FILE_SYSTEM_DRIVER

061) "Ftdisk" - Driver archiviazione volumi
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\ftdisk.sys
---> TYPE = KERNEL_DRIVER

062) "gameenum" - Enumeratore porta giochi
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\gameenum.sys
---> TYPE = KERNEL_DRIVER

063) "GEARAspiWDM" - GearAspiWDM
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\GEARAspiWDM.sys
---> TYPE = KERNEL_DRIVER

064) "GenericMount" - Generic Mount Driver
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\GenericMount.sys
---> TYPE = KERNEL_DRIVER

065) "Gpc" - Utilità di classificazione pacchetti generica
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\msgpc.sys
---> TYPE = KERNEL_DRIVER

066) "hpn"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

067) "HSFHWBS2"
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\HSFHWBS2.sys
---> TYPE = KERNEL_DRIVER

068) "HSF_DP"
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\HSF_DP.sys
---> TYPE = KERNEL_DRIVER

069) "HSF_DPV"
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\HSF_DPV.sys
---> TYPE = KERNEL_DRIVER

070) "HTTP" - HTTP
---> STAT = (RUNNING) Started manually
---> FILE = System32\Drivers\HTTP.sys
---> TYPE = KERNEL_DRIVER

071) "i2omgmt"
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

072) "i2omp"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

073) "i8042prt" - Driver di porta mouse PS/2 e tastiera i8042
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\i8042prt.sys
---> TYPE = KERNEL_DRIVER

074) "Imapi" - Driver filtro masterizzazione CD
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\imapi.sys
---> TYPE = KERNEL_DRIVER

075) "ini910u"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

076) "IntelIde"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

077) "intelppm" - Driver processore Intel
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\intelppm.sys
---> TYPE = KERNEL_DRIVER

078) "Ip6Fw" - Driver Windows Firewall IPv6
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\Ip6Fw.sys
---> TYPE = KERNEL_DRIVER

079) "IpFilterDriver" - Driver filtro traffico IP
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\ipfltdrv.sys
---> TYPE = KERNEL_DRIVER

080) "IpInIp" - Driver tunnel IP in IP
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\ipinip.sys
---> TYPE = KERNEL_DRIVER

081) "IpNat" - Traduttore indirizzi di rete IP
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\ipnat.sys
---> TYPE = KERNEL_DRIVER

082) "IPSec" - Driver IPSEC
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\ipsec.sys
---> TYPE = KERNEL_DRIVER

083) "IRENUM" - Servizio enumeratore infrarossi
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\irenum.sys
---> TYPE = KERNEL_DRIVER

084) "isapnp" - Driver bus PnP ISA/EISA
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\isapnp.sys
---> TYPE = KERNEL_DRIVER

085) "Kbdclass" - Driver classe tastiera
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\kbdclass.sys
---> TYPE = KERNEL_DRIVER

086) "kmixer" - Mixer wave audio del kernel Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\drivers\kmixer.sys
---> TYPE = KERNEL_DRIVER

087) "KSecDD"
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = KERNEL_DRIVER

088) "Lbd" - Lbd
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\Lbd.sys
---> TYPE = FILE_SYSTEM_DRIVER

089) "lbrtfdc"
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

090) "mdmxsdk"
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\mdmxsdk.sys
---> TYPE = KERNEL_DRIVER

091) "mnmdd"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

092) "Modem"
---> STAT = (RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

093) "MODEMCSA" - Periferica filtro flusso Unimodem
---> STAT = (RUNNING) Started manually
---> FILE = system32\drivers\MODEMCSA.sys
---> TYPE = KERNEL_DRIVER

094) "Mouclass" - Driver classe mouse
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\mouclass.sys
---> TYPE = KERNEL_DRIVER

095) "MountMgr"
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = KERNEL_DRIVER

096) "mraid35x"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

097) "MRENDIS5" - MRENDIS5 NDIS Protocol Driver
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS
---> TYPE = KERNEL_DRIVER

098) "MRxDAV" - Redirector del client WebDav
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\mrxdav.sys
---> TYPE = FILE_SYSTEM_DRIVER

099) "MRxSmb" - MRXSMB
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\mrxsmb.sys
---> TYPE = FILE_SYSTEM_DRIVER

100) "Msfs"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = FILE_SYSTEM_DRIVER

101) "MSKSSRV" - Proxy di servizio di flusso Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\MSKSSRV.sys
---> TYPE = KERNEL_DRIVER

102) "MSPCLOCK" - Proxy clock di flusso Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\MSPCLOCK.sys
---> TYPE = KERNEL_DRIVER

103) "MSPQM" - Proxy di gestione qualità di flusso Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\MSPQM.sys
---> TYPE = KERNEL_DRIVER

104) "mssmbios" - Driver BIOS Microsoft System Management
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\mssmbios.sys
---> TYPE = KERNEL_DRIVER

105) "ms_mpu401" - Driver Microsoft MPU-401 MIDI UART
---> STAT = (RUNNING) Started manually
---> FILE = system32\drivers\msmpu401.sys
---> TYPE = KERNEL_DRIVER

106) "Mup" - Mup
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = FILE_SYSTEM_DRIVER

107) "NDIS" - Driver di sistema NDIS
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = KERNEL_DRIVER

108) "NdisTapi" - Driver TAPI NDIS di accesso remoto
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\ndistapi.sys
---> TYPE = KERNEL_DRIVER

109) "Ndisuio" - Protocollo I/O modalità utente su NDIS
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\ndisuio.sys
---> TYPE = KERNEL_DRIVER

110) "NdisWan" - Driver WAN NDIS di accesso remoto
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\ndiswan.sys
---> TYPE = KERNEL_DRIVER

111) "NDProxy" - multi:Proxy NDIS\00\00
---> STAT = (RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

112) "NetBIOS" - Interfaccia NetBIOS
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\netbios.sys
---> TYPE = FILE_SYSTEM_DRIVER

113) "NetBT" - NetBios su Tcpip
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\netbt.sys
---> TYPE = KERNEL_DRIVER

114) "Npfs"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = FILE_SYSTEM_DRIVER

115) "Ntfs"
---> STAT = (RUNNING) Disabled
---> TYPE = FILE_SYSTEM_DRIVER

116) "Null"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

117) "NwlnkFlt" - Driver filtro traffico IPX
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\nwlnkflt.sys
---> TYPE = KERNEL_DRIVER

118) "NwlnkFwd" - Driver inoltratore traffico IPX
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\nwlnkfwd.sys
---> TYPE = KERNEL_DRIVER

119) "NwlnkIpx" - Protocollo di trasporto compatibile NWLink IPX/SPX/NetBIOS
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\nwlnkipx.sys
---> TYPE = KERNEL_DRIVER

120) "NwlnkNb" - NWLink NetBIOS
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\nwlnknb.sys
---> TYPE = KERNEL_DRIVER

121) "NwlnkSpx" - Protocollo NWLink SPX/SPXII
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\nwlnkspx.sys
---> TYPE = KERNEL_DRIVER

122) "Parport" - Driver della porta parallela
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\parport.sys
---> TYPE = KERNEL_DRIVER

123) "PartMgr"
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = KERNEL_DRIVER

124) "ParVdm"
---> STAT = (RUNNING) Started automatically
---> TYPE = KERNEL_DRIVER

125) "PCI" - Driver bus PCI
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\pci.sys
---> TYPE = KERNEL_DRIVER

126) "PCIDump"
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

127) "PCIIde"
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\pciide.sys
---> TYPE = KERNEL_DRIVER

128) "Pcmcia"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

129) "PDCOMP"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

130) "PDFRAME"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

131) "PDRELI"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

132) "PDRFRAME"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

133) "perc2"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

134) "perc2hib"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

135) "PptpMiniport" - WAN Miniport (PPTP)
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\raspptp.sys
---> TYPE = KERNEL_DRIVER

136) "PSched" - Utilità di pianificazione pacchetti QoS
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\psched.sys
---> TYPE = KERNEL_DRIVER

137) "Ptilink" - Driver Direct Parallel Link
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\ptilink.sys
---> TYPE = KERNEL_DRIVER

138) "PxHelp20" - PxHelp20
---> STAT = (RUNNING) Started by operating system loader
---> FILE = System32\Drivers\PxHelp20.sys
---> TYPE = KERNEL_DRIVER

139) "ql1080"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

140) "Ql10wnt"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

141) "ql12160"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

142) "ql1240"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

143) "ql1280"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

144) "RasAcd" - Driver connessione automatica Accesso remoto
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\rasacd.sys
---> TYPE = KERNEL_DRIVER

145) "Rasl2tp" - WAN Miniport (L2TP)
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\rasl2tp.sys
---> TYPE = KERNEL_DRIVER

146) "RasPppoe" - Driver PPPOE di accesso remoto
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\raspppoe.sys
---> TYPE = KERNEL_DRIVER

147) "Raspti" - Direct Parallel
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\raspti.sys
---> TYPE = KERNEL_DRIVER

148) "Rdbss" - Rdbss
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\rdbss.sys
---> TYPE = FILE_SYSTEM_DRIVER

149) "RDPCDD"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = System32\DRIVERS\RDPCDD.sys
---> TYPE = KERNEL_DRIVER

150) "rdpdr" - Driver redirector periferica Terminal Server
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\rdpdr.sys
---> TYPE = KERNEL_DRIVER

151) "RDPWD"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

152) "redbook" - Driver filtro riproduzione CD-ROM audio digitale
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\redbook.sys
---> TYPE = KERNEL_DRIVER

153) "RTLWUSB" - NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\wg111v2.sys
---> TYPE = KERNEL_DRIVER

154) "Secdrv" - Secdrv
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\secdrv.sys
---> TYPE = KERNEL_DRIVER

155) "serenum" - Driver filtro Serenum
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\serenum.sys
---> TYPE = KERNEL_DRIVER

156) "Serial" - Driver della porta seriale
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\serial.sys
---> TYPE = KERNEL_DRIVER

157) "Sfloppy"
---> STAT = (NOT RUNNING) Started by "IoInitSystem" function
---> TYPE = KERNEL_DRIVER

158) "Simbad"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

159) "sisagp" - Filtro bus SIS AGP
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\sisagp.sys
---> TYPE = KERNEL_DRIVER

160) "snapman" - Acronis Snapshots Manager
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\snapman.sys
---> TYPE = KERNEL_DRIVER

161) "SONYPVU1" - Driver filtro USB Sony (SONYPVU1)
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\SONYPVU1.SYS
---> TYPE = KERNEL_DRIVER

162) "Sparrow"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

163) "splitter" - Frazionatore audio del kernel Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\splitter.sys
---> TYPE = KERNEL_DRIVER

164) "sptd"
---> STAT = (RUNNING) Started by operating system loader
---> FILE = System32\Drivers\sptd.sys
---> TYPE = KERNEL_DRIVER

165) "sr" - Driver filtro Ripristino configurazione di sistema
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\sr.sys
---> TYPE = FILE_SYSTEM_DRIVER

166) "Srv" - Srv
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\srv.sys
---> TYPE = FILE_SYSTEM_DRIVER

167) "StarOpen"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> TYPE = FILE_SYSTEM_DRIVER

168) "StreamDispatcher"
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\strmdisp.sys
---> TYPE = KERNEL_DRIVER

169) "swenum" - Driver bus software
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\swenum.sys
---> TYPE = KERNEL_DRIVER

170) "swmidi" - Sintetizzatore Wavetable GS kernel Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\drivers\swmidi.sys
---> TYPE = KERNEL_DRIVER

171) "symc810"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

172) "symc8xx"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

173) "symsnap" - Symantec Volume Snap Shot Driver
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\symsnap.sys
---> TYPE = FILE_SYSTEM_DRIVER

174) "sym_hi"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

175) "sym_u3"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

176) "sysaudio" - Periferica audio di sistema Microsoft Kernel
---> STAT = (RUNNING) Started manually
---> FILE = system32\drivers\sysaudio.sys
---> TYPE = KERNEL_DRIVER

177) "Tcpip" - Driver protocollo TCP/IP
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\tcpip.sys
---> TYPE = KERNEL_DRIVER

178) "TDPIPE"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

179) "tdrpman228" - Acronis Try&Decide and Restore Points filter (build 228)
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\tdrpm228.sys
---> TYPE = KERNEL_DRIVER

180) "TDTCP"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

181) "TermDD" - Driver della periferica terminale
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = system32\DRIVERS\termdd.sys
---> TYPE = KERNEL_DRIVER

182) "tifsfilter" - Acronis True Image FS Filter
---> STAT = (RUNNING) Started automatically
---> FILE = system32\DRIVERS\tifsfilt.sys
---> TYPE = FILE_SYSTEM_DRIVER

183) "timounter" - Acronis True Image Backup Archive Explorer
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\timntr.sys
---> TYPE = KERNEL_DRIVER

184) "TosIde"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

185) "Udfs"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = FILE_SYSTEM_DRIVER

186) "ultra"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

187) "Update" - Driver aggiornamento microcodice
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\update.sys
---> TYPE = KERNEL_DRIVER

188) "usbccgp" - Driver principale generico USB Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\usbccgp.sys
---> TYPE = KERNEL_DRIVER

189) "usbehci" - Driver Miniport controller enhanced host USB 2.0 Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbehci.sys
---> TYPE = KERNEL_DRIVER

190) "usbhub" - Hub abilitato USB2
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbhub.sys
---> TYPE = KERNEL_DRIVER

191) "usbohci" - Driver miniport per controller open host USB Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbohci.sys
---> TYPE = KERNEL_DRIVER

192) "usbprint" - Classe stampanti USB Microsoft
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\usbprint.sys
---> TYPE = KERNEL_DRIVER

193) "usbscan" - Driver scanner USB
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\usbscan.sys
---> TYPE = KERNEL_DRIVER

194) "USBSTOR" - Driver archiviazione di massa USB
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\USBSTOR.SYS
---> TYPE = KERNEL_DRIVER

195) "usbuhci" - Driver Miniport Controller Universal Host USB Microsoft
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\usbuhci.sys
---> TYPE = KERNEL_DRIVER

196) "v2imount" - Symantec V2i Mount Driver
---> STAT = (NOT RUNNING) Started automatically
---> FILE = system32\DRIVERS\v2imount.sys
---> TYPE = KERNEL_DRIVER

197) "Vax347b"
---> STAT = (RUNNING) Started by operating system loader
---> FILE = system32\DRIVERS\Vax347b.sys
---> TYPE = KERNEL_DRIVER

198) "Vax347s"
---> STAT = (RUNNING) Started by operating system loader
---> FILE = System32\Drivers\Vax347s.sys
---> TYPE = KERNEL_DRIVER

199) "VgaSave"
---> STAT = (RUNNING) Started by "IoInitSystem" function
---> FILE = \SystemRoot\System32\drivers\vga.sys
---> TYPE = KERNEL_DRIVER

200) "ViaIde"
---> STAT = (NOT RUNNING) Disabled
---> TYPE = KERNEL_DRIVER

201) "VolSnap"
---> STAT = (RUNNING) Started by operating system loader
---> TYPE = KERNEL_DRIVER

202) "Wanarp" - Driver ARP IP di accesso remoto
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\wanarp.sys
---> TYPE = KERNEL_DRIVER

203) "Wdf01000" - Kernel Mode Driver Frameworks service
---> STAT = (NOT RUNNING) Started manually
---> FILE = System32\Drivers\wdf01000.sys
---> TYPE = KERNEL_DRIVER

204) "WDICA"
---> STAT = (NOT RUNNING) Started manually
---> TYPE = KERNEL_DRIVER

205) "wdmaud" - Driver di compatibilità audio Microsoft WINMM WDM
---> STAT = (RUNNING) Started manually
---> FILE = system32\drivers\wdmaud.sys
---> TYPE = KERNEL_DRIVER

206) "winachsf"
---> STAT = (RUNNING) Started manually
---> FILE = system32\DRIVERS\HSF_CNXT.sys
---> TYPE = KERNEL_DRIVER

207) "WS2IFSL" - Ambiente di supporto del provider del Servizio Non-IFS di Windows Socket 2.0
---> STAT = (NOT RUNNING) Disabled
---> FILE = \SystemRoot\System32\drivers\ws2ifsl.sys
---> TYPE = KERNEL_DRIVER

208) "WudfPf" - Windows Driver Foundation - User-mode Driver Framework Platform Driver
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\WudfPf.sys
---> TYPE = KERNEL_DRIVER

209) "WudfRd" - Windows Driver Foundation - User-mode Driver Framework Reflector
---> STAT = (NOT RUNNING) Started manually
---> FILE = system32\DRIVERS\wudfrd.sys
---> TYPE = KERNEL_DRIVER

-----HKLM\system\currentcontrolset\services-----

000) "AcrSch2Svc" - Servizio Acronis Scheduler2
---> STAT = (RUNNING) Started automatically
---> FILE = \C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe\
---> TYPE = OWN_SERVICE

001) "Alerter" - Avvisi
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\system32\svchost.exe -k LocalService
---> TYPE = SHARE_SERVICE

002) "ALG" - Servizio Gateway di livello applicazione
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\alg.exe
---> TYPE = OWN_SERVICE

003) "AppMgmt" - Gestione applicazione
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

004) "aspnet_state" - Servizio stato di ASP.NET
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
---> TYPE = OWN_SERVICE

005) "Ati HotKey Poller"
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\Ati2evxx.exe
---> TYPE = OWN_SERVICE

006) "AudioSrv" - Audio Windows
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

007) "BITS" - Servizio trasferimento intelligente in background
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

008) "Browser" - Browser di computer
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

009) "btwdins" - Bluetooth Service
---> STAT = (RUNNING) Started automatically
---> FILE = C:\Programmi\D-Link\Software Bluetooth\bin\btwdins.exe
---> TYPE = OWN_SERVICE

010) "CiSvc" - Servizio di indicizzazione
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\cisvc.exe
---> TYPE = SHARE_SERVICE

011) "ClipSrv" - ClipBook
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\clipsrv.exe
---> TYPE = OWN_SERVICE

012) "clr_optimization_v2.0.50727_32" - .NET Runtime Optimization Service v2.0.50727_X86
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
---> TYPE = OWN_SERVICE

013) "COMSysApp" - Applicazione di sistema COM+
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
---> TYPE = OWN_SERVICE

014) "CryptSvc" - CryptSvc
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

015) "DcomLaunch" - Utilità di avvio processo server DCOM
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost -k DcomLaunch
---> TYPE = SHARE_SERVICE

016) "DfSdkS" - Defragmentation-Service
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\Ashampoo\Ashampoo WinOptimizer 2010\Dfsdks.exe\
---> TYPE = OWN_SERVICE

017) "Dhcp" - Client DHCP
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

018) "dmadmin" - Servizio amministrativo di Gestione disco logico
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\dmadmin.exe /com
---> TYPE = SHARE_SERVICE

019) "dmserver" - Gestione dischi logici
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

020) "Dnscache" - Client DNS
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k NetworkService
---> TYPE = SHARE_SERVICE

021) "Dot3svc" - Configurazione automatica reti cablate
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k dot3svc
---> TYPE = SHARE_SERVICE

022) "EapHost" - Servizio Extensible Authentication Protocol
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k eapsvcs
---> TYPE = SHARE_SERVICE

023) "EhttpSrv" - ESET HTTP Server
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\ESET\ESET NOD32 Antivirus\EHttpSrv.exe\
---> TYPE = OWN_SERVICE

024) "ekrn" - ESET Service
---> STAT = (RUNNING) Started automatically
---> FILE = \C:\Programmi\ESET\ESET NOD32 Antivirus\ekrn.exe\
---> TYPE = OWN_SERVICE

025) "EPSON_EB_RPCV4_01" - EPSON V5 Service4(01)
---> STAT = (RUNNING) Started automatically
---> FILE = C:\Documents and Settings\All Users\Dati applicazioni\EPSON\EPW!3 SSRP\E_S40ST7.EXE
---> TYPE = OWN_SERVICE

026) "EPSON_PM_RPCV4_01" - EPSON V3 Service4(01)
---> STAT = (RUNNING) Started automatically
---> FILE = C:\Documents and Settings\All Users\Dati applicazioni\EPSON\EPW!3 SSRP\E_S40RP7.EXE
---> TYPE = OWN_SERVICE

027) "ERSvc" - Servizio di segnalazione errori
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

028) "EsetNod32Fix" - Nod32 AV
---> STAT = (NOT RUNNING) Started automatically
---> FILE = C:\WINDOWS\Regedit.exe /s %WinDir%\Fix.reg
---> TYPE = OWN_SERVICE

029) "Eventlog" - Registro eventi
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\services.exe
---> TYPE = SHARE_SERVICE

030) "EventSystem" - Sistema di eventi COM+
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

031) "FastUserSwitchingCompatibility" - Compatibilità di Cambio rapido utente
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

032) "Fax" - Fax
---> STAT = (NOT RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\fxssvc.exe
---> TYPE = OWN_SERVICE

033) "FLEXnet Licensing Service" - FLEXnet Licensing Service
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe\
---> TYPE = OWN_SERVICE

034) "FontCache3.0.0.0" - Windows Presentation Foundation Font Cache 3.0.0.0
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
---> TYPE = OWN_SERVICE

035) "gupdate1c9e38bb56a2f10" - Google Update Service (gupdate1c9e38bb56a2f10)
---> STAT = (NOT RUNNING) Started automatically
---> FILE = \C:\Programmi\Google\Update\GoogleUpdate.exe\ /svc
---> TYPE = OWN_SERVICE

036) "helpsvc" - Guida in linea e supporto tecnico
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

037) "HidServ" - Accesso periferica Human Interface
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

038) "hkmsvc" - Servizio gestione chiavi e certificati di integrità
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

039) "HTTPFilter" - SSL HTTP
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k HTTPFilter
---> TYPE = SHARE_SERVICE

040) "IDriverT" - InstallDriver Table Manager
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe\
---> TYPE = OWN_SERVICE

041) "idsvc" - Windows CardSpace
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\
---> TYPE = SHARE_SERVICE

042) "ImapiService" - Servizio COM di masterizzazione CD IMAPI
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\imapi.exe
---> TYPE = OWN_SERVICE

043) "JavaQuickStarterService" - Java Quick Starter
---> STAT = (RUNNING) Started automatically
---> FILE = \C:\Programmi\Java\jre6\bin\jqs.exe\ -service -config \C:\Programmi\Java\jre6\lib\deploy\jqs\jqs.conf\
---> TYPE = OWN_SERVICE

044) "LanmanServer" - Server
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

045) "lanmanworkstation" - Workstation
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

046) "Lavasoft Ad-Aware Service" - Lavasoft Ad-Aware Service
---> STAT = (RUNNING) Started automatically
---> FILE = \C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe\
---> TYPE = OWN_SERVICE

047) "LmHosts" - Helper NetBIOS di TCP/IP
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k LocalService
---> TYPE = SHARE_SERVICE

048) "Messenger" - Messenger
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

049) "Microsoft Office Groove Audit Service" - Microsoft Office Groove Audit Service
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\Microsoft Office\Office12\GrooveAuditService.exe\
---> TYPE = OWN_SERVICE

050) "mnmsrvc" - Condivisione desktop remoto di NetMeeting
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\mnmsrvc.exe
---> TYPE = OWN_SERVICE

051) "MSCSPTISRV" - MSCSPTISRV
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe\
---> TYPE = OWN_SERVICE

052) "MSDTC" - Distributed Transaction Coordinator
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\msdtc.exe
---> TYPE = OWN_SERVICE

053) "MSIServer" - Windows Installer
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\msiexec.exe /V
---> TYPE = SHARE_SERVICE

054) "napagent" - Agente protezione accesso alla rete
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

055) "Nero BackItUp Scheduler 4.0" - Nero BackItUp Scheduler 4.0
---> STAT = (RUNNING) Started automatically
---> FILE = C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
---> TYPE = OWN_SERVICE

056) "NetDDE" - DDE di rete
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\system32\netdde.exe
---> TYPE = SHARE_SERVICE

057) "NetDDEdsdm" - DDE DSDM di rete
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\system32\netdde.exe
---> TYPE = SHARE_SERVICE

058) "Netlogon" - Accesso rete
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\lsass.exe
---> TYPE = SHARE_SERVICE

059) "Netman" - Connessioni di rete
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

060) "NetTcpPortSharing" - Net.Tcp Port Sharing Service
---> STAT = (NOT RUNNING) Disabled
---> FILE = \C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\
---> TYPE = SHARE_SERVICE

061) "Nla" - NLA (Network Location Awareness)
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

062) "NOD32FiXTemDono" - Eset Nod32 Boot
---> STAT = (NOT RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\regedt32.exe /s C:\WINDOWS\nod32fixtemdono.reg
---> TYPE = OWN_SERVICE

063) "NtLmSsp" - Provider supporto protezione LM NT
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\lsass.exe
---> TYPE = SHARE_SERVICE

064) "NtmsSvc" - Archivi rimovibili
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

065) "NwSapAgent" - Agente SAP
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

066) "odserv" - Microsoft Office Diagnostics Service
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE\
---> TYPE = OWN_SERVICE

067) "ose" - Office Source Engine
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE\
---> TYPE = OWN_SERVICE

068) "PACSPTISVR" - PACSPTISVR
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe\
---> TYPE = OWN_SERVICE

069) "PlugPlay" - Plug and Play
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\services.exe
---> TYPE = SHARE_SERVICE

070) "PolicyAgent" - Servizi IPSEC
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\lsass.exe
---> TYPE = SHARE_SERVICE

071) "ProtectedStorage" - Archiviazione protetta
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\lsass.exe
---> TYPE = SHARE_SERVICE

072) "RasAuto" - Auto Connection Manager di Accesso remoto
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

073) "RasMan" - Connection Manager di Accesso remoto
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

074) "RDSessMgr" - Gestione sessione di assistenza mediante desktop remoto
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\sessmgr.exe
---> TYPE = OWN_SERVICE

075) "RemoteAccess" - Routing e Accesso remoto
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

076) "RemoteRegistry" - Registro di sistema remoto
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k LocalService
---> TYPE = SHARE_SERVICE

077) "RpcLocator" - RPC Locator
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\locator.exe
---> TYPE = OWN_SERVICE

078) "RpcSs" - RPC (Remote Procedure Call)
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost -k rpcss
---> TYPE = OWN_SERVICE

079) "RSVP" - QoS RSVP
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\rsvp.exe
---> TYPE = OWN_SERVICE

080) "SamSs" - Gestione account di protezione (SAM)
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\lsass.exe
---> TYPE = SHARE_SERVICE

081) "SCardSvr" - smart card
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\SCardSvr.exe
---> TYPE = SHARE_SERVICE

082) "Schedule" - Utilità di pianificazione
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

083) "seclogon" - Secondary Logon
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

084) "SENS" - Notifica eventi di sistema
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

085) "SharedAccess" - Windows Firewall / Condivisione connessione Internet (ICS)
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

086) "ShellHWDetection" - Rilevamento hardware shell
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

087) "Spooler" - Spooler di stampa
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\spoolsv.exe
---> TYPE = OWN_SERVICE

088) "SPTISRV" - Sony SPTI Service
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe\
---> TYPE = OWN_SERVICE

089) "srservice" - Servizio Ripristino configurazione di sistema
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

090) "SSDPSRV" - Servizio di rilevamento SSDP
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k LocalService
---> TYPE = SHARE_SERVICE

091) "StarWindService" - StarWind iSCSI Service
---> STAT = (RUNNING) Started automatically
---> FILE = C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
---> TYPE = OWN_SERVICE

092) "stisvc" - Acquisizione di immagini di Windows (WIA)
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k imgsvc
---> TYPE = SHARE_SERVICE

093) "SwPrv" - MS Software Shadow Copy Provider
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\dllhost.exe /Processid:{CD7490A7-1506-47DF-A4C5-3D7150E6C46E}
---> TYPE = OWN_SERVICE

094) "SysmonLog" - Avvisi e registri di prestazioni
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\smlogsvc.exe
---> TYPE = OWN_SERVICE

095) "TapiSrv" - Telefonia
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

096) "TermService" - Servizi terminal
---> STAT = (RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost -k DComLaunch
---> TYPE = SHARE_SERVICE

097) "Themes" - Temi
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

098) "TlntSvr" - Telnet
---> STAT = (NOT RUNNING) Disabled
---> FILE = C:\WINDOWS\system32\tlntsvr.exe
---> TYPE = OWN_SERVICE

099) "TrkWks" - Manutenzione collegamenti distribuiti client
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

100) "upnphost" - Host di periferiche Plug and Play universali
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k LocalService
---> TYPE = SHARE_SERVICE

101) "UPS" - Gruppo di continuità
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\ups.exe
---> TYPE = OWN_SERVICE

102) "VSS" - Copia replicata del volume
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\vssvc.exe
---> TYPE = OWN_SERVICE

103) "W32Time" - Ora di Windows
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

104) "WebClient" - WebClient
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k LocalService
---> TYPE = OWN_SERVICE

105) "WinDefend" - Windows Defender
---> STAT = (RUNNING) Started automatically
---> FILE = \C:\Programmi\Windows Defender\MsMpEng.exe\
---> TYPE = OWN_SERVICE

106) "winmgmt" - Strumentazione gestione Windows
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

107) "Winsock"
---> STAT = (RUNNING) Started manually
---> TYPE = ADAPTER

108) "WmdmPmSN" - Portable Media Serial Number Service
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

109) "Wmi" - Estensioni driver di Strumentazione gestione Windows
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

110) "WmiApSrv" - Scheda WMI Performance
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\wbem\wmiapsrv.exe
---> TYPE = OWN_SERVICE

111) "WMPNetworkSvc" - Servizio di condivisione in rete Windows Media Player
---> STAT = (NOT RUNNING) Started manually
---> FILE = \C:\Programmi\Windows Media Player\WMPNetwk.exe\
---> TYPE = OWN_SERVICE

112) "wscsvc" - Centro sicurezza PC
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

113) "wuauserv" - Aggiornamenti automatici
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\system32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

114) "WudfSvc" - Windows Driver Foundation - User-mode Driver Framework
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
---> TYPE = SHARE_SERVICE

115) "WZCSVC" - Zero Configuration reti senza fili
---> STAT = (RUNNING) Started automatically
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

116) "xmlprov" - Servizio Provisioning di rete
---> STAT = (NOT RUNNING) Started manually
---> FILE = C:\WINDOWS\System32\svchost.exe -k netsvcs
---> TYPE = SHARE_SERVICE

===================== SVCHOST INSTANCES =====================

HTTPFilter
+---- HTTPFilter
+---- %SystemRoot%\System32\w3ssl.dll

LocalService
+---- Alerter
+---- %SystemRoot%\system32\alrsvc.dll
+---- WebClient
+---- %SystemRoot%\System32\webclnt.dll
+---- LmHosts
+---- %SystemRoot%\System32\lmhsvc.dll
+---- RemoteRegistry
+---- %SystemRoot%\system32\regsvc.dll
+---- upnphost
+---- %SystemRoot%\System32\upnphost.dll
+---- SSDPSRV
+---- %SystemRoot%\System32\ssdpsrv.dll

NetworkService
+---- DnsCache
+---- %SystemRoot%\System32\dnsrslvr.dll

netsvcs
+---- 6to4
+---- AppMgmt
+---- %SystemRoot%\System32\appmgmts.dll
+---- AudioSrv
+---- %SystemRoot%\System32\audiosrv.dll
+---- Browser
+---- %SystemRoot%\System32\browser.dll
+---- CryptSvc
+---- %SystemRoot%\System32\cryptsvc.dll
+---- DMServer
+---- %SystemRoot%\System32\dmserver.dll
+---- DHCP
+---- %SystemRoot%\System32\dhcpcsvc.dll
+---- ERSvc
+---- %SystemRoot%\System32\ersvc.dll
+---- EventSystem
+---- C:\WINDOWS\system32\es.dll
+---- FastUserSwitchingCompatibility
+---- %SystemRoot%\System32\shsvcs.dll
+---- HidServ
+---- %SystemRoot%\System32\hidserv.dll
+---- Ias
+---- Iprip
+---- Irmon
+---- LanmanServer
+---- %SystemRoot%\System32\srvsvc.dll
+---- LanmanWorkstation
+---- %SystemRoot%\System32\wkssvc.dll
+---- Messenger
+---- %SystemRoot%\System32\msgsvc.dll
+---- Netman
+---- %SystemRoot%\System32\netman.dll
+---- Nla
+---- %SystemRoot%\System32\mswsock.dll
+---- Ntmssvc
+---- %SystemRoot%\system32\ntmssvc.dll
+---- NWCWorkstation
+---- Nwsapagent
+---- %SystemRoot%\System32\ipxsap.dll
+---- Rasauto
+---- %SystemRoot%\System32\rasauto.dll
+---- Rasman
+---- %SystemRoot%\System32\rasmans.dll
+---- Remoteaccess
+---- %SystemRoot%\System32\mprdim.dll
+---- Schedule
+---- %SystemRoot%\system32\schedsvc.dll
+---- Seclogon
+---- %SystemRoot%\System32\seclogon.dll
+---- SENS
+---- %SystemRoot%\system32\sens.dll
+---- Sharedaccess
+---- %SystemRoot%\System32\ipnathlp.dll
+---- SRService
+---- %SystemRoot%\system32\srsvc.dll
+---- Tapisrv
+---- %SystemRoot%\System32\tapisrv.dll
+---- Themes
+---- %SystemRoot%\System32\shsvcs.dll
+---- TrkWks
+---- %SystemRoot%\system32\trkwks.dll
+---- W32Time
+---- %systemroot%\system32\w32time.dll
+---- WZCSVC
+---- %SystemRoot%\System32\wzcsvc.dll
+---- Wmi
+---- %SystemRoot%\System32\advapi32.dll
+---- WmdmPmSp
+---- winmgmt
+---- %SystemRoot%\system32\wbem\WMIsvc.dll
+---- wscsvc
+---- %SYSTEMROOT%\system32\wscsvc.dll
+---- xmlprov
+---- %SystemRoot%\System32\xmlprov.dll
+---- napagent
+---- %SystemRoot%\System32\qagentrt.dll
+---- hkmsvc
+---- %SystemRoot%\System32\kmsvc.dll
+---- BITS
+---- %systemroot%\system32\qmgr.dll
+---- wuauserv
+---- C:\WINDOWS\system32\wuauserv.dll
+---- ShellHWDetection
+---- %SystemRoot%\System32\shsvcs.dll
+---- helpsvc
+---- %WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll

DcomLaunch
+---- DcomLaunch
+---- %SystemRoot%\system32\rpcss.dll
+---- TermService
+---- %SystemRoot%\System32\termsrv.dll

rpcss
+---- RpcSs
+---- %SystemRoot%\System32\rpcss.dll

eapsvcs
+---- eaphost
+---- %SystemRoot%\System32\eapsvc.dll

dot3svc
+---- dot3svc
+---- %SystemRoot%\System32\dot3svc.dll

imgsvc
+---- StiSvc
+---- %SystemRoot%\system32\wiaservc.dll

termsvcs
+---- TermService
+---- %SystemRoot%\System32\termsrv.dll

WudfServiceGroup
+---- WUDFSvc
+---- %SystemRoot%\System32\WUDFSvc.dll

===================== LOADED MODULES =====================

*** NOTE *** Process uuoywfrygn.exe belongs to SystemScan
Already known legit dlls are not shown

---

System pid: 4
Command line: <no command line>

---

smss.exe pid: 652
Command line: \SystemRoot\System32\smss.exe

Base Size Version Path
0x48580000 0xf000 \SystemRoot\System32\smss.exe

---

csrss.exe pid: 732
Command line: C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

Base Size Version Path
0x4a680000 0x5000 \??\C:\WINDOWS\system32\csrss.exe
0x75af0000 0xb000 5.01.2600.5512 C:\WINDOWS\system32\CSRSRV.dll
0x75b00000 0x10000 5.01.2600.5512 C:\WINDOWS\system32\basesrv.dll
0x75b10000 0x4b000 5.01.2600.5512 C:\WINDOWS\system32\winsrv.dll

---

winlogon.exe pid: 756
Command line: winlogon.exe

Base Size Version Path
0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe
0x77690000 0x12000 5.01.2600.5512 C:\WINDOWS\system32\AUTHZ.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x10000000 0x17000 6.14.0010.4096 C:\WINDOWS\system32\Ati2evxx.dll
0x47190000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\dimsntfy.dll
0x014a0000 0x42000 1.09.0040.0000 C:\WINDOWS\system32\WgaLogon.dll
0x012a0000 0x13000 4.00.0000.0344 C:\Programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x74e80000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemprox.dll
0x74e60000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemsvc.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x74910000 0x123000 8.100.1051.0000 C:\WINDOWS\system32\msxml3.dll

---

services.exe pid: 800
Command line: C:\WINDOWS\system32\services.exe

Base Size Version Path
0x01000000 0x1d000 5.01.2600.5755 C:\WINDOWS\system32\services.exe
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x77b40000 0x54000 5.01.2600.5512 C:\WINDOWS\system32\SCESRV.dll
0x77690000 0x12000 5.01.2600.5512 C:\WINDOWS\system32\AUTHZ.dll
0x7dbb0000 0x21000 5.01.2600.5512 C:\WINDOWS\system32\umpnpmgr.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x474b0000 0xf000 5.01.2600.5512 C:\WINDOWS\AppPatch\AcAdProc.dll
0x772d0000 0x11000 5.01.2600.5512 C:\WINDOWS\system32\eventlog.dll

---

lsass.exe pid: 812
Command line: C:\WINDOWS\system32\lsass.exe

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\lsass.exe
0x753e0000 0xb6000 5.01.2600.5834 C:\WINDOWS\system32\LSASRV.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x743d0000 0x6e000 5.01.2600.5512 C:\WINDOWS\system32\SAMSRV.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x4d200000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\msprivs.dll
0x71c80000 0x4c000 5.01.2600.5834 C:\WINDOWS\system32\kerberos.dll
0x74440000 0x65000 5.01.2600.5512 C:\WINDOWS\system32\netlogon.dll
0x76780000 0x2d000 5.01.2600.5512 C:\WINDOWS\system32\w32time.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x767b0000 0x28000 5.01.2600.5834 C:\WINDOWS\system32\schannel.dll
0x7e8c0000 0x11000 5.01.2600.5834 C:\WINDOWS\system32\wdigest.dll
0x7d520000 0x31000 5.01.2600.5512 C:\WINDOWS\system32\scecli.dll
0x68100000 0x26000 5.01.2600.5507 C:\WINDOWS\system32\dssenh.dll
0x74360000 0x30000 5.01.2600.5512 C:\WINDOWS\system32\ipsecsvc.dll
0x77690000 0x12000 5.01.2600.5512 C:\WINDOWS\system32\AUTHZ.dll
0x756d0000 0xd0000 5.01.2600.5886 C:\WINDOWS\system32\oakley.DLL
0x742f0000 0xb000 5.01.2600.5512 C:\WINDOWS\system32\WINIPSEC.DLL
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x74320000 0xb000 5.01.2600.5512 C:\WINDOWS\system32\pstorsvc.dll
0x74340000 0x1b000 5.01.2600.5512 C:\WINDOWS\system32\psbase.dll

---

ati2evxx.exe pid: 972
Command line: C:\WINDOWS\system32\Ati2evxx.exe

Base Size Version Path
0x00400000 0x67000 6.14.0010.4096 C:\WINDOWS\system32\Ati2evxx.exe
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime

---

svchost.exe pid: 984
Command line: C:\WINDOWS\system32\svchost -k DcomLaunch

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x77690000 0x12000 5.01.2600.5512 c:\windows\system32\AUTHZ.dll
0x76ae0000 0x11000 3.05.2284.0002 c:\windows\system32\ATL.DLL
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll

---

svchost.exe pid: 1040
Command line: C:\WINDOWS\system32\svchost -k rpcss

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x71ec0000 0x6000 5.01.2600.0000 C:\WINDOWS\System32\wshisn.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll

---

MsMpEng.exe pid: 1136
Command line: "C:\Programmi\Windows Defender\MsMpEng.exe"

Base Size Version Path
0x01000000 0x4000 1.01.1593.0000 C:\Programmi\Windows Defender\MsMpEng.exe
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x5c800000 0x44000 1.01.1593.0000 C:\Programmi\Windows Defender\MpSvc.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x5b800000 0x4f000 1.01.1593.0000 C:\Programmi\Windows Defender\MpClient.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5a100000 0x4d1000 1.01.5302.0000 C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Definition Updates\{CDCC8775-CA5B-4A26-BEA6-FD844D1AFE27}\mpengine.dll
0x006f0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x5e800000 0xf000 1.01.1593.0000 C:\Programmi\Windows Defender\mprtplug.dll
0x60800000 0xf000 1.01.1593.0000 C:\Programmi\Windows Defender\MpAsDesc.dll

---

svchost.exe pid: 1176
Command line: C:\WINDOWS\System32\svchost.exe -k netsvcs

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\System32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\System32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\System32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\System32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x76ee0000 0x27000 5.01.2600.5625 c:\windows\system32\DNSAPI.dll
0x4cf40000 0xb000 5.01.2600.5512 c:\windows\system32\EapolQec.dll
0x76ae0000 0x11000 3.05.2284.0002 c:\windows\system32\ATL.DLL
0x745c0000 0x16000 5.01.2600.5512 c:\windows\system32\QUtil.dll
0x76030000 0x65000 6.02.3104.0000 c:\windows\system32\MSVCP60.dll
0x72960000 0xa000 5.01.2600.5512 c:\windows\system32\dot3api.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\System32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x014e0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x767b0000 0x28000 5.01.2600.5834 C:\WINDOWS\System32\SCHANNEL.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\System32\cryptdll.dll
0x76760000 0x13000 5.01.2600.5512 c:\windows\system32\NTDSAPI.dll
0x6ff20000 0x6b000 6.07.2600.5512 c:\windows\system32\qmgr.dll
0x74f20000 0x9000 2600.5512.0503.0000 c:\windows\system32\dmserver.dll
0x76bc0000 0x2e000 5.01.2600.5512 C:\WINDOWS\System32\credui.dll
0x73640000 0x6000 5.01.2600.5512 C:\WINDOWS\System32\dot3dlg.dll
0x5ad00000 0x28000 5.01.2600.5512 C:\WINDOWS\System32\OneX.DLL
0x71680000 0x22000 5.01.2600.5512 C:\WINDOWS\System32\eappcfg.dll
0x73b40000 0xe000 5.01.2600.5512 C:\WINDOWS\System32\eappprxy.dll
0x776e0000 0x44000 2001.12.4414.0706 c:\windows\system32\es.dll
0x74ed0000 0xc000 5.01.2600.5512 c:\windows\pchealth\helpctr\binaries\pchsvc.dll
0x665d0000 0x17000 5.01.2600.0000 c:\windows\system32\ipxsap.dll
0x5d780000 0x1c000 5.01.2600.0000 c:\windows\system32\rtm.dll
0x71fd0000 0x12000 5.01.2600.0000 c:\windows\system32\adptif.dll
0x76780000 0x2d000 5.01.2600.5512 c:\windows\system32\w32time.dll
0x4f120000 0x28000 5.01.2600.5512 c:\windows\system32\wbem\wmisvc.dll
0x50000000 0x5000 5.04.3790.5512 c:\windows\system32\wuauserv.dll
0x50040000 0x1d9000 7.04.7600.0226 C:\WINDOWS\system32\wuaueng.dll
0x750e0000 0x13000 5.01.2600.5512 C:\WINDOWS\System32\Cabinet.dll
0x604f0000 0xb000 5.01.2600.5512 C:\WINDOWS\System32\mspatcha.dll
0x77690000 0x12000 5.01.2600.5512 c:\windows\system32\AUTHZ.dll
0x74e60000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemsvc.dll
0x742f0000 0xb000 5.01.2600.5512 C:\WINDOWS\System32\WINIPSEC.DLL
0x58080000 0x36000 5.01.2600.5512 C:\WINDOWS\System32\unimdm.tsp
0x5b480000 0x16000 5.01.2600.5512 C:\WINDOWS\System32\unimdmat.dll
0x61ab0000 0x29000 5.01.2600.5512 C:\WINDOWS\system32\modemui.dll
0x58100000 0xb000 5.01.2600.5512 C:\WINDOWS\System32\kmddsp.tsp
0x580e0000 0x10000 5.01.2600.5512 C:\WINDOWS\System32\ndptsp.tsp
0x58110000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\ipconf.tsp
0x58130000 0x46000 5.01.2600.5512 C:\WINDOWS\System32\h323.tsp
0x58120000 0xa000 5.01.2600.5512 C:\WINDOWS\System32\hidphone.tsp
0x71c80000 0x4c000 5.01.2600.5834 C:\WINDOWS\system32\kerberos.dll
0x723c0000 0x13000 5.01.2600.5512 C:\WINDOWS\System32\RASQEC.DLL
0x71f00000 0x9000 5.01.2600.5512 C:\WINDOWS\System32\ipxwan.dll
0x74910000 0x123000 8.100.1051.0000 C:\WINDOWS\system32\msxml3.dll
0x68100000 0x26000 5.01.2600.5507 C:\WINDOWS\System32\dssenh.dll
0x65000000 0x2e000 8.00.6001.18702 C:\WINDOWS\system32\advpack.dll
0x70040000 0x9e000 2001.12.4414.0700 C:\WINDOWS\System32\catsrvut.dll
0x70100000 0x3d000 2001.12.4414.0700 C:\WINDOWS\System32\catsrv.dll
0x61df0000 0x9000 2001.12.4414.0700 C:\WINDOWS\System32\MfcSubs.dll

---

svchost.exe pid: 1220
Command line: C:\WINDOWS\system32\svchost.exe -k NetworkService

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x76ee0000 0x27000 5.01.2600.5625 c:\windows\system32\DNSAPI.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll

---

svchost.exe pid: 1276
Command line: C:\WINDOWS\system32\svchost.exe -k LocalService

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x76ab0000 0x12000 5.01.2600.5512 c:\windows\system32\regsvc.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll

---

ati2evxx.exe pid: 1596
Command line: Ati2evxx.exe -Client

Base Size Version Path
0x00400000 0x67000 6.14.0010.4096 C:\WINDOWS\system32\Ati2evxx.exe
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll

---

explorer.exe pid: 1680
Command line: C:\WINDOWS\Explorer.EXE

Base Size Version Path
0x01000000 0xff000 6.00.2900.5512 C:\WINDOWS\Explorer.EXE
0x75f30000 0xfd000 6.00.2900.5512 C:\WINDOWS\system32\BROWSEUI.dll
0x7e210000 0x171000 6.00.2900.5512 C:\WINDOWS\system32\SHDOCVW.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x68ef0000 0xf1000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x68ff0000 0x7000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\MSImg32.dll
0x5ba40000 0x72000 6.00.2900.5512 C:\WINDOWS\system32\themeui.dll
0x76940000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\LINKINFO.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x65e30000 0x37000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
0x74910000 0x123000 8.100.1051.0000 C:\WINDOWS\system32\msxml3.dll
0x76bc0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\credui.dll
0x72960000 0xa000 5.01.2600.5512 C:\WINDOWS\system32\dot3api.dll
0x73640000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\dot3dlg.dll
0x5ad00000 0x28000 5.01.2600.5512 C:\WINDOWS\system32\OneX.DLL
0x71680000 0x22000 5.01.2600.5512 C:\WINDOWS\system32\eappcfg.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x73b40000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\eappprxy.dll
0x40260000 0xa93000 8.00.6001.18854 C:\WINDOWS\system32\ieframe.dll
0x5f800000 0x16000 1.01.1593.0000 C:\PROGRA~1\WIFD1F~1\MpShHook.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x75d50000 0x91000 6.00.2900.5512 C:\WINDOWS\system32\MLANG.dll
0x66b40000 0x17d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR326C~1.DLL
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x164a0000 0x23000 5.02.5721.5145 C:\WINDOWS\system32\wpdshserviceobj.dll
0x10000000 0x11000 4.00.0001.2303 C:\WINDOWS\system32\btncopy.dll
0x761e0000 0x21000 5.01.2600.5512 C:\WINDOWS\system32\stobject.dll
0x74a80000 0xa000 6.00.2900.5512 C:\WINDOWS\system32\BatMeter.dll
0x109c0000 0x2c000 5.02.5721.5145 C:\WINDOWS\system32\portabledevicetypes.dll
0x10930000 0x49000 5.02.5721.5145 C:\WINDOWS\system32\portabledeviceapi.dll
0x692e0000 0x8d000 5.02.2600.5512 C:\WINDOWS\system32\fxsst.dll
0x60270000 0x72000 5.02.2600.5512 C:\WINDOWS\system32\FXSAPI.dll
0x01910000 0x13000 4.00.0000.0344 C:\Programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
0x75f10000 0x7000 5.01.2600.5512 C:\WINDOWS\System32\drprov.dll
0x71ba0000 0xe000 5.01.2600.5512 C:\WINDOWS\System32\ntlanman.dll
0x71c60000 0x17000 5.01.2600.5512 C:\WINDOWS\System32\NETUI0.dll
0x71c20000 0x40000 5.01.2600.5512 C:\WINDOWS\System32\NETUI1.dll
0x75f20000 0xa000 5.01.2600.5512 C:\WINDOWS\System32\davclnt.dll
0x71600000 0x13000 6.00.2900.5512 C:\WINDOWS\system32\browselc.dll
0x03290000 0x1a5000 12.00.4518.1014 C:\Programmi\Microsoft Office\Office12\1040\GrooveIntlResource.dll
0x4b440000 0x86000 5.41.0015.1515 C:\WINDOWS\system32\MSFTEDIT.DLL
0x6c6b0000 0x4d000 5.01.2600.5512 C:\WINDOWS\system32\DUSER.dll
0x73b10000 0x14000 5.01.2600.5512 C:\WINDOWS\system32\sti.dll
0x74a70000 0x7000 5.01.2600.5512 C:\WINDOWS\system32\CFGMGR32.dll
0x040e0000 0x4c000 9.00.0000.0000 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA
0x01ff0000 0xf000 C:\Programmi\D-Link\Software Bluetooth\btkeyind.dll
0x03d30000 0x4a000 1.02.0001.1551 C:\Programmi\File comuni\Adobe\Adobe Drive CS4\BIB.dll
0x61800000 0x15b000 4.00.0000.0344 C:\Programmi\File comuni\Adobe\Adobe Version Cue CS4\Client\4.0.0\VersionCue.DLL
0x05400000 0x54000 9.00.0005.0332 C:\Programmi\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.ita
0x16200000 0x6000 4.01.0000.0000 C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
0x04c80000 0x147000 4.00.0000.0344 C:\Programmi\File comuni\Adobe\Adobe Drive CS4\ADFSMenu.dll
0x01300000 0x18000 1.03.0000.0000 C:\Programmi\Malwarebytes' Anti-Malware\mbamext.dll
0x04fd0000 0xa3000 C:\PROGRA~1\Ashampoo\ASHAMP~1\CONTEX~1.DLL
0x051c0000 0xd5000 12.00.0000.9769 C:\Programmi\Acronis\TrueImageHome\tishell.dll
0x03680000 0x41000 4.00.0000.0525 C:\Programmi\Acronis\TrueImageHome\timounter.dll
0x02060000 0x2e000 3.80.0000.0000 C:\Programmi\WinRAR\rarext.dll
0x02530000 0x17000 1.00.0000.0001 C:\Programmi\Lavasoft\Ad-Aware\ShellExt.dll
0x78480000 0x8e000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCP90.dll
0x78520000 0xa3000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCR90.dll
0x78e20000 0x2a000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\ATL90.DLL
0x22000000 0x31000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\shellExt.dll
0x03810000 0x45000 2.00.0001.0000 C:\Programmi\Epson Software\Easy Photo Print\EPPShell.dll
0x05e80000 0x209000 4.00.0005.0100 C:\Programmi\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll
0x781d0000 0x10f000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL
0x4ebd0000 0x1ab000 5.02.6001.22319 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x75df0000 0x21000 5.01.2600.5512 C:\WINDOWS\system32\MSVFW32.dll
0x5d360000 0xf000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80ITA.DLL
0x69940000 0x16000 5.01.2600.5512 C:\WINDOWS\system32\Faultrep.dll
0x73250000 0x5000 5.01.2600.0000 C:\WINDOWS\system32\RICHED32.DLL
0x74dc0000 0x6d000 5.30.0023.1230 C:\WINDOWS\system32\RICHED20.dll
0x05770000 0xa8000 9.00.0005.0332 C:\Programmi\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.dll
0x782e0000 0x10f000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL
0x736d0000 0x4b000 5.03.2600.5512 C:\WINDOWS\system32\ddraw.dll
0x73b30000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\DCIMAN32.dll
0x4f4b0000 0x61000 5.01.2600.5512 C:\WINDOWS\system32\wzcdlg.dll
0x05470000 0x1f7000 6.02.0010.0031 C:\Programmi\File comuni\Nero\SMC\NeroDigitalExt.dll
0x03c60000 0x5b000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll
0x71cd0000 0x1b000 6.00.2900.5512 C:\WINDOWS\system32\actxprxy.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x74b10000 0x8f000 5.01.2600.5512 C:\WINDOWS\system32\printui.dll

---

AAWService.exe pid: 1696
Command line: "C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe"

Base Size Version Path
0x00400000 0x102000 8.00.0000.0000 C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe
0x10000000 0x41000 C:\Programmi\Lavasoft\Ad-Aware\RPAPI.dll
0x78480000 0x8e000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCP90.dll
0x78520000 0xa3000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCR90.dll
0x4dd50000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\FLTLIB.DLL
0x00350000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x00d00000 0x190000 C:\Programmi\Lavasoft\Ad-Aware\Resources.dll
0x73540000 0x47000 5.01.2600.5512 C:\WINDOWS\system32\mstask.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x013c0000 0x57000 7.01.0000.0012 C:\Programmi\Lavasoft\Ad-Aware\lavalicense.dll
0x74e80000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemprox.dll
0x74e60000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemsvc.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x01d10000 0xa4000 8.00.0000.0000 C:\Programmi\Lavasoft\Ad-Aware\ceapi.dll
0x01dd0000 0x38000 3.80.0002.0166 C:\Programmi\Lavasoft\Ad-Aware\unrar.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x76940000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\LINKINFO.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x40260000 0xa93000 8.00.6001.18854 C:\WINDOWS\system32\ieframe.dll
0x76bc0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\credui.dll
0x72960000 0xa000 5.01.2600.5512 C:\WINDOWS\system32\dot3api.dll
0x73640000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\dot3dlg.dll
0x5ad00000 0x28000 5.01.2600.5512 C:\WINDOWS\system32\OneX.DLL
0x71680000 0x22000 5.01.2600.5512 C:\WINDOWS\system32\eappcfg.dll
0x73b40000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\eappprxy.dll
0x05180000 0x13000 4.00.0000.0344 C:\Programmi\File comuni\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
0x75f10000 0x7000 5.01.2600.5512 C:\WINDOWS\System32\drprov.dll
0x71ba0000 0xe000 5.01.2600.5512 C:\WINDOWS\System32\ntlanman.dll
0x71c60000 0x17000 5.01.2600.5512 C:\WINDOWS\System32\NETUI0.dll
0x71c20000 0x40000 5.01.2600.5512 C:\WINDOWS\System32\NETUI1.dll
0x75f20000 0xa000 5.01.2600.5512 C:\WINDOWS\System32\davclnt.dll

---

spoolsv.exe pid: 1844
Command line: C:\WINDOWS\system32\spoolsv.exe

Base Size Version Path
0x01000000 0x10000 5.01.2600.5512 C:\WINDOWS\system32\spoolsv.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x00980000 0xc000 9.00.0000.0000 C:\WINDOWS\system32\AdobePDF.dll
0x00990000 0x18000 2.09.0000.0000 C:\WINDOWS\system32\E_FLBFAE.DLL
0x00cc0000 0x14000 1.04.0000.0000 C:\WINDOWS\system32\E_FLBBGE.DLL
0x693f0000 0x9000 5.02.2600.5512 C:\WINDOWS\system32\FXSMON.DLL
0x69410000 0x12000 5.02.2600.5512 C:\WINDOWS\system32\FXSEVENT.dll
0x10000000 0x1c000 4.00.0001.2303 C:\WINDOWS\system32\bthcrp.dll
0x00ce0000 0xfa000 4.00.0001.2303 C:\WINDOWS\system32\WidcommSdk.dll
0x00de0000 0xca000 4.00.0001.2303 C:\WINDOWS\system32\wbtapi.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x00ed0000 0x9000 0.03.4518.1014 C:\WINDOWS\system32\msonpmon.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x3f420000 0x1b000 6.01.2600.5635 C:\WINDOWS\System32\spool\PRTPROCS\W32X86\filterpipelineprintproc.dll
0x00f50000 0x9000 0.03.4518.1014 C:\WINDOWS\System32\spool\PRTPROCS\W32X86\msonpppr.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\System32\mswsock.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x68f00000 0x161000 0.03.0052.0012 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FUICFAE.DLL
0x73aa0000 0x15000 5.01.2600.5627 C:\WINDOWS\system32\mscms.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x01120000 0x27000 0.03.0001.0026 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FMAIFAE.DLL

---

GrooveMonitor.exe pid: 680
Command line: "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"

Base Size Version Path
0x00400000 0x8000 12.00.4518.1014 C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe
0x68ef0000 0xf1000 12.00.4518.1014 C:\Programmi\Microsoft Office\Office12\GrooveUtil.DLL
0x00350000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x68ff0000 0x7000 12.00.4518.1014 C:\Programmi\Microsoft Office\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\MSImg32.dll
0x65e30000 0x37000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x76940000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\LINKINFO.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x74910000 0x123000 8.100.1051.0000 C:\WINDOWS\system32\msxml3.dll

---

MSASCui.exe pid: 716
Command line: "C:\Programmi\Windows Defender\MSASCui.exe" -hide

Base Size Version Path
0x01000000 0xd7000 1.01.1593.0000 C:\Programmi\Windows Defender\MSASCui.exe
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x5b800000 0x4f000 1.01.1593.0000 C:\Programmi\Windows Defender\MpClient.dll
0x4ebd0000 0x1ab000 5.02.6001.22319 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x74c10000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x61800000 0x9c000 1.01.1593.0000 C:\Programmi\Windows Defender\MsMpRes.dll
0x5d800000 0xac000 1.01.1593.0000 C:\Programmi\Windows Defender\MpRtMon.DLL
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x4b440000 0x86000 5.41.0015.1515 C:\WINDOWS\system32\MSFTEDIT.DLL
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime

---

acrotray.exe pid: 816
Command line: "C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

Base Size Version Path
0x00400000 0x9f000 9.00.0000.0332 C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
0x74c10000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\OLEACC.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x10000000 0x7000 9.00.0000.0000 C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.ita
0x00a50000 0x7000 9.00.0000.0000 C:\Programmi\Adobe\Acrobat 9.0\Acrobat\AcroTray.ESP
0x00a70000 0x7000 9.00.0000.0000 C:\Programmi\Adobe\Acrobat 9.0\Acrobat\AcroTray.NLD
0x00a90000 0x7000 9.00.0000.0000 C:\Programmi\Adobe\Acrobat 9.0\Acrobat\AcroTray.PTB
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll

---

carpserv.exe pid: 996
Command line: "C:\WINDOWS\system32\carpserv.exe"

Base Size Version Path
0x00400000 0x5000 1.00.0000.0001 C:\WINDOWS\system32\carpserv.exe

---

TrueImageMonitor.exe pid: 1088
Command line: "C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe"

Base Size Version Path
0x00400000 0x3aa000 12.00.0000.9769 C:\Programmi\Acronis\TrueImageHome\TrueImageMonitor.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x20300000 0x43000 1.00.0000.0009 C:\Programmi\Acronis\TrueImageHome\Common\resource.dll
0x20100000 0x10000 1.00.0000.0145 C:\Programmi\Acronis\TrueImageHome\Common\gc.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x10000000 0x3e000 3.05.0000.0423 C:\Programmi\File comuni\Acronis\SnapAPI\snapapi.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x20600000 0x7000 1.00.0000.0014 C:\Programmi\Acronis\TrueImageHome\Common\thread_pool.dll
0x019c0000 0xa000 1.00.0000.0123 C:\Programmi\Acronis\TrueImageHome\Common\rpc_client.dll
0x01c10000 0x2da000 1.00.0000.0228 C:\Programmi\File comuni\Acronis\TrueImageHome\tdrpapi.dll

---

TimounterMonitor.exe pid: 1128
Command line: "C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe"

Base Size Version Path
0x00400000 0xe7000 4.00.0000.0453 C:\Programmi\Acronis\TrueImageHome\TimounterMonitor.exe
0x10000000 0x1a0000 2.00.0000.0003 C:\Programmi\Acronis\TrueImageHome\fox.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x7e430000 0x89000 5.02.3790.4110 C:\WINDOWS\system32\hhctrl.ocx
0x68de0000 0x18000 4.74.9273.0000 C:\WINDOWS\system32\mui\0010\hhctrlui.dll
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\msimg32.dll
0x20700000 0x151000 3.08.0001.0000 C:\Programmi\Acronis\TrueImageHome\Common\icu38.dll
0x00ad0000 0x183000 3.08.0001.0000 C:\Programmi\Acronis\TrueImageHome\Common\icudt38.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x4ebd0000 0x1ab000 5.02.6001.22319 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x20600000 0x7000 1.00.0000.0014 C:\Programmi\Acronis\TrueImageHome\Common\thread_pool.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll

---

schedhlp.exe pid: 1240
Command line: "C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe"

Base Size Version Path
0x00400000 0x5d000 1.00.0000.0318 C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll

---

MCCITR~1.EXE pid: 1256
Command line: "C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven~1\syncer\MCCITR~1.EXE"

Base Size Version Path
0x00400000 0xea000 5.00.0000.0055 C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven~1\syncer\MCCITR~1.EXE
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x5b160000 0xa000 5.01.2600.5512 C:\WINDOWS\system32\VDMDBG.DLL

---

jusched.exe pid: 1252
Command line: "C:\Programmi\Java\jre6\bin\jusched.exe"

Base Size Version Path
0x00400000 0x25000 6.00.0170.0004 C:\Programmi\Java\jre6\bin\jusched.exe
0x00340000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x72240000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\sensapi.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\System32\mswsock.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll

---

egui.exe pid: 1312
Command line: "C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

Base Size Version Path
0x00400000 0x1f7000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\egui.exe
0x782e0000 0x10f000 8.00.50727.4053 C:\Programmi\ESET\ESET NOD32 Antivirus\MFC80U.DLL
0x78130000 0x9b000 8.00.50727.4053 C:\Programmi\ESET\ESET NOD32 Antivirus\MSVCR80.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x5d360000 0xf000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80ITA.DLL
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x21c00000 0x49000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiScan.dll
0x21400000 0x21000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiAmon.dll
0x21600000 0x19000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiEmon.dll
0x23200000 0x17000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiDmon.dll
0x20400000 0xda000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiEpfw.dll
0x21200000 0x45000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiUpdate.dll
0x22b00000 0x16000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\eguiMailPlugins.dll

---

msmsgs.exe pid: 1348
Command line: "C:\Programmi\Messenger\msmsgs.exe" /background

Base Size Version Path
0x01000000 0x1a3000 4.07.0000.3001 C:\Programmi\Messenger\msmsgs.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x4ebd0000 0x1ab000 5.02.6001.22319 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\MSIMG32.dll
0x00400000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x10000000 0x6f000 5.01.2600.5512 C:\WINDOWS\system32\XPOB2RES.DLL
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x776e0000 0x44000 2001.12.4414.0706 C:\WINDOWS\system32\es.dll
0x76bc0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\credui.dll

---

btdna.exe pid: 1400
Command line: "C:\Programmi\DNA\btdna.exe"

Base Size Version Path
0x00400000 0xc9000 2.02.0004.16502 C:\Programmi\DNA\btdna.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x76bc0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\credui.dll
0x72960000 0xa000 5.01.2600.5512 C:\WINDOWS\system32\dot3api.dll
0x73640000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\dot3dlg.dll
0x5ad00000 0x28000 5.01.2600.5512 C:\WINDOWS\system32\OneX.DLL
0x71680000 0x22000 5.01.2600.5512 C:\WINDOWS\system32\eappcfg.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x73b40000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\eappprxy.dll

---

ctfmon.exe pid: 1440
Command line: "C:\WINDOWS\system32\ctfmon.exe"

Base Size Version Path
0x00400000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\ctfmon.exe
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x60060000 0x33000 5.01.2600.5512 C:\WINDOWS\system32\MSUTB.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime

---

BTTray.exe pid: 1804
Command line: "C:\Programmi\D-Link\Software Bluetooth\BTTray.exe"

Base Size Version Path
0x00400000 0xc8000 4.00.0001.2303 C:\Programmi\D-Link\Software Bluetooth\BTTray.exe
0x10000000 0xca000 4.00.0001.2303 C:\WINDOWS\system32\wbtapi.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x00340000 0x1f000 4.00.0001.2303 C:\WINDOWS\system32\btosif.dll
0x00360000 0x38000 4.00.0001.2303 C:\WINDOWS\system32\btwhidcs.DLL
0x74a70000 0x7000 5.01.2600.5512 C:\WINDOWS\system32\CFGMGR32.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll
0x003b0000 0xd000 4.00.0001.2303 C:\Programmi\D-Link\Software Bluetooth\BtBalloon.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x00a70000 0x2fb000 4.00.0001.2303 C:\WINDOWS\system32\btrez.dll
0x00d70000 0x10000 2.00.0039.0000 C:\WINDOWS\system32\CSH.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x00f30000 0xf000 C:\Programmi\D-Link\Software Bluetooth\btkeyind.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime

---

svchost.exe pid: 308
Command line: C:\WINDOWS\system32\svchost.exe -k LocalService

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x00950000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll

---

schedul2.exe pid: 524
Command line: "C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe"

Base Size Version Path
0x00400000 0x98000 1.00.0000.0318 C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

---

btwdins.exe pid: 456
Command line: "C:\Programmi\D-Link\Software Bluetooth\bin\btwdins.exe"

Base Size Version Path
0x00400000 0x58000 4.00.0001.2303 C:\Programmi\D-Link\Software Bluetooth\bin\btwdins.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

---

ekrn.exe pid: 1756
Command line: "C:\Programmi\ESET\ESET NOD32 Antivirus\ekrn.exe"

Base Size Version Path
0x00400000 0xb1000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrn.exe
0x7c420000 0x87000 8.00.50727.4053 C:\Programmi\ESET\ESET NOD32 Antivirus\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.4053 C:\Programmi\ESET\ESET NOD32 Antivirus\MSVCR80.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x767b0000 0x28000 5.01.2600.5834 C:\WINDOWS\system32\schannel.dll
0x21e00000 0x34000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnScan.dll
0x21300000 0x46c000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnAmon.dll
0x02e10000 0x1b000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnEmon.dll
0x23400000 0x1a000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnDmon.dll
0x20300000 0x65000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll
0x21100000 0x25000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnUpdate.dll
0x21000000 0x35000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\updater.dll
0x22900000 0x19000 4.00.0468.0001 C:\Programmi\ESET\ESET NOD32 Antivirus\ekrnMailPlugins.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x74e80000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemprox.dll
0x74e60000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemsvc.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll

---

E_S40ST7.EXE pid: 1592
Command line: "C:\Documents and Settings\All Users\Dati applicazioni\EPSON\EPW!3 SSRP\E_S40ST7.EXE"

Base Size Version Path
0x01000000 0x28000 4.00.0000.0000 C:\Documents and Settings\All Users\Dati applicazioni\EPSON\EPW!3 SSRP\E_S40ST7.EXE
0x5dd60000 0x9000 5.01.2600.0000 C:\WINDOWS\system32\RPCNS4.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

---

E_S40RP7.EXE pid: 1968
Command line: "C:\Documents and Settings\All Users\Dati applicazioni\EPSON\EPW!3 SSRP\E_S40RP7.EXE"

Base Size Version Path
0x01000000 0x20000 4.00.0002.0000 C:\Documents and Settings\All Users\Dati applicazioni\EPSON\EPW!3 SSRP\E_S40RP7.EXE
0x5dd60000 0x9000 5.01.2600.0000 C:\WINDOWS\system32\RPCNS4.dll

---

jqs.exe pid: 2140
Command line: "C:\Programmi\Java\jre6\bin\jqs.exe" -service -config "C:\Programmi\Java\jre6\lib\deploy\jqs\jqs.conf"

Base Size Version Path
0x00400000 0x24000 6.00.0170.0004 C:\Programmi\Java\jre6\bin\jqs.exe
0x7c340000 0x56000 7.10.3052.0004 C:\Programmi\Java\jre6\bin\MSVCR71.dll
0x674c0000 0x6000 2000.85.1132.0000 C:\WINDOWS\system32\odbcbcp.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x79fd0000 0x8000 1.01.4322.0573 C:\WINDOWS\system32\netfxperf.dll
0x79000000 0x46000 2.00.50727.3053 C:\WINDOWS\system32\mscoree.dll
0x640d0000 0x16000 2.00.50727.3053 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\perfcounter.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x00d40000 0x590000 2.00.50727.3603 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
0x60310000 0x17000 2.00.50727.3053 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CorperfmonExt.dll
0x60080000 0x9000 2.00.50727.3053 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.dll
0x7d9b0000 0x166000 5.01.2600.5847 C:\WINDOWS\System32\query.dll
0x693b0000 0x6000 5.02.2600.5512 C:\WINDOWS\system32\fxsperf.dll
0x610c0000 0x2b000 2001.12.4414.0706 C:\WINDOWS\system32\msdtcuiu.DLL
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x5f800000 0xf2000 6.02.8071.0000 C:\WINDOWS\system32\MFC42u.DLL
0x6da30000 0x6d000 2001.12.4414.0706 C:\WINDOWS\system32\MSDTCPRX.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x5ebe0000 0xd000 5.01.2600.5512 C:\WINDOWS\system32\perfctrs.dll
0x38ee0000 0x2d2000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\OLMAPI32.DLL
0x5ebd0000 0x9000 5.01.2600.5512 C:\WINDOWS\system32\perfdisk.dll
0x5ebc0000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\perfnet.dll
0x5eba0000 0xa000 5.01.2600.5512 C:\WINDOWS\system32\perfos.dll
0x5eb90000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\perfproc.dll
0x5e620000 0x6000 5.01.2600.0000 C:\WINDOWS\system32\pschdprf.dll
0x5e060000 0x6000 5.01.2600.0000 C:\WINDOWS\System32\rasctrs.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x5d840000 0x6000 5.01.2600.0000 C:\WINDOWS\System32\rsvpperf.dll
0x5bbf0000 0x5000 5.01.2600.0000 C:\WINDOWS\system32\tapiperf.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x5eb80000 0x6000 5.01.2600.0000 C:\WINDOWS\system32\perfts.dll
0x5b1c0000 0xa000 5.01.2600.0000 C:\WINDOWS\system32\UTILDLL.dll
0x59d70000 0x19000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wmiaprpl.dll
0x72ed0000 0x1c000 5.01.2600.5512 C:\WINDOWS\system32\loadperf.dll

---

NBService.exe pid: 2248
Command line: "C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe"

Base Size Version Path
0x00400000 0xe3000 4.00.0001.0102 C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x59e60000 0xa1000 5.01.2600.5512 C:\WINDOWS\system32\dbghelp.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x10000000 0x118000 4.00.0001.0102 C:\Programmi\File comuni\Nero\Nero BackItUp 4\NB.dll
0x69940000 0x16000 5.01.2600.5512 C:\WINDOWS\system32\Faultrep.dll
0x00a30000 0x6d000 4.00.0001.0102 C:\Programmi\File comuni\Nero\Nero BackItUp 4\LBFC.dll
0x73540000 0x47000 5.01.2600.5512 C:\WINDOWS\system32\mstask.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x011b0000 0x42000 4.00.0001.0102 C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBBurn.dll
0x01210000 0x27000 9.00.0000.0100 C:\Programmi\File comuni\Nero\Nero BackItUp 4\NeroAPIGlueLayerUnicode.dll

---

StarWindService.exe pid: 2668
Command line: "C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe"

Base Size Version Path
0x00400000 0x3a000 2.06.0000.1025 C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\System32\mswsock.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll

---

svchost.exe pid: 2704
Command line: C:\WINDOWS\system32\svchost.exe -k imgsvc

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\svchost.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x75a20000 0x55000 5.01.2600.5512 c:\windows\system32\wiaservc.dll
0x74a70000 0x7000 5.01.2600.5512 c:\windows\system32\CFGMGR32.dll
0x73aa0000 0x15000 5.01.2600.5627 c:\windows\system32\mscms.dll
0x71cd0000 0x1b000 6.00.2900.5512 C:\WINDOWS\system32\actxprxy.dll
0x73b10000 0x14000 5.01.2600.5512 C:\WINDOWS\system32\sti.dll

---

unsecapp.exe pid: 3428
Command line: C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding

Base Size Version Path
0x01000000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\wbem\unsecapp.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x74e60000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemsvc.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll

---

alg.exe pid: 3832
Command line: C:\WINDOWS\System32\alg.exe

Base Size Version Path
0x01000000 0xd000 5.01.2600.5512 C:\WINDOWS\System32\alg.exe
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\System32\ATL.DLL
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\System32\MSWSOCK.DLL
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\System32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\System32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\System32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll

---

wmiprvse.exe pid: 4092
Command line: C:\WINDOWS\system32\wbem\wmiprvse.exe

Base Size Version Path
0x01000000 0x3a000 5.01.2600.5755 C:\WINDOWS\system32\wbem\wmiprvse.exe
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x76760000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NTDSAPI.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x74e60000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\wbem\wbemsvc.dll
0x46ea0000 0x151000 5.01.2600.5512 C:\WINDOWS\system32\wbem\cimwin32.dll
0x697b0000 0x30000 5.01.2600.5512 C:\WINDOWS\system32\wbem\framedyn.dll

---

AAWTray.exe pid: 3160
Command line: C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe

Base Size Version Path
0x00400000 0x82000 8.00.0000.0000 C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe
0x78480000 0x8e000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCP90.dll
0x78520000 0xa3000 9.00.30729.0001 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCR90.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x10000000 0x190000 C:\Programmi\Lavasoft\Ad-Aware\Resources.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime

---

iexplore.exe pid: 1672
Command line: "C:\Programmi\Internet Explorer\iexplore.exe"

Base Size Version Path
0x00400000 0x9c000 8.00.6001.18702 C:\Programmi\Internet Explorer\iexplore.exe
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x71600000 0x79000 5.01.2600.5906 C:\WINDOWS\AppPatch\AcLayers.DLL
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x40260000 0xa93000 8.00.6001.18854 C:\WINDOWS\system32\IEFRAME.dll
0x009b0000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x72240000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\sensapi.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\System32\mswsock.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x01ef0000 0x2a000 8.00.6001.18702 C:\WINDOWS\system32\IEUI.dll
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\MSIMG32.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x76bc0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\credui.dll
0x72960000 0xa000 5.01.2600.5512 C:\WINDOWS\system32\dot3api.dll
0x73640000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\dot3dlg.dll
0x5ad00000 0x28000 5.01.2600.5512 C:\WINDOWS\system32\OneX.DLL
0x71680000 0x22000 5.01.2600.5512 C:\WINDOWS\system32\eappcfg.dll
0x76030000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll
0x73b40000 0xe000 5.01.2600.5512 C:\WINDOWS\system32\eappprxy.dll
0x4cf40000 0xb000 5.01.2600.5512 C:\WINDOWS\system32\EapolQec.dll
0x745c0000 0x16000 5.01.2600.5512 C:\WINDOWS\system32\QUtil.dll
0x45210000 0x40000 8.00.6001.18854 C:\Programmi\Internet Explorer\ieproxy.dll
0x74680000 0x2a000 5.01.2600.5512 C:\WINDOWS\system32\msimtf.dll
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x68ef0000 0xf1000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x68ff0000 0x7000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x74c10000 0x2c000 4.02.5406.0000 C:\WINDOWS\system32\oleacc.dll
0x47060000 0x21000 1.00.1018.0000 C:\WINDOWS\system32\xmllite.dll
0x44f30000 0x94000 8.00.6001.18854 C:\WINDOWS\system32\msfeeds.dll
0x71cd0000 0x1b000 6.00.2900.5512 C:\WINDOWS\system32\actxprxy.dll
0x75d50000 0x91000 6.00.2900.5512 C:\WINDOWS\system32\MLANG.dll
0x74d20000 0x6b000 1.420.2600.5512 C:\WINDOWS\system32\USP10.dll
0x10000000 0x1f7000 6.02.0010.0031 C:\Programmi\File comuni\Nero\SMC\NeroDigitalExt.dll
0x781d0000 0x10f000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x5d360000 0xf000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80ITA.DLL
0x02b80000 0x5b000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.dll
0x03c10000 0x4c000 9.00.0000.0000 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA
0x3fac0000 0x5ae000 8.00.6001.18854 C:\WINDOWS\system32\mshtml.dll
0x00b80000 0x29000 3.10.0349.0000 C:\WINDOWS\system32\msls31.dll

---

iexplore.exe pid: 3016
Command line: "C:\Programmi\Internet Explorer\iexplore.exe" SCODEF:1672 CREDAT:14337

Base Size Version Path
0x00400000 0x9c000 8.00.6001.18702 C:\Programmi\Internet Explorer\iexplore.exe
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x71600000 0x79000 5.01.2600.5906 C:\WINDOWS\AppPatch\AcLayers.DLL
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x40260000 0xa93000 8.00.6001.18854 C:\WINDOWS\system32\IEFRAME.dll
0x451f0000 0x6000 8.00.6001.18854 C:\Programmi\Internet Explorer\xpshims.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x45210000 0x40000 8.00.6001.18854 C:\Programmi\Internet Explorer\ieproxy.dll
0x01c40000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x72240000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\sensapi.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x75d50000 0x91000 6.00.2900.5512 C:\WINDOWS\system32\MLANG.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x10000000 0x53000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x02420000 0x21000 9.00.0000.0000 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.ITA
0x02470000 0x11000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
0x024a0000 0x10000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x68ef0000 0xf1000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL
0x68ff0000 0x7000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\MSImg32.dll
0x027a0000 0x1a5000 12.00.4518.1014 C:\Programmi\Microsoft Office\Office12\1040\GrooveIntlResource.dll
0x4b440000 0x86000 5.41.0015.1515 C:\WINDOWS\system32\MSFTEDIT.DLL
0x65e30000 0x37000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
0x66b40000 0x17d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR326C~1.DLL
0x74910000 0x123000 8.100.1051.0000 C:\WINDOWS\system32\msxml3.dll
0x6d440000 0xc000 6.00.0170.0004 C:\Programmi\Java\jre6\bin\jp2ssv.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Programmi\Java\jre6\bin\MSVCR71.dll
0x6dae0000 0x12000 6.00.0170.0004 C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
0x3fac0000 0x5ae000 8.00.6001.18854 C:\WINDOWS\system32\mshtml.dll
0x03560000 0x29000 3.10.0349.0000 C:\WINDOWS\system32\msls31.dll
0x72ea0000 0x6f000 8.00.6001.18669 C:\WINDOWS\system32\ieapfltr.dll
0x71cd0000 0x1b000 6.00.2900.5512 C:\WINDOWS\system32\actxprxy.dll
0x42700000 0x2f000 8.00.6001.18854 C:\WINDOWS\system32\iepeers.dll
0x74680000 0x2a000 5.01.2600.5512 C:\WINDOWS\system32\msimtf.dll
0x1b000000 0xc000 8.00.6001.18702 C:\WINDOWS\system32\ImgUtil.dll
0x1b060000 0xe000 8.00.6001.18702 C:\WINDOWS\system32\pngfilt.dll
0x35c50000 0x39000 8.00.6001.18702 C:\WINDOWS\system32\Dxtrans.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x6d950000 0xa000 5.03.2600.5512 C:\WINDOWS\system32\ddrawex.dll
0x736d0000 0x4b000 5.03.2600.5512 C:\WINDOWS\system32\DDRAW.dll
0x73b30000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\DCIMAN32.dll
0x35cb0000 0x57000 8.00.6001.18702 C:\WINDOWS\system32\Dxtmsft.dll
0x74d20000 0x6b000 1.420.2600.5512 C:\WINDOWS\system32\USP10.dll
0x06a20000 0x4a4000 10.00.0042.0034 C:\WINDOWS\system32\Macromed\Flash\Flash10d.ocx
0x73aa0000 0x15000 5.01.2600.5627 C:\WINDOWS\system32\mscms.dll
0x767b0000 0x28000 5.01.2600.5834 C:\WINDOWS\system32\schannel.dll
0x12950000 0xa66000 11.00.5721.5268 C:\WINDOWS\system32\wmp.dll
0x75df0000 0x21000 5.01.2600.5512 C:\WINDOWS\system32\MSVFW32.dll
0x59e60000 0xa1000 5.01.2600.5512 C:\WINDOWS\system32\dbghelp.dll
0x13740000 0x7e8000 11.00.5721.5145 C:\WINDOWS\system32\wmploc.dll
0x4ebd0000 0x1ab000 5.02.6001.22319 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x0bef0000 0x37000 11.00.5721.5145 C:\WINDOWS\system32\MFPlat.DLL
0x0a900000 0x6a000 5.08.6001.18702 C:\WINDOWS\system32\vbscript.dll
0x738b0000 0xd0000 5.03.2600.5512 C:\WINDOWS\system32\D3DIM700.DLL
0x68100000 0x26000 5.01.2600.5507 C:\WINDOWS\system32\dssenh.dll
0x03720000 0xf000 C:\Programmi\D-Link\Software Bluetooth\btkeyind.dll

---

iexplore.exe pid: 2992
Command line: "C:\Programmi\Internet Explorer\iexplore.exe" SCODEF:1672 CREDAT:145410

Base Size Version Path
0x00400000 0x9c000 8.00.6001.18702 C:\Programmi\Internet Explorer\iexplore.exe
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x71600000 0x79000 5.01.2600.5906 C:\WINDOWS\AppPatch\AcLayers.DLL
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x40260000 0xa93000 8.00.6001.18854 C:\WINDOWS\system32\IEFRAME.dll
0x451f0000 0x6000 8.00.6001.18854 C:\Programmi\Internet Explorer\xpshims.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x45210000 0x40000 8.00.6001.18854 C:\Programmi\Internet Explorer\ieproxy.dll
0x01c40000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x75d50000 0x91000 6.00.2900.5512 C:\WINDOWS\system32\MLANG.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x10000000 0x53000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
0x7c420000 0x87000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCP80.dll
0x78130000 0x9b000 8.00.50727.3053 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
0x020f0000 0x21000 9.00.0000.0000 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEFavClient.ITA
0x02170000 0x10000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x68ef0000 0xf1000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL
0x68ff0000 0x7000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL
0x7c630000 0x1b000 8.00.50727.0762 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.DLL
0x76330000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\MSImg32.dll
0x021f0000 0x1a5000 12.00.4518.1014 C:\Programmi\Microsoft Office\Office12\1040\GrooveIntlResource.dll
0x4b440000 0x86000 5.41.0015.1515 C:\WINDOWS\system32\MSFTEDIT.DLL
0x65e30000 0x37000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
0x66b40000 0x17d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GR326C~1.DLL
0x74910000 0x123000 8.100.1051.0000 C:\WINDOWS\system32\msxml3.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x71cd0000 0x1b000 6.00.2900.5512 C:\WINDOWS\system32\actxprxy.dll
0x3fac0000 0x5ae000 8.00.6001.18854 C:\WINDOWS\system32\mshtml.dll
0x02f00000 0x29000 3.10.0349.0000 C:\WINDOWS\system32\msls31.dll
0x72ea0000 0x6f000 8.00.6001.18669 C:\WINDOWS\system32\ieapfltr.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x72240000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\sensapi.dll
0x74680000 0x2a000 5.01.2600.5512 C:\WINDOWS\system32\msimtf.dll
0x1b000000 0xc000 8.00.6001.18702 C:\WINDOWS\system32\ImgUtil.dll
0x1b060000 0xe000 8.00.6001.18702 C:\WINDOWS\system32\pngfilt.dll
0x35c50000 0x39000 8.00.6001.18702 C:\WINDOWS\system32\Dxtrans.dll
0x76ae0000 0x11000 3.05.2284.0002 C:\WINDOWS\system32\ATL.DLL
0x6d950000 0xa000 5.03.2600.5512 C:\WINDOWS\system32\ddrawex.dll
0x736d0000 0x4b000 5.03.2600.5512 C:\WINDOWS\system32\DDRAW.dll
0x73b30000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\DCIMAN32.dll
0x35cb0000 0x57000 8.00.6001.18702 C:\WINDOWS\system32\Dxtmsft.dll
0x74d20000 0x6b000 1.420.2600.5512 C:\WINDOWS\system32\USP10.dll
0x089a0000 0xf000 C:\Programmi\D-Link\Software Bluetooth\btkeyind.dll
0x4ebd0000 0x1ab000 5.02.6001.22319 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x738b0000 0xd0000 5.03.2600.5512 C:\WINDOWS\system32\D3DIM700.DLL
0x00b50000 0x11000 9.00.0000.0332 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
0x661c0000 0x21d000 12.00.4518.1014 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
0x6d440000 0xc000 6.00.0170.0004 C:\Programmi\Java\jre6\bin\jp2ssv.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Programmi\Java\jre6\bin\MSVCR71.dll
0x6dae0000 0x12000 6.00.0170.0004 C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
0x42700000 0x2f000 8.00.6001.18854 C:\WINDOWS\system32\iepeers.dll
0x04530000 0x4a4000 10.00.0042.0034 C:\WINDOWS\system32\Macromed\Flash\Flash10d.ocx
0x73aa0000 0x15000 5.01.2600.5627 C:\WINDOWS\system32\mscms.dll
0x767b0000 0x28000 5.01.2600.5834 C:\WINDOWS\system32\schannel.dll
0x68100000 0x26000 5.01.2600.5507 C:\WINDOWS\system32\dssenh.dll
0x06b10000 0x4c000 9.00.0000.0000 C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\PDFShell.ITA
0x76940000 0x8000 5.01.2600.5512 C:\WINDOWS\system32\LINKINFO.dll
0x5f800000 0x15000 1.01.1593.0000 C:\PROGRA~1\WIFD1F~1\MpOAv.dll

---

ntvdm.exe pid: 2628
Command line: "C:\WINDOWS\system32\ntvdm.exe" -f -i1 -w -a C:\WINDOWS\system32\krnl386.exe

Base Size Version Path
0x0f000000 0xa7000 5.01.2600.5512 C:\WINDOWS\system32\ntvdm.exe
0x5f5a0000 0x7000 5.01.2600.5512 C:\WINDOWS\system32\NTVDMD.DLL
0x5f590000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\NWAPI16.DLL
0x5f570000 0x13000 5.01.2600.5512 C:\WINDOWS\system32\NWAPI32.dll
0x5f520000 0x27000 5.01.2600.5512 C:\WINDOWS\system32\NWPROVAU.dll
0x5af90000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\VWIPXSPX.DLL
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\system32\mswsock.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71ec0000 0x6000 5.01.2600.0000 C:\WINDOWS\System32\wshisn.dll
0x0ffb0000 0x45000 5.01.2600.5512 C:\WINDOWS\system32\WOW32.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5b840000 0x10000 5.01.2600.0000 C:\WINDOWS\system32\tsappcmp.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll

---

wscntfy.exe pid: 2576
Command line: C:\WINDOWS\system32\wscntfy.exe

Base Size Version Path
0x01000000 0x6000 5.01.2600.5512 C:\WINDOWS\system32\wscntfy.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime

---

sys84308.exe pid: 2604
Command line: "C:\Documents and Settings\Biagio\Desktop\sys84308.exe"

Base Size Version Path
0x00400000 0x39000 C:\Documents and Settings\Biagio\Desktop\sys84308.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll

---

runme.exe pid: 3332
Command line: runme.exe

Base Size Version Path
0x00400000 0x5e000 3.06.0000.0007 C:\DOCUME~1\Biagio\IMPOST~1\Temp\nsw5DE.tmp\runme.exe
0x73390000 0x153000 6.00.0098.0002 C:\WINDOWS\system32\MSVBVM60.DLL
0x746b0000 0x4c000 5.01.2600.5512 C:\WINDOWS\system32\MSCTF.dll
0x752e0000 0x2e000 5.01.2600.5512 C:\WINDOWS\system32\msctfime.ime
0x73510000 0x2a000 5.07.0000.18066 C:\WINDOWS\system32\scrrun.dll
0x01460000 0x9000 6.00.5441.0000 C:\WINDOWS\system32\Normaliz.dll
0x40070000 0x1e8000 8.00.6001.18854 C:\WINDOWS\system32\iertutil.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x76750000 0xc000 5.01.2600.5512 C:\WINDOWS\system32\cryptdll.dll
0x72240000 0x5000 5.01.2600.5512 C:\WINDOWS\system32\sensapi.dll
0x719d0000 0x40000 5.01.2600.5625 C:\WINDOWS\System32\mswsock.dll
0x76ee0000 0x27000 5.01.2600.5625 C:\WINDOWS\system32\DNSAPI.dll
0x66750000 0x58000 5.01.2600.5512 C:\WINDOWS\system32\hnetcfg.dll
0x71a10000 0x8000 5.01.2600.5512 C:\WINDOWS\System32\wshtcpip.dll
0x01ab0000 0x6a000 5.08.6001.18702 C:\WINDOWS\system32\vbscript.dll

---

cmd.exe pid: 4040
Command line: cmd /c uuoywfrygn.exe > tempd.txt

Base Size Version Path
0x4ad00000 0x63000 5.01.2600.5512 C:\WINDOWS\system32\cmd.exe
0x5cf90000 0x26000 5.01.2600.5512 C:\WINDOWS\system32\ShimEng.dll
0x5d190000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\serwvdrv.dll
0x5b4b0000 0x7000 5.01.2600.0000 C:\WINDOWS\system32\umdmxfrm.dll
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

---

uuoywfrygn.exe pid: 2460
Command line: uuoywfrygn.exe

Base Size Version Path
0x00400000 0x14000 2.25.0000.0000 C:\DOCUME~1\Biagio\IMPOST~1\Temp\nsw5DE.tmp\uuoywfrygn.exe
0x773a0000 0x103000 6.00.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

===================== NTFS ADS =====================



C:\Documents and Settings\All Users\Dati applicazioni\Symantec\hpc:1358375374 72 bytes
C:\Documents and Settings\All Users\Dati applicazioni\Symantec\hpc:2704092260 136 bytes
C:\Documents and Settings\All Users\Dati applicazioni\Symantec\hpc:3898751835 113 bytes
C:\Documents and Settings\All Users\Dati applicazioni\TEMP:DFC5A2B2 152 bytes
C:\Documents and Settings\All Users\Documenti\Immagini\Immagini campione\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\All Users\Documenti\TNTforum - Reaper Stagione 1 .url:favicon 22486 bytes
C:\Documents and Settings\Biagio:zylomtest 0 bytes
C:\Documents and Settings\Biagio:zylomtr{00013KEU-UKQE-K6V0-DNSL-22H2BN66GVVR} 17 bytes
C:\Documents and Settings\Biagio\Documenti\Immagini\Raccolta multimediale Microsoft\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Biagio\Preferiti\Accedi Facebook.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Aiutamici.com.url:favicon 2862 bytes
C:\Documents and Settings\Biagio\Preferiti\AliceCasa\ilpuntotecnicoeadsl.com - Indice.url:favicon 1078 bytes
C:\Documents and Settings\Biagio\Preferiti\AliceCasa\[Thread Ufficiale] Alice Gate VoIP 2 Plus Wi-Fi - Hardware Upgrade Forum.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\animedb Guarda tantissimi film, anime e cartoni in streaming « SMaNEttONi.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Auguri.it - Cartoline virtuali gratis per fare gli auguri.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Banca\ING DIRECT.url:favicon 0 bytes
C:\Documents and Settings\Biagio\Preferiti\Banca\Intesa Sanpaolo. Vicini a Voi..url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Repubblica.it.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\Servizi\ESSELUNGA - Homepage.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\Servizi\Monitoraggio Finanziaria 2008.url:favicon 4926 bytes
C:\Documents and Settings\Biagio\Preferiti\Servizi\Poste Italiane - Home page.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Servizi\Telecom Italia - 187.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Servizi\VcastCanali.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Software\DDL2.com - Latest Direct Downloads!.url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Software\Stai per scaricare CCleaner 2.01.507 Software Windows Download.HTML.it.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\Spettacolo\YouTube - Broadcast Yourself..url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Cartoline.net - cartoline virtuali animate e auguri da inviare gratis ad amici e conoscenti.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Collegamenti\Siti suggeriti.url:favicon 25214 bytes
C:\Documents and Settings\Biagio\Preferiti\Commercio\CHL - Acquisti online di Informatica, Audio Video, Telefonia, Fotografia, Elettrodomestici.url:favicon 1386 bytes
C:\Documents and Settings\Biagio\Preferiti\Corriere della Sera.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Cover\Darktown.to.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Cover\coverMegaSearch.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Cover\Le copertine di www.marcelloweb.it - search your cover.url:favicon 766 bytes
C:\Documents and Settings\Biagio\Preferiti\Discoveritalia.url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Divertimento, Curiosità, Web Cam, Suonerie Cellulari, Test.url:favicon 3262 bytes
C:\Documents and Settings\Biagio\Preferiti\F.C. INTERNAZIONALE MILANO - SITO UFFICIALE.url:favicon 4710 bytes
C:\Documents and Settings\Biagio\Preferiti\Hattrick.url:favicon 3126 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\... Il Portale Tributario della Regione Lombardia ....url:favicon 822 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\Agenzia delle Entrate - Home Page.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\Comune di Rivello (PZ) - Italia Informazioni.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\Comune di Vanzago (MI) - Italia Informazioni.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\Direzione Centrale per la Formazione Vigili del Fuoco - Home.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\Imprese, famiglie, mutui, fisco Decreto anti-crisi dalla A alla Z - Il Sole 24 ORE.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Istituzioni\Monitoraggio Finanziaria 2008.url:favicon 4926 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\HTML.it.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\Aiutamici.com.url:favicon 2862 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\Hardware Upgrade - Il sito italiano sulla tecnologia - www.hwupgrade.it.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\Libero - Assistenza.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\PC PRIMI PASSI,il portale italiano per i neofiti del computer,corsi,servizi gratuiti,articoli,aiu.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\SOFTWARE ZONE, il software che cerchi.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\Strumento recupero dati per Windows XP, Windows 2000-2003 e Windows NT.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\PC\WinTricks.it - Windows News Software.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\java.com Java + You.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\La Gazzetta dello Sport foto e video di calcio, formula 1, ciclismo, motomondiale.url:favicon 3262 bytes
C:\Documents and Settings\Biagio\Preferiti\Leopard\Bios.url:favicon 9062 bytes
C:\Documents and Settings\Biagio\Preferiti\Leopard\Chicche di Cala - Costruire un Hackintosh Mac con il sistema operativo Leopard [Guida passo passo].url:favicon 5430 bytes
C:\Documents and Settings\Biagio\Preferiti\Leopard\Il Mac costa troppo Fatti un “Hackintosh” - Geekissimo.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Leopard\Il modo più semplice per installare Mac Os X 10.5.1 sul proprio Pc senza Hack - Geekissimo.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Leopard\Installare Mac OS X Leopard sul tuo PC -2.url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Lonely Planet Italia.url:favicon 372 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\DivX DooR - Copiare DVD, Masterizzare DVD, DivX, AC3, Mp3, Mpeg.url:favicon 2238 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\Manuali.it - Manuali, Corsi online, Miniguide, Glossario.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\MondoDvd.net Dvd video , hd dvd, blu-ray disc, masterizzazione, backup dvd, video-editing.. GRATIS!.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\Sito Guida alla masterizzazione.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\Videomakers - Pagina 1-4 - Canopus Edius 2 Prova su Strada Part 2.url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\WebMasterPoint.org - DIVX Come aprire e masterizzare i file .bin, .cue, .iso.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Manuali Video\World Divx - Software e guide per divx e DVD.url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Moduli.it.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\ADSL HP Alice Adsl.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Area download Microsoft.url:favicon 3638 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Google Maps.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Google Translate.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Google.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Libero.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Mininova The ultimate BitTorrent source!.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Tiscali Italia.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\TorrentPump.com - torrent search engine.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Torrents Search Engine.url:favicon 894 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\VIRGILIO.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Windows Live.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\Motori\Yahoo! Italia.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\nardonardo.url:favicon 822 bytes
C:\Documents and Settings\Biagio\Preferiti\Suonerie gratis.url:favicon 1150 bytes
C:\Documents and Settings\Biagio\Preferiti\TNTforum - Reaper Stagione 1 .url:favicon 22486 bytes
C:\Documents and Settings\Biagio\Preferiti\Trasporti & Viaggi\Aurum Hotels.url:favicon 390 bytes
C:\Documents and Settings\Biagio\Preferiti\Trasporti & Viaggi\Ferrovie dello Stato - Homepage.url:favicon 1406 bytes
C:\Documents and Settings\Biagio\Preferiti\Wikipedia.url:favicon 318 bytes
C:\Documents and Settings\Biagio\Preferiti\YouTube - Broadcast Yourself..url:favicon 318 bytes



===================== ENCRYPTED FILES =====================


===================== HIDDEN OBJECTS =====================


scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Programmi\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:ec,46,62,75,df,6b,8a,11,87,05,08,e1,27,75,45,5e,44,27,5d,40,8a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,44,db,e9,a4,85,76,a0,81,6c,21,97,d2,f8,36,63,52,ca,..
"khjeh"=hex:15,61,0f,bd,d3,c9,39,e5,15,19,1f,46,dc,d9,a7,7f,28,e3,be,7a,d0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:14,39,e5,6b,db,d9,c0,b2,7a,0e,56,07,09,a0,f2,db,b5,b0,1f,8f,fc,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40]
"ujdew"=hex:20,02,00,00,b0,e2,f2,0e,3e,b8,54,7c,18,b4,4d,99,80,7e,55,fa,0f,..
"ljej40"=hex:c8,98,0a,e2,b7,e9,5b,ed,9f,03,42,8e,9c,7b,47,c8,54,63,9c,59,bf,..
"ljej41"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
"ljej42"=hex:d1,36,9d,f9,be,58,a6,3e,a2,f0,44,0b,6b,5a,2d,be,3e,0b,9e,20,64,..
"ljej43"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
"ljej44"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
"ljej45"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
"ljej46"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
"ljej47"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
"ljej48"=hex:58,98,0a,e2,cf,e9,5b,ed,9e,03,43,8e,9d,7b,47,c8,54,63,9c,59,1b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Programmi\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:ec,46,62,75,df,6b,8a,11,87,05,08,e1,27,75,45,5e,44,27,5d,40,8a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,44,db,e9,a4,85,76,a0,81,6c,21,97,d2,f8,36,63,52,ca,..
"khjeh"=hex:15,61,0f,bd,d3,c9,39,e5,15,19,1f,46,dc,d9,a7,7f,28,e3,be,7a,d0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:14,39,e5,6b,db,d9,c0,b2,7a,0e,56,07,09,a0,f2,db,b5,b0,1f,8f,fc,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


===================== MASTER BOOT RECORD =====================


device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
malicious code @ sector 0x94fe9bd size 0x1fd !
copy of MBR has been found in sector 62 !
PE file found in sector at 0x094FE9BD !

===================== NETWORK SETTINGS =====================

~~~~~~~~~~~~~~~~~~~~~ Winsock Parameters ~~~~~~~~~~~~~~~~~~~~~

-----HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters\-----

[Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001]
"LibraryPath"="%SystemRoot%\System32\mswsock.dll"

[Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002]
"LibraryPath"="%SystemRoot%\System32\winrnr.dll"

[Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003]
"LibraryPath"="%SystemRoot%\System32\mswsock.dll"

[Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004]
"LibraryPath"="%SystemRoot%\System32\nwprovau.dll"

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\rsvpsp.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\rsvpsp.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000025]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

[Parameters\Protocol_Catalog9\Catalog_Entries\000000000026]
### "PackedCatalogItem" (bin)= %SystemRoot%\system32\mswsock.dll

~~~~~~~~~~~~~~~~~~~~~ TCP/IP network configuration ~~~~~~~~~~~~~~~~~~~~~


-----HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

~~~~~~~~~~~~~~~~~~~~~ Open ports ~~~~~~~~~~~~~~~~~~~~~

Connessioni attive
Proto Indirizzo locale Indirizzo esterno Stato PID
TCP biagio-1e59a061:epmap 0.0.0.0:0 LISTENING 1040
c:\windows\system32\WS2_32.dll
C:\WINDOWS\system32\RPCRT4.dll
c:\windows\system32\rpcss.dll
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ADVAPI32.dll
[svchost.exe]
TCP biagio-1e59a061:microsoft-ds 0.0.0.0:0 LISTENING 4
[Sistema]
TCP biagio-1e59a061:3260 0.0.0.0:0 LISTENING 2668
[StarWindService.exe]
TCP biagio-1e59a061:3261 0.0.0.0:0 LISTENING 2668
[StarWindService.exe]
TCP biagio-1e59a061:20342 0.0.0.0:0 LISTENING 1400
[btdna.exe]
TCP biagio-1e59a061:1035 0.0.0.0:0 LISTENING 3832
[alg.exe]
TCP biagio-1e59a061:5152 0.0.0.0:0 LISTENING 2140
[jqs.exe]
TCP biagio-1e59a061:30606 0.0.0.0:0 LISTENING 1756
[ekrn.exe]
TCP biagio-1e59a061:2995 localhost:30606 CLOSE_WAIT 3332
[runme.exe]
TCP biagio-1e59a061:5152 localhost:2952 CLOSE_WAIT 2140
[jqs.exe]
UDP biagio-1e59a061:isakmp *:* 812
[lsass.exe]
UDP biagio-1e59a061:20342 *:* 1400
[btdna.exe]
UDP biagio-1e59a061:4500 *:* 812
[lsass.exe]
UDP biagio-1e59a061:microsoft-ds *:* 4
[Sistema]
UDP biagio-1e59a061:1900 *:* 1276
c:\windows\system32\WS2_32.dll
c:\windows\system32\ssdpsrv.dll
ntdll.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]
UDP biagio-1e59a061:2769 *:* 3016
[iexplore.exe]
UDP biagio-1e59a061:ntp *:* 1176
c:\windows\system32\WS2_32.dll
c:\windows\system32\w32time.dll
ntdll.dll
C:\WINDOWS\system32\kernel32.dll
[svchost.exe]
UDP biagio-1e59a061:2880 *:* 2992
[iexplore.exe]
UDP biagio-1e59a061:1900 *:* 1400
[btdna.exe]

~~~~~~~~~~~~~~~~~~~~~ Shared Resources ~~~~~~~~~~~~~~~~~~~~~

Nome cond. Risorsa Nota
D$ D:\ Condivisione predefinita
print$ C:\WINDOWS\system32\spool\drivers
Driver della stampante
ADMIN$ C:\WINDOWS Amministrazione remota
C$ C:\ Condivisione predefinita
IPC$ IPC remoto
ShareDocs C:\Documents and Settings\All Users\Documenti

EPSONS21 USB002 Spooler EPSON S21 Series

~~~~~~~~~~~~~~~~~~~~~ TRUSTED DOMAINS ~~~~~~~~~~~~~~~~~~~~~

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

~~~~~~~~~~~~~~~~~~~~~ TRUSTED IPs ~~~~~~~~~~~~~~~~~~~~~

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\

~~~~~~~~~~~~~~~~~~~~~ RAS active connections ~~~~~~~~~~~~~~~~~~~~~

Nessuna connessione

~~~~~~~~~~~~~~~~~~~~~ Rasphone.pbk content ~~~~~~~~~~~~~~~~~~~~~

-----C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Connections\Pbk\rasphone.pbk

[Alice ADSL]
Encoding=1
Type=5
AutoLogon=0
UseRasCredentials=1
DialParamsUID=96875960
Guid=214FF6313CC3EB4A8CEACA9E092355E5
BaseProtocol=1
VpnStrategy=0
ExcludedProtocols=3
LcpExtensions=1
DataEncryption=8
SwCompression=1
NegotiateMultilinkAlways=0
SkipNwcWarning=0
SkipDownLevelDialog=0
SkipDoubleDialDialog=0
DialMode=1
DialPercent=75
DialSeconds=120
HangUpPercent=10
HangUpSeconds=120
OverridePref=15
RedialAttempts=3
RedialSeconds=60
IdleDisconnectSeconds=1200
RedialOnLinkFailure=1
CallbackMode=0
CustomDialDll=
CustomDialFunc=
CustomRasDialDll=
AuthenticateServer=0
ShareMsFilePrint=1
BindMsNetClient=0
SharedPhoneNumbers=0
GlobalDeviceSettings=0
PrerequisiteEntry=
PrerequisitePbk=
PreferredPort=
PreferredDevice=
PreferredBps=0
PreferredHwFlow=0
PreferredProtocol=0
PreferredCompression=0
PreferredSpeaker=0
PreferredMdmProtocol=0
PreviewUserPw=1
PreviewDomain=0
PreviewPhoneNumber=0
ShowDialingProgress=1
ShowMonitorIconInTaskBar=1
CustomAuthKey=-1
AuthRestrictions=632
TypicalAuth=1
IpPrioritizeRemote=1
IpHeaderCompression=0
IpAddress=0.0.0.0
IpDnsAddress=0.0.0.0
IpDns2Address=0.0.0.0
IpWinsAddress=0.0.0.0
IpWins2Address=0.0.0.0
IpAssign=1
IpNameAssign=1
IpFrameSize=1006
IpDnsFlags=0
IpNBTFlags=0
TcpWindowSize=0
UseFlags=1
IpSecFlags=0
IpDnsSuffix=

NETCOMPONENTS=
ms_server=1
ms_msclient=0
ms_psched=1
ms_nwsapagent=1

MEDIA=rastapi
Port=PPPoE6-0
Device=Miniport WAN (PPPOE)

DEVICE=PPPoE
PhoneNumber=
AreaCode=
CountryCode=39
CountryID=39
UseDialingRules=0
Comment=
LastSelectedPhone=0
PromoteAlternates=0
TryNextAlternateOnFail=1


===================== HOSTS FILE =====================

127.0.0.1 localhost

===================== SUSPICIOUS FILES =====================
EXE and DLL files packed with runtime packers, found in: C:\; C:\WINDOWS\; C:\WINDOWS\system32\

C:\mbr.exe --> is compressed with UPX
C:\WINDOWS\MBR.exe --> is compressed with UPX
C:\WINDOWS\NIRCMD.exe --> is compressed with UPX
C:\WINDOWS\PEV.exe --> is compressed with PECompact
C:\WINDOWS\SWREG.exe --> is compressed with UPX
C:\WINDOWS\SWSC.exe --> is compressed with UPX

===================== UNINSTALL LIST =====================


-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall-----

[Uninstall]

[Uninstall\6194C28A8F62DD817EA1B918E6E46E806A21B452]
"UninstallString"="C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\shpacm_18A9B92ED8DEDC602E49E767FA4BE98A30525207\shpacm.inf"
"DisplayName"="Pacchetto driver Windows - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)"
"DisplayIcon"=expand:"C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe,0"

[Uninstall\65B6FE5418CE28F4D72543FB2D964C3CEC83F161]
"UninstallString"="C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\shpusb_558D416BCEB984F35885804D3E1A9C3773F1B17C\shpusb.inf"
"DisplayName"="Pacchetto driver Windows - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)"
"DisplayIcon"=expand:"C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe,0"

[Uninstall\Ad-Aware]
"DisplayIcon"="C:\Documents and Settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe"
"DisplayName"="Ad-Aware"
"UninstallString"="\"C:\Documents and Settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe\" REMOVE=TRUE MODIFY=FALSE"

[Uninstall\AddressBook]

[Uninstall\Adobe AIR]
"DisplayIcon"="C:\PROGRA~1\FILECO~1\ADOBEA~1\Versions\1.0\RESOUR~1\ADOBEA~1.EXE"
"DisplayName"="Adobe AIR"
"UninstallString"="C:\Programmi\File comuni\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall"

[Uninstall\Adobe Flash Player ActiveX]
"DisplayName"="Adobe Flash Player 10 ActiveX"
"DisplayIcon"="C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe"
"UninstallString"="C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe"

[Uninstall\Adobe Flash Player Plugin]
"DisplayName"="Adobe Flash Player 10 Plugin"
"DisplayIcon"="C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe"
"UninstallString"="C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe"

[Uninstall\Adobe_faf656ef605427ee2f42989c3ad31b8]
"DisplayName"="Adobe Photoshop CS4"
"DisplayIcon"="C:\Programmi\File comuni\Adobe\\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe,0"
"UninstallString"="C:\Programmi\File comuni\Adobe\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe --uninstall=1"

[Uninstall\Ashampoo WinOptimizer 2010_is1]
"DisplayName"="Ashampoo WinOptimizer 2010"
"UninstallString"="\"C:\Programmi\Ashampoo\Ashampoo WinOptimizer 2010\unins000.exe\""

[Uninstall\ATI Display Driver]
"DisplayName"="ATI Display Driver"
"UninstallString"="rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean"

[Uninstall\Branding]

[Uninstall\C-Media Audio Driver]
"DisplayName"="C-Media WDM Audio Driver"
"UninstallString"="C:\WINDOWS\system32\cmirmdrv.exe"

[Uninstall\CDEdit 1.145_is1]
"DisplayName"="CDEdit version 1.145"
"UninstallString"="\"C:\Programmi\CDEdit 1.14\unins000.exe\""

[Uninstall\CloneCD]
"DisplayName"="CloneCD"
"UninstallString"="\"C:\Programmi\SlySoft\CloneCD\ccd-uninst.exe\" /D=\"C:\Programmi\SlySoft\CloneCD\""

[Uninstall\CNXT_MODEM_PCI_HSF]
"DisplayName"="PCI SoftV92 Modem"
"UninstallString"="C:\Programmi\CONEXANT\CNXT_MODEM_PCI_HSF\UIU32m.exe -U -IPSCRCSR5K.inf"

[Uninstall\Connection Manager]

[Uninstall\DirectAnimation]

[Uninstall\DirectDrawEx]

[Uninstall\DVD Shrink_is1]
"DisplayName"="DVD Shrink 3.2"
"UninstallString"="\"C:\Programmi\DVD Shrink\unins000.exe\""

[Uninstall\DXM_Runtime]

[Uninstall\eMule]
"DisplayName"="eMule"
"UninstallString"="\"C:\Programmi\eMule\Uninstall.exe\""

[Uninstall\ENTERPRISE]
"DisplayIcon"="C:\Programmi\File comuni\Microsoft Shared\OFFICE12\Office Setup Controller\OSETUP.DLL,1"
"DisplayName"="Microsoft Office Enterprise 2007"
"UninstallString"="\"C:\Programmi\File comuni\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe\" /uninstall ENTERPRISE /dll OSETUP.DLL"

[Uninstall\EPSON Photo Print]
"UninstallString"="C:\WINDOWS\IsUn0410.exe -f\"C:\Programmi\EPSON\Photo Print\Uninst.isu\""
"DisplayName"="EPSON Photo Print"

[Uninstall\EPSON S21 Series]
"DisplayName"="EPSON S21 Series Printer Uninstall"
"UninstallString"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FINSFAE.EXE /R /APD /P:\"EPSON S21 Series\""

[Uninstall\EPSON S21 Series\PrinterDrivers]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series\Files]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series\Files\Extension]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series\Files\Extension\101]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series\Files\Extension\102]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series\Settings]

[Uninstall\EPSON S21 Series\PrinterDrivers\EPSON S21 Series\Settings\HKEY_LOCAL_MACHINE]

[Uninstall\Epson Stylus S21_T21_T27 Guida utente]
"DisplayName"="Epson Stylus S21_T21_T27 Manuale"
"UninstallString"="C:\Programmi\EPSON\TPMANUAL\ESS21_T21_T27\ITA\USE_G\DOCUNINS.EXE"

[Uninstall\Fontcore]

[Uninstall\ICW]

[Uninstall\IDNMitigationAPIs]

[Uninstall\IE40]

[Uninstall\IE4Data]

[Uninstall\IE5BAKEX]

[Uninstall\ie7]

[Uninstall\ie8]
"DisplayName"="Windows Internet Explorer 8"
"UninstallString"="\"C:\WINDOWS\ie8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\Internet Explorer\iexplore.exe"

[Uninstall\IEData]

[Uninstall\InstallShield Uninstall Information]

[Uninstall\InstallShield Uninstall Information\{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}]

[Uninstall\InstallShield Uninstall Information\{3633BA28-67CE-4AC8-A677-3406CA84C3D8}]

[Uninstall\InstallShield_{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}]
"UninstallString"="C:\PROGRA~1\FILECO~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3} UNINSTALL"
"DisplayName"="OpenMG AAC Add-on Module 1.0.00"
"InstallSource"="F:\common\omgaddon\"
"DisplayIcon"=expand:""

[Uninstall\InstallShield_{3633BA28-67CE-4AC8-A677-3406CA84C3D8}]
"UninstallString"="C:\PROGRA~1\FILECO~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{3633BA28-67CE-4AC8-A677-3406CA84C3D8} UNINSTALL"
"DisplayName"="OpenMG Secure Module 4.5.01"
"InstallSource"="F:\common\openmg\"
"DisplayIcon"=expand:""

[Uninstall\KB892130]
"DisplayName"="Windows Genuine Advantage Validation Tool (KB892130)"
"UninstallString"=""

[Uninstall\KB898461]
"DisplayName"="Aggiornamento per Windows XP (KB898461)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe\""

[Uninstall\KB915865]
"DisplayName"="Hotfix for Windows XP (KB915865)"
"UninstallString"=""

[Uninstall\KB923561]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB923561)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe\""

[Uninstall\KB936782_WMP11]
"DisplayName"="Aggiornamento della protezione per Windows Media Player 11 (KB936782)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB938127-v2-IE7]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 7 (KB938127-v2)"
"UninstallString"="\"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB938464]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB938464)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe\""

[Uninstall\KB939683]
"DisplayName"="Aggiornamento rapido per Windows Media Player 11 (KB939683)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB941569]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB941569)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe\""

[Uninstall\KB946648]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB946648)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe\""

[Uninstall\KB950762]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB950762)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe\""

[Uninstall\KB950974]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB950974)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe\""

[Uninstall\KB951066]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB951066)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe\""

[Uninstall\KB951376-v2]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB951376-v2)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe\""

[Uninstall\KB951698]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB951698)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe\""

[Uninstall\KB951748]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB951748)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe\""

[Uninstall\KB951978]
"DisplayName"="Aggiornamento per Windows XP (KB951978)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe\""

[Uninstall\KB952004]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB952004)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe\""

[Uninstall\KB952069_WM9]
"DisplayName"="Aggiornamento della protezione per Windows Media Player (KB952069)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB952287]
"DisplayName"="Aggiornamento rapido per Windows XP (KB952287)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe\""

[Uninstall\KB952954]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB952954)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe\""

[Uninstall\KB954154_WM11]
"DisplayName"="Aggiornamento della protezione per Windows Media Player 11 (KB954154)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB954155_WM9]
"DisplayName"="Aggiornamento della protezione per Windows Media Player (KB954155)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB954211]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB954211)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe\""

[Uninstall\KB954459]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB954459)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe\""

[Uninstall\KB954550-v5]
"DisplayName"="Hotfix for Windows XP (KB954550-v5)"
"UninstallString"=""

[Uninstall\KB954600]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB954600)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe\""

[Uninstall\KB955069]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB955069)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe\""

[Uninstall\KB955759]
"DisplayName"="Aggiornamento per Windows XP (KB955759)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe\""

[Uninstall\KB955839]
"DisplayName"="Aggiornamento per Windows XP (KB955839)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe\""

[Uninstall\KB956391]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956391)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe\""

[Uninstall\KB956572]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956572)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe\""

[Uninstall\KB956744]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956744)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe\""

[Uninstall\KB956802]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956802)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe\""

[Uninstall\KB956803]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956803)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe\""

[Uninstall\KB956841]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956841)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe\""

[Uninstall\KB956844]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB956844)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe\""

[Uninstall\KB957095]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB957095)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe\""

[Uninstall\KB957097]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB957097)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe\""

[Uninstall\KB958215-IE7]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 7 (KB958215)"
"UninstallString"="\"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB958644]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB958644)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe\""

[Uninstall\KB958687]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB958687)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe\""

[Uninstall\KB958690]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB958690)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe\""

[Uninstall\KB958869]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB958869)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe\""

[Uninstall\KB959426]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB959426)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe\""

[Uninstall\KB959772_WM11]
"DisplayName"="Aggiornamento critico per Windows Media Player 11 (KB959772)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB960225]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB960225)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe\""

[Uninstall\KB960714-IE7]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 7 (KB960714)"
"UninstallString"="\"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB960715]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB960715)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe\""

[Uninstall\KB960803]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB960803)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe\""

[Uninstall\KB960859]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB960859)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe\""

[Uninstall\KB961118]
"DisplayName"="Aggiornamento rapido per Windows XP (KB961118)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe\""

[Uninstall\KB961260-IE7]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 7 (KB961260)"
"UninstallString"="\"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB961371]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB961371)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe\""

[Uninstall\KB961373]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB961373)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe\""

[Uninstall\KB961501]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB961501)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe\""

[Uninstall\KB963027-IE7]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 7 (KB963027)"
"UninstallString"="\"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB967715]
"DisplayName"="Aggiornamento per Windows XP (KB967715)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe\""

[Uninstall\KB968389]
"DisplayName"="Aggiornamento per Windows XP (KB968389)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe\""

[Uninstall\KB968537]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB968537)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe\""

[Uninstall\KB968816_WM9]
"DisplayName"="Aggiornamento della protezione per Windows Media Player (KB968816)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB969059]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB969059)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe\""

[Uninstall\KB969897-IE7]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 7 (KB969897)"
"UninstallString"="\"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB969897-IE8]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 8 (KB969897)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB969898]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB969898)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe\""

[Uninstall\KB969947]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB969947)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe\""

[Uninstall\KB970238]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB970238)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe\""

[Uninstall\KB970430]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB970430)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe\""

[Uninstall\KB970653-v3]
"DisplayName"="Aggiornamento rapido per Windows XP (KB970653-v3)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe\""

[Uninstall\KB971180-IE8]
"DisplayName"="Aggiornamento per Windows Internet Explorer 8 (KB971180)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB971486]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB971486)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe\""

[Uninstall\KB971557]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB971557)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe\""

[Uninstall\KB971633]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB971633)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe\""

[Uninstall\KB971657]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB971657)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe\""

[Uninstall\KB971737]
"DisplayName"="Aggiornamento per Windows XP (KB971737)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe\""

[Uninstall\KB971961-IE8]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 8 (KB971961)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB972260-IE8]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 8 (KB972260)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB973346]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB973346)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe\""

[Uninstall\KB973354]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB973354)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe\""

[Uninstall\KB973507]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB973507)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe\""

[Uninstall\KB973525]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB973525)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe\""

[Uninstall\KB973540_WM9]
"DisplayName"="Aggiornamento della protezione per Windows Media Player (KB973540)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe\""
"DisplayIcon"=expand:"\"%ProgramFiles%\windows media player\wmplayer.exe\""

[Uninstall\KB973687]
"DisplayName"="Aggiornamento per Windows XP (KB973687)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe\""

[Uninstall\KB973815]
"DisplayName"="Aggiornamento per Windows XP (KB973815)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe\""

[Uninstall\KB973869]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB973869)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe\""

[Uninstall\KB973904]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB973904)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe\""

[Uninstall\KB974112]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB974112)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe\""

[Uninstall\KB974318]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB974318)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe\""

[Uninstall\KB974392]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB974392)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe\""

[Uninstall\KB974455-IE8]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 8 (KB974455)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB974571]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB974571)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe\""

[Uninstall\KB975025]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB975025)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe\""

[Uninstall\KB975467]
"DisplayName"="Aggiornamento della protezione per Windows XP (KB975467)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe\""

[Uninstall\KB976098-v2]
"DisplayName"="Aggiornamento rapido per Windows XP (KB976098-v2)"
"UninstallString"="\"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe\""

[Uninstall\KB976325-IE8]
"DisplayName"="Aggiornamento della protezione per Windows Internet Explorer 8 (KB976325)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KB976749-IE8]
"DisplayName"="Aggiornamento per Windows Internet Explorer 8 (KB976749)"
"UninstallString"="\"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe\""
"DisplayIcon"="C:\Programmi\internet explorer\iexplore.exe"

[Uninstall\KLiteCodecPack_is1]
"DisplayName"="K-Lite Mega Codec Pack 4.1.7"
"UninstallString"="\"C:\Programmi\K-Lite Codec Pack\unins000.exe\""

[Uninstall\Malwarebytes' Anti-Malware_is1]
"DisplayName"="Malwarebytes' Anti-Malware"
"DisplayIcon"="C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe"
"UninstallString"="\"C:\Programmi\Malwarebytes' Anti-Malware\unins000.exe\""

[Uninstall\Microsoft .NET Framework 3.5 Language Pack - ita]
"DisplayIcon"="C:\WINDOWS\system32\msiexec.exe"
"DisplayName"="Microsoft .NET Framework 3.5 - Language Pack (italiano)"
"UninstallString"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - ita\setup.exe"

[Uninstall\Microsoft .NET Framework 3.5 SP1]
"DisplayIcon"="C:\WINDOWS\system32\msiexec.exe"
"DisplayName"="Microsoft .NET Framework 3.5 SP1"
"UninstallString"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe"

[Uninstall\MobileOptionPack]

[Uninstall\MPlayer2]

[Uninstall\MsJavaVM]

[Uninstall\NetMeeting]

[Uninstall\NLSDownlevelMapping]

[Uninstall\OpenMG HotFix4.5-06-05-10-01]
"UninstallString"="C:\Programmi\File comuni\Sony Shared\OpenMG\HotFixes\HotFix4.5-06-05-12-01\HotFixSetup\setup.exe /u"
"DisplayName"="OpenMG Limited Patch 4.5-06-05-12-01"

[Uninstall\OutlookExpress]

[Uninstall\PCHealth]
"UninstallString"="rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf"

[Uninstall\SAMSUNG Mobile Composite Device]
"DisplayName"="SAMSUNG Mobile Composite Device Software"
"UninstallString"="C:\WINDOWS\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe"

[Uninstall\SAMSUNG Mobile Modem]
"DisplayName"="SAMSUNG Mobile Modem Driver Set"
"UninstallString"="C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe"

[Uninstall\Samsung Mobile phone USB driver]
"DisplayName"="Samsung Mobile phone USB driver Software"
"UninstallString"="C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe"

[Uninstall\SAMSUNG Mobile USB Modem]
"DisplayName"="SAMSUNG Mobile USB Modem Software"
"UninstallString"="C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe"

[Uninstall\SAMSUNG Mobile USB Modem 1.0]
"DisplayName"="SAMSUNG Mobile USB Modem 1.0 Software"
"UninstallString"="C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe"

[Uninstall\SchedulingAgent]

[Uninstall\Total Uninstall 5_is1]
"DisplayName"="Total Uninstall 5.0.1"
"DisplayIcon"="C:\Programmi\Total Uninstall 5\Tu.exe"
"UninstallString"="\"C:\Programmi\Total Uninstall 5\unins000.exe\""

[Uninstall\UltraISO_is1]
"DisplayName"="UltraISO Premium V9.33"
"DisplayIcon"="C:\Programmi\UltraISO\UltraISO.exe"
"UninstallString"="\"C:\Programmi\UltraISO\unins000.exe\""

[Uninstall\Wdf01000]

[Uninstall\Wdf01001]

[Uninstall\Wdf01005]

[Uninstall\Wdf01007]

[Uninstall\Wdf01009]
"DisplayName"="Microsoft Kernel-Mode Driver Framework Feature Pack 1.9"
"UninstallString"="\"C:\WINDOWS\$NtUninstallWdf01009$\spuninst\spuninst.exe\""

[Uninstall\WGA]
"DisplayName"="Windows Genuine Advantage Validation Tool (KB892130)"

[Uninstall\WgaNotify]
"DisplayName"="Windows Genuine Advantage Notifications (KB905474)"
"UninstallString"=""

[Uninstall\WIC]

[Uninstall\WinRAR archiver]
"DisplayName"="WinRAR gestione archivi"
"UninstallString"="C:\Programmi\WinRAR\uninstall.exe"
"DisplayIcon"="C:\Programmi\WinRAR\WinRAR.exe"

[Uninstall\XpsEPSC]
"DisplayName"="XML Paper Specification Shared Components Pack 1.0"
"UninstallString"=""

[Uninstall\XPSEPSCLP]
"DisplayName"="XML Paper Specification Shared Components Language Pack 1.0"
"UninstallString"="\"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe\""

[Uninstall\{02627ee5-eaca-4742-a9cc-e687631773e4}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_13\"
"DisplayName"="Nero ShowTime"

[Uninstall\{05308C4E-7285-4066-BAE3-6B50DA6ED755}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeAUM6.0All\"
"UninstallString"=expand:"MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}"
"DisplayName"="Adobe Update Manager CS4"

[Uninstall\{054EFA56-2AC1-48F4-A883-0AB89874B972}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeExtensionManager2All\"
"UninstallString"=expand:"MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}"
"DisplayName"="Adobe Extension Manager CS4"

[Uninstall\{086a7d8c-0a38-4c7f-819a-620275550d5c}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_4\"
"DisplayName"="Nero BurningROM"

[Uninstall\{098727E1-775A-4450-B573-3F441F1CA243}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\kuler2.0-mul\"
"UninstallString"=expand:"MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}"
"DisplayName"="kuler"

[Uninstall\{098A2A49-7CF3-4F08-A38D-FB879117152A}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeColorNA_ExtraSettings2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{098A2A49-7CF3-4F08-A38D-FB879117152A}"
"DisplayName"="Adobe Color NA Extra Settings CS4"

[Uninstall\{0D6013AB-A0C7-41DC-973C-E93129C9A29F}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeColorJA_ExtraSettings2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}"
"DisplayName"="Adobe Color JA Extra Settings CS4"

[Uninstall\{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\"
"UninstallString"=expand:"MsiExec.exe /I{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}"
"DisplayName"="Adobe Setup"

[Uninstall\{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeColorEU_Recommended2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}"
"DisplayName"="Adobe Color EU Recommended Settings CS4"

[Uninstall\{0F723FC1-7606-4867-866C-CE80AD292DAF}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeCSIAll\"
"UninstallString"=expand:"MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}"
"DisplayName"="Adobe CSI CS4"

[Uninstall\{11E83B33-972B-4512-A447-FF0FD0246EE9}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{11E83B33-972B-4512-A447-FF0FD0246EE9}\setup.exe\" -l0x10 "

[Uninstall\{1618734A-3957-4ADD-8199-F973763109A8}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeALMAnchorService2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}"
"DisplayName"="Adobe Anchor Service CS4"

[Uninstall\{16E16F01-2E2D-4248-A42F-76261C147B6C}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeDriveAll\"
"UninstallString"=expand:"MsiExec.exe /I{16E16F01-2E2D-4248-A42F-76261C147B6C}"
"DisplayName"="Adobe Drive CS4"

[Uninstall\{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeColorCommonSetRGB2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}"
"DisplayName"="AdobeColorCommonSetRGB"

[Uninstall\{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}]
"InstallSource"="d:\download\emule\adobe\adobe photoshop cs4 extended - italiano - (da provare)\payloads\adobeair1.0\"
"UninstallString"=expand:"MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}"
"DisplayName"="Adobe AIR"

[Uninstall\{1c00c7c5-e615-4139-b817-7f4003de68c0}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_10\"
"DisplayName"="Nero PhotoSnap Help"

[Uninstall\{20400dbd-e6db-45b8-9b6b-1dd7033818ec}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_20\"
"DisplayName"="Nero InfoTool"

[Uninstall\{21B6F79B-2286-4BB0-B1E3-BA6B9498D110}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{21B6F79B-2286-4BB0-B1E3-BA6B9498D110}\setup.exe\" -l0x10 "

[Uninstall\{2348b586-c9ae-46ce-936c-a68e9426e214}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_15\"
"DisplayName"="Nero StartSmart Help"

[Uninstall\{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}]
"InstallSource"="F:\common\omgaddon\"
"DisplayName"="OpenMG AAC Add-on Module 1.0.00"

[Uninstall\{23EFDB58-0874-4883-9810-EDA510B19FAE}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{23EFDB58-0874-4883-9810-EDA510B19FAE}\setup.exe\" -l0x10 "

[Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216011FF}]
"DisplayIcon"="C:\Programmi\Java\jre6\\bin\javaws.exe"
"InstallSource"="C:\Documents and Settings\Biagio\Dati applicazioni\Sun\Java\jre1.6.0_11\"
"UninstallString"=expand:"MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}"
"DisplayName"="Java(TM) 6 Update 17"

[Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216013FB}]
"DisplayIcon"="C:\Programmi\Java\jre6\\bin\javaws.exe"

[Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216015FB}]
"DisplayIcon"="C:\Programmi\Java\jre6\\bin\javaws.exe"

[Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216017FB}]
"DisplayIcon"="C:\Programmi\Java\jre6\\bin\javaws.exe"

[Uninstall\{27B9131D-CEFA-42C5-8D7D-56EFD80BAA25}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{27B9131D-CEFA-42C5-8D7D-56EFD80BAA25}\setup.exe\" -l0x10 "

[Uninstall\{2BB79C8D-9DCC-4861-8A23-AE1B0B45E2B6}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{2BB79C8D-9DCC-4861-8A23-AE1B0B45E2B6}\setup.exe\" -l0x10 "

[Uninstall\{2BFBC62A-3353-443D-93BE-7AC641D9F342}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{2BFBC62A-3353-443D-93BE-7AC641D9F342}\setup.exe\" -l0x10 "

[Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160070}]
"DisplayIcon"="C:\Programmi\Java\jre1.6.0_07\\bin\javaws.exe"
"InstallSource"="C:\Documents and Settings\Biagio\Dati applicazioni\Sun\Java\jre1.6.0_07\"
"UninstallString"=expand:"MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}"
"DisplayName"="Java(TM) 6 Update 7"

[Uninstall\{33cf58f5-48d8-4575-83d6-96f574e4d83a}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_19\"
"DisplayName"="Nero DriveSpeed"

[Uninstall\{350C9410-3D7C-4EE8-BAA9-00BCB3D54227}]
"InstallSource"="C:\WINDOWS\system32\"
"DisplayName"="WebFldrs XP"

[Uninstall\{354052fb-cb7a-4ce9-8d7d-5b5483fb10e1}]
"DisplayName"="Blu-ray Disc Authoring Plug-in"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9M13-0083-2710-5622-98W3-TL0A-THW4-9A0T\""

[Uninstall\{359cfc0a-beb1-440d-95ba-cf63a86da34f}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_12\"
"DisplayName"="Nero Recode"

[Uninstall\{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobePDFSettings9-mul\"
"UninstallString"=expand:"MsiExec.exe /I{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}"
"DisplayName"="PDF Settings CS4"

[Uninstall\{3633BA28-67CE-4AC8-A677-3406CA84C3D8}]
"InstallSource"="F:\common\openmg\"
"DisplayName"="OpenMG Secure Module 4.5.01"

[Uninstall\{368ba326-73ad-4351-84ed-3c0a7a52cc53}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_21\"
"DisplayName"="Nero Rescue Agent"

[Uninstall\{36cac872-5669-4610-9295-47828fc70fc5}]
"DisplayName"="Nero Move it"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9M09-01AC-5TE3-KEU9-177W-C6E0-6KCT-2W4K\""

[Uninstall\{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeXMPPanelsAll\"
"UninstallString"=expand:"MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}"
"DisplayName"="Adobe XMP Panels CS4"

[Uninstall\{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeColorPhotoshop2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}"
"DisplayName"="Adobe Color - Photoshop Specific CS4"

[Uninstall\{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeWinSoftLinguisticsPluginAll\"
"UninstallString"=expand:"MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}"
"DisplayName"="Adobe WinSoft Linguistics Plugin"

[Uninstall\{3e40958c-7902-4c0c-9209-f7716a871ddb}]
"DisplayName"="Nero 9"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A\""

[Uninstall\{3F4EC965-28EF-45C3-B063-04B25D4E9679}]
"InstallSource"="F:\Driver & Software\"
"UninstallString"=expand:"MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}"
"DisplayName"="D-Link Bluetooth Software"

[Uninstall\{43e39830-1826-415d-8bae-86845787b54b}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_16\"
"DisplayName"="Nero Vision"

[Uninstall\{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeServiceManager-mul\"
"UninstallString"=expand:"MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}"
"DisplayName"="Adobe Service Manager Extension"

[Uninstall\{56C049BE-79E9-4502-BEA7-9754A3E60F9B}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_tpi_msxml-4\"
"UninstallString"=expand:"MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}"
"DisplayName"="neroxml"

[Uninstall\{595a3116-40bb-4e0f-a2e8-d7951da56270}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_6\"
"DisplayName"="NeroExpress"

[Uninstall\{59EC5F32-D8D7-3909-B0CB-255AD09F5993}]
"InstallSource"="d:\17414968ed784d65bfedd40c6e7b3377\netfx30lp\"
"UninstallString"=expand:"MsiExec.exe /I{59EC5F32-D8D7-3909-B0CB-255AD09F5993}"
"DisplayName"="Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - ITA"

[Uninstall\{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_16\"
"DisplayName"="Nero Vision"

[Uninstall\{5e08ecd1-c98e-4711-bf65-8fd736b3f969}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_21\"
"DisplayName"="Nero RescueAgent Help"

[Uninstall\{60c731fb-c951-41ce-ad41-8e54c8594609}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_50\"
"DisplayName"="Nero Disc Copy Gadget Help"

[Uninstall\{62ac81f6-bdd3-4110-9d36-3e9eaab40999}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_5\"
"DisplayName"="Nero CoverDesigner"

[Uninstall\{63C24A08-70F3-4C8E-B9FB-9F21A903801D}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeVideoProfilesCS2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}"
"DisplayName"="Adobe Color Video Profiles CS CS4"

[Uninstall\{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobePhotoshop11-Support\"
"UninstallString"=expand:"MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}"
"DisplayName"="Adobe Photoshop CS4 Support"

[Uninstall\{67F0E67A-8E93-4C2C-B29D-47C48262738A}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeDeviceCentral2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}"
"DisplayName"="Adobe Device Central CS4"

[Uninstall\{68243FF8-83CA-466B-B2B8-9F99DA5479C4}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeColorCommonSetCMYK2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{68243FF8-83CA-466B-B2B8-9F99DA5479C4}"
"DisplayName"="AdobeColorCommonSetCMYK"

[Uninstall\{6C11D561-620B-47DA-A693-4C597F3CDF40}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{6C11D561-620B-47DA-A693-4C597F3CDF40}\setup.exe\" -l0x10 Uninstall"
"DisplayName"="EPSON Smart Panel"
"DisplayIcon"="C:\Programmi\EPSON\Smart Panel\SmaPanel.exe"

[Uninstall\{71CB2612-627C-3D58-8D82-B77444B27B6A}]
"InstallSource"="d:\17414968ed784d65bfedd40c6e7b3377\netfx20lp\"
"UninstallString"=expand:"MsiExec.exe /I{71CB2612-627C-3D58-8D82-B77444B27B6A}"
"DisplayName"="Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - ITA"

[Uninstall\{7299052b-02a4-4627-81f2-1818da5d550d}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\IXP001.TMP\"
"UninstallString"=expand:"MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}"
"DisplayName"="Microsoft Visual C++ 2005 Redistributable"

[Uninstall\{7748ac8c-18e3-43bb-959b-088faea16fb2}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_15\"
"DisplayName"="Nero StartSmart"

[Uninstall\{77e33d87-255e-413e-9c8d-eed2a7f9bebf}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_71\"
"DisplayName"="Nero Live Help"

[Uninstall\{7829db6f-a066-4e40-8912-cb07887c20bb}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_22\"
"DisplayName"="Nero BurnRights"

[Uninstall\{7B694704-8D6C-4833-99E1-311A9788F61F}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{7B694704-8D6C-4833-99E1-311A9788F61F}\setup.exe\" -l0x10 UNINSTALL -removeonly"
"InstallSource"="F:\device\pdf manual\nw-s200 series\"
"DisplayName"="PDF Manual NW-S200 Series"

[Uninstall\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE\" -l0x10 -anything"
"DisplayName"="EPSON Web-To-Page"
"DisplayIcon"="C:\Programmi\EPSON\EPSON Web-To-Page\Setting.ico"

[Uninstall\{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeTypeSupport9-mul\"
"UninstallString"=expand:"MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}"
"DisplayName"="Adobe Type Support CS4"

[Uninstall\{83202942-84b3-4c50-8622-b8c0aa2d2885}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_6\"
"DisplayName"="Nero Express"

[Uninstall\{83877DB1-8B77-45BC-AB43-2BAC22E093E0}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeBridge3All\"
"UninstallString"=expand:"MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}"
"DisplayName"="Adobe Bridge CS4"

[Uninstall\{842B4B72-9E8F-4962-B3C1-1C422A5C4434}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeSuiteSharedConfiguration-mul\"
"UninstallString"=expand:"MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}"
"DisplayName"="Suite Shared Configuration CS4"

[Uninstall\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}]
"InstallSource"="d:\035fb07c2cd0fb8de0265572\"
"UninstallString"=expand:"MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}"
"DisplayName"="MSXML 4.0 SP2 (KB954430)"

[Uninstall\{869200db-287a-4dc0-b02b-2b6787fbcd4c}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_57\"
"DisplayName"="Nero DiscSpeed"

[Uninstall\{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}]
"UninstallString"="C:\Programmi\InstallShield Installation Information\{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}\SETUP.EXE -runfromtemp -l0x0010 UNINST -removeonly"
"InstallSource"="E:\Easy Photo Print\"
"DisplayName"="Epson Easy Photo Print 2"
"DisplayIcon"="C:\Programmi\Epson Software\Easy Photo Print\EPQuicker.exe"

[Uninstall\{88E5FCB8-5F25-11D5-B16F-0800460222F0}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{88E5FCB8-5F25-11D5-B16F-0800460222F0}\setup.exe\" -l0x10 UNINSTALL"

[Uninstall\{90120000-0010-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0010-0410-0000-0000000FF1CE}-C\"
"DisplayName"="Microsoft Software Update for Web Folders (Italian) 12"

[Uninstall\{90120000-0015-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0015-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-0015-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Access MUI (Italian) 2007"

[Uninstall\{90120000-0016-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0016-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-0016-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Excel MUI (Italian) 2007"

[Uninstall\{90120000-0018-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0018-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-0018-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office PowerPoint MUI (Italian) 2007"

[Uninstall\{90120000-0019-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0019-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-0019-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Publisher MUI (Italian) 2007"

[Uninstall\{90120000-001A-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-001A-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-001A-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Outlook MUI (Italian) 2007"

[Uninstall\{90120000-001B-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-001B-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-001B-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Word MUI (Italian) 2007"

[Uninstall\{90120000-001F-0407-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-002C-0410-0000-0000000FF1CE}-C\Proof.de\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Proof (German) 2007"

[Uninstall\{90120000-001F-0409-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-002C-0410-0000-0000000FF1CE}-C\Proof.en\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Proof (English) 2007"

[Uninstall\{90120000-001F-040C-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-002C-0410-0000-0000000FF1CE}-C\Proof.fr\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Proof (French) 2007"

[Uninstall\{90120000-001F-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-002C-0410-0000-0000000FF1CE}-C\Proof.it\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Proof (Italian) 2007"

[Uninstall\{90120000-002C-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-002C-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-002C-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Proofing (Italian) 2007"

[Uninstall\{90120000-0030-0000-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Enterprise 2007"

[Uninstall\{90120000-0044-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-0044-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-0044-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office InfoPath MUI (Italian) 2007"

[Uninstall\{90120000-006E-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-006E-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-006E-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Shared MUI (Italian) 2007"

[Uninstall\{90120000-00A1-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-00A1-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-00A1-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office OneNote MUI (Italian) 2007"

[Uninstall\{90120000-00BA-0410-0000-0000000FF1CE}]
"InstallSource"="C:\MSOCache\All Users\{90120000-00BA-0410-0000-0000000FF1CE}-C\"
"UninstallString"=expand:"MsiExec.exe /X{90120000-00BA-0410-0000-0000000FF1CE}"
"DisplayName"="Microsoft Office Groove MUI (Italian) 2007"

[Uninstall\{92524203-2dd3-4d16-85f6-cc2a21059962}]
"DisplayName"="Nero BackItUp 4"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9M11-01CA-032E-01A5-AA9C-H44K-6T9U-X4HW\""

[Uninstall\{9311A75A-D83D-37B5-8D49-88E7F5AB2762}]
"InstallSource"="d:\17414968ed784d65bfedd40c6e7b3377\"
"UninstallString"=expand:"MsiExec.exe /I{9311A75A-D83D-37B5-8D49-88E7F5AB2762}"
"DisplayName"="Microsoft .NET Framework 3.5 Language Pack - ita"

[Uninstall\{931AB7EA-3656-4BB7-864D-022B09E3DD67}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeLinguisticsAll\"
"UninstallString"=expand:"MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67}"
"DisplayName"="Adobe Linguistics CS4"

[Uninstall\{94D398EB-D2FD-4FD1-B8C4-592635E8A191}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeCMaps2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}"
"DisplayName"="Adobe CMaps CS4"

[Uninstall\{9600B88C-BE14-4BEA-A529-F5F312900BA3}]
"InstallSource"="C:\Programmi\Samsung\Samsung PC Studio 3\{9600B88C-BE14-4BEA-A529-F5F312900BA3}\"
"DisplayName"="Samsung PC Studio 3"

[Uninstall\{982b26ad-ec19-487e-9145-c8a1d348d39b}]
"DisplayName"="mp3PRO Plug-in"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9C00-E0A2-98K1-294K-06XC-MX2C-X988\""

[Uninstall\{98a67610-a3b5-4098-a423-3708040026d3}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_14\"
"DisplayName"="\"Nero SoundTrax Help"

[Uninstall\{9A3EABC0-CA06-11D4-BF77-00104B130C19}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{9A3EABC0-CA06-11D4-BF77-00104B130C19}\setup.exe\" -l0x10 UNINSTALL"
"DisplayName"="EPSON TWAIN 5"

[Uninstall\{9e82b934-9a25-445b-b8df-8012808074ac}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_10\"
"DisplayName"="Nero PhotoSnap"

[Uninstall\{A06275F4-324B-4E85-95E6-87B2CD729401}]
"InstallSource"="D:\Programmi Vari\Antivirus\Windows Defender\"
"UninstallString"=expand:"MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}"
"DisplayName"="Windows Defender"

[Uninstall\{a08cc3d3-4aec-4639-bfc4-009903389070}]
"DisplayName"="Nero MediaHome 4"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9M06-019C-TTET-880Z-5PUM-6XA2-5MEC-35WM\""

[Uninstall\{a209525b-3377-43f4-b886-32f6b6e7356f}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_17\"
"DisplayName"="Nero WaveEditor"

[Uninstall\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}]
"InstallSource"="d:\086351f3e98aa27c00\dotnetfx30\"
"UninstallString"=expand:"MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}"
"DisplayName"="Microsoft .NET Framework 3.0 Service Pack 2"

[Uninstall\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}.KB958483]

[Uninstall\{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_tpi_imagxpress-7.0.74.0\"
"DisplayName"="ImagXpress"

[Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}]
"InstallSource"="C:\Programmi\Google\Update\1.2.183.13\"
"UninstallString"=expand:"MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}"
"DisplayName"="Google Update Helper"

[Uninstall\{AC0A97B5-991D-4761-B4E9-B6F9811B6A38}]
"InstallSource"="D:\Download\Emule\Nod\Nod 32 v4 Ita + patch\"
"DisplayName"="ESET NOD32 Antivirus"

[Uninstall\{AC76BA86-1040-7D70-7761-000000000004}]
"InstallSource"="E:\Adobe Acrobat 9 Pro Extended\Acrobat9\"
"DisplayName"="Adobe Acrobat 9 Pro Extended - Italiano, Español, Nederlands, Português"

[Uninstall\{AC76BA86-1040-7D70-7761-000000000004}{AC76BA86-1040-7D70-7761-000000000004}]
"DisplayIcon"="C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe,0"
"InstallSource"="E:\Adobe Acrobat 9 Pro Extended\Acrobat9\"
"DisplayName"="Adobe Acrobat 9 Pro Extended - Italiano, Español, Nederlands, Português"
"UninstallString"="msiexec /I {AC76BA86-1040-7D70-7761-000000000004}"

[Uninstall\{ad6bc5cc-2ef0-49c4-b33d-cdc8b2c4dc80}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_12\"
"DisplayName"="Nero Recode Help"

[Uninstall\{B100B05B-E290-41EF-9366-8BC4C76D7769}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{B100B05B-E290-41EF-9366-8BC4C76D7769}\setup.exe\" -l0x10 "

[Uninstall\{B14F9B26-D695-4C4A-8B11-0FE6CDCC797B}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{B14F9B26-D695-4C4A-8B11-0FE6CDCC797B}\setup.exe\" -l0x10 "

[Uninstall\{b1adf008-e898-4fe2-8a1f-690d9a06acaf}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_69\"
"DisplayName"="DolbyFiles"

[Uninstall\{B29AD377-CC12-490A-A480-1452337C618D}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeConnect-mul\"
"UninstallString"=expand:"MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}"
"DisplayName"="Connect"

[Uninstall\{b2ec4a38-b545-4a00-8214-13fe0e915e6d}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_61\"
"DisplayName"="Advertising Center"

[Uninstall\{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobePhotoshop11-Core\"
"UninstallString"=expand:"MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}"
"DisplayName"="Adobe Photoshop CS4"

[Uninstall\{B69CC1A5-0404-11D6-ABCB-005004C21D30}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{B69CC1A5-0404-11D6-ABCB-005004C21D30}\setup.exe\" ADDREMOVEDLG"
"DisplayName"="EPSON Copy Utility"

[Uninstall\{b78120a0-cf84-4366-a393-4d0a59bc546c}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_62\"
"DisplayName"="Menu Templates - Starter Kit"

[Uninstall\{BB4E33EC-8181-4685-96F7-8554293DEC6A}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeOutputModuleAll\"
"UninstallString"=expand:"MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}"
"DisplayName"="Adobe Output Module"

[Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}]

[Uninstall\{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_63\"
"DisplayName"="Nero ControlCenter"

[Uninstall\{BDFC3C8D-823E-4FCF-870B-E756B27CB57E}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{BDFC3C8D-823E-4FCF-870B-E756B27CB57E}\setup.exe\" -l0x10 "

[Uninstall\{C084BC61-E537-11DE-8616-005056806466}]
"InstallSource"="C:\WINDOWS\TEMP\7ZipSfx.000\"
"UninstallString"=expand:"MsiExec.exe /X{C084BC61-E537-11DE-8616-005056806466}"
"DisplayName"="Google Earth"

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
"InstallSource"="d:\086351f3e98aa27c00\dotnetfx20\"
"UninstallString"=expand:"MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}"
"DisplayName"="Microsoft .NET Framework 2.0 Service Pack 2"

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB200003]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB431780]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB946922]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB947748]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB949272]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB952137]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB952677]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB953300]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB953990]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB954832]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB956860]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB957541]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB957542]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB957543]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB958129]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB958481]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB960043]

[Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB974417]

[Uninstall\{C4A4722E-79F9-417C-BD72-8D359A090C97}]
"UninstallString"="\"C:\Programmi\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe\" -runfromtemp -l0x0010 -removeonly"
"InstallSource"="D:\Programmi Vari\Samsung PC Studio 3-1.1\Samsung_PC_Studio_322_HF1.exe"
"DisplayName"="Samsung PC Studio 3"
"DisplayIcon"="C:\Programmi\Samsung\Samsung PC Studio 3\Launcher.exe"

[Uninstall\{C52E3EC1-048C-45E1-8D53-10B0C6509683}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeDefaultLanguage2-mul\"
"UninstallString"=expand:"MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}"
"DisplayName"="Adobe Default Language CS4"

[Uninstall\{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_14\"
"DisplayName"="SoundTrax"

[Uninstall\{c884e85c-5611-404d-96e6-f5155a9152df}]
"DisplayName"="Gracenote Plug-in"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9M0C-01A2-K817-3LK8-9X6M-WK3U-L942-3WE1\""

[Uninstall\{cc019e3f-59d2-4486-8d4b-878105b62a71}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_57\"
"DisplayName"="Nero DiscSpeed"

[Uninstall\{CC75AB5C-2110-4A7F-AF52-708680D22FE8}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeCameraRaw5.0All\"
"UninstallString"=expand:"MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}"
"DisplayName"="Photoshop Camera Raw"

[Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}]
"InstallSource"="C:\WINDOWS\TEMP\IXP052BF.tmp\dotnetfx35\x86\"
"UninstallString"=expand:"MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}"
"DisplayName"="Microsoft .NET Framework 3.5 SP1"

[Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB350003]

[Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595]
"DisplayName"="Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)"
"UninstallString"="C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=\"\""

[Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484]
"DisplayName"="Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)"
"UninstallString"="C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=\"\""

[Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB960043]

[Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707]
"DisplayName"="Update for Microsoft .NET Framework 3.5 SP1 (KB963707)"
"UninstallString"="C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=\"\""

[Uninstall\{ce96f5a5-584d-4f8f-aa3e-9baed413db72}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_5\"
"DisplayName"="Nero CoverDesigner Help"

[Uninstall\{d025a639-b9c9-417d-8531-208859000af8}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_4\"
"DisplayName"="NeroBurningROM"

[Uninstall\{D1E0E859-F46D-4708-A41D-ED90C0C1822A}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\D2F7DB6C-14D7-4748-8ED3-2CCF08C6CB9E\"
"UninstallString"=expand:"MsiExec.exe /X{D1E0E859-F46D-4708-A41D-ED90C0C1822A}"
"DisplayName"="Acronis True Image Home"

[Uninstall\{D3568156-59C3-42DF-A520-2C25B6706C91}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{D3568156-59C3-42DF-A520-2C25B6706C91}\setup.exe\" -l0x9 "

[Uninstall\{D76298C2-E532-4A11-BCFF-76F3F19DA84D}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{D76298C2-E532-4A11-BCFF-76F3F19DA84D}\setup.exe\" UNINSTALL"

[Uninstall\{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_13\"
"DisplayName"="Nero ShowTime"

[Uninstall\{dddf46cc-ee41-447b-aeaf-cc9d690676a1}]
"DisplayName"="DTS Plug-in"
"UninstallString"="C:\Programmi\File comuni\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER=\"9K00-0003-8M80-6320-5043-1458-XAA5\""

[Uninstall\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\mia1\"
"DisplayName"="Ad-Aware"
"UninstallString"="C:\Documents and Settings\All Users\Dati applicazioni\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe"

[Uninstall\{DF487E0B-8B2F-430B-A7F9-94DEF592555D}]
"InstallSource"="E:\sw_update\am\"
"UninstallString"=expand:"MsiExec.exe /I{DF487E0B-8B2F-430B-A7F9-94DEF592555D}"
"DisplayName"="RTC Client API v1.3 msm"

[Uninstall\{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_71\"
"DisplayName"="Nero Live"

[Uninstall\{E213C271-AEFA-481D-A9B4-914D88925B8D}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{E213C271-AEFA-481D-A9B4-914D88925B8D}\setup.exe\" -l0x10 "

[Uninstall\{E4848436-0345-47E2-B648-8B522FCDA623}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobePhotoshop11-Driver\"
"UninstallString"=expand:"MsiExec.exe /I{E4848436-0345-47E2-B648-8B522FCDA623}"
"DisplayName"="Adobe Photoshop CS4"

[Uninstall\{e498385e-1c51-459a-b45f-1721e37aa1a0}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_64\"
"DisplayName"="Movie Templates - Starter Kit"

[Uninstall\{e5c7d048-f9b4-4219-b323-8bdb01a2563d}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_19\"
"DisplayName"="Nero DriveSpeed"

[Uninstall\{e8631efb-6b9a-426c-b1ce-e7173ca26bf8}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_17\"
"DisplayName"="Nero WaveEditor Help"

[Uninstall\{e8a80433-302b-4ff1-815d-fcc8eac482ff}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_30\"
"DisplayName"="Nero Installer"

[Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"InstallSource"="D:\Programmi Vari\Programmi per Masterizzare\Alcohol\Alcohol 120% v1.9.5.3105 + Crack\"
"UninstallString"=expand:"MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}"
"DisplayName"="Alcohol 120%"

[Uninstall\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}\setup.exe\" ADDREMOVEDLG"
"DisplayName"="ScanToWeb"

[Uninstall\{F0E64E2E-3A60-40D8-A55D-92F6831875DA}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeSearchforHelp-mul\"
"UninstallString"=expand:"MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}"
"DisplayName"="Adobe Search for Help"

[Uninstall\{f1861f30-3419-44db-b2a1-c274825698b3}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_50\"
"DisplayName"="Nero Disc Copy Gadget"

[Uninstall\{F333A33D-125C-32A2-8DCE-5C5D14231E27}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\mia14E8.tmp\data\Microsoft Visual C++ Runtime 9.0 (includes ATL and MFC) Service Pack 1\mFileBagIDE.dll\bag\"
"UninstallString"=expand:"MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}"
"DisplayName"="Visual C++ 2008 x86 Runtime - (v9.0.30729)"

[Uninstall\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01]
"DisplayName"="Visual C++ 2008 x86 Runtime - v9.0.30729.01"
"UninstallString"="C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=\"\""

[Uninstall\{f4041dce-3fe1-4e18-8a9e-9de65231ee36}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_63\"
"DisplayName"="Nero ControlCenter"

[Uninstall\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}]
"InstallSource"="d:\cd1203da1da03402f35a20e99c43\"
"UninstallString"=expand:"MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}"
"DisplayName"="MSXML 4.0 SP2 (KB973688)"

[Uninstall\{f6bdd7c5-89ed-4569-9318-469aa9732572}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_hlp_22\"
"DisplayName"="Nero BurnRights"

[Uninstall\{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeExtendScriptToolkit3.0.0All\"
"UninstallString"=expand:"MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}"
"DisplayName"="Adobe ExtendScript Toolkit CS4"

[Uninstall\{F93C84A6-0DC6-42AF-89FA-776F7C377353}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobePDFL9-mul\"
"UninstallString"=expand:"MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}"
"DisplayName"="Adobe PDF Library Files CS4"

[Uninstall\{FAD9402A-1A9B-4ABE-A410-393A3622FA5A}]
"UninstallString"="RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup \"C:\Programmi\InstallShield Installation Information\{FAD9402A-1A9B-4ABE-A410-393A3622FA5A}\setup.exe\" -l0x10 "

[Uninstall\{fbcdfd61-7dcf-4e71-9226-873ba0053139}]
"InstallSource"="C:\DOCUME~1\Biagio\IMPOST~1\Temp\NERO1002626\unit_app_20\"
"DisplayName"="Nero InfoTool"

[Uninstall\{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}]
"InstallSource"="D:\Download\Emule\Adobe\Adobe Photoshop CS4 Extended - Italiano - (da provare)\payloads\AdobeFontsAll\"
"UninstallString"=expand:"MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}"
"DisplayName"="Adobe Fonts All"

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall-----

[Uninstall]

[Uninstall\BitTorrent]
"DisplayName"="BitTorrent"
"UninstallString"="C:\Programmi\BitTorrent\uninst.exe"
"DisplayIcon"="C:\Programmi\BitTorrent\bittorrent.exe"

[Uninstall\BitTorrent DNA]
"DisplayIcon"="C:\Programmi\DNA\btdna.exe,0"
"DisplayName"="DNA"
"UninstallString"="\"C:\Programmi\DNA\btdna.exe\" /UNINSTALL"

==========================================
Scan completed in 17,7 minutes
End of report


~~~~~~~~~~~~~~~~~~~~~-----CREDITS-----~~~~~~~~~~~~~~~~~~~~~
SystemScan uses some freeware tools that remain property of their authors:

* SteelWerX Registry Console Tool, Who Am I (Bobby Flekman: www.xs4all.nl/~fstaal01) --> "Registry scan", "PC accounts "
* dumphive (Markus Stephany)--> "Registry scan"
* Listdlls (M.Russinovich, B.Cogswell: www.sysinternals.com) --> "Loaded modules"
* Catchme & MBR Rootkit detector (gmer: www.gmer.net) --> "Hidden objects", "Alternate Data Streams" & "Master Boot Record"
---> NOTE: SystemScan integrates "The Avenger" from Swandog46 (http://swandog46.geekstogo.com) to allow you to remove malwares found in this log

Thanks to all of them for their hard work

Ciao r16
Come mi hai suggerito ho fatto la scansione in modalita provvisoria con Virit il quale ha trovato un file infetto che non è riuscito ad eliminare

Problema dopo il PC non si è più avviato ne nel modo classico ne in modalita provvisoria ne nell'ultima versione funzionante.
cosa è successo?
Adesso ho ripristinato un backup del 29-12-09, pero mi dice che c'è ancora il virus Olmarik
Come faccio x ripulire il tutto?
Grazie

Ok adesso lo faccio dopo ti posto il log

Disistalla Ad-Aware .
Domanda:
il Nod32 è regolare?

Disistalla il Nod.
Finita la disistallazione fai girare questo tooll, che elimina eventuali "rimasugli":
http://www.nod32.nl/download/tool/nod32removal.exe

Dai una pulita (registro compreso)con CCleaner: http://www.aiutamici.com/software?ID=11223
Nella schermata iniziale di CCleaner, clicca su Opzioni e poi Avanzate, togli il segno di spunta a: Cancella i file in Windows Temp solo se più vecchi di 48 ore. (poi esegui le pulizie)

Scarica Avira:
http://www.aiutamici.com/software?ID=10908

Lo configuri esattamente come in questa guida, in formato PDF:

http://www.zeusnews.it/zz_upload/PSV/Guida%20completa%20di%20%20AVIRA%20Antivir%209.pdf

Le voci indicate nella prima immagine a pagina 11 della Guida, spuntale tutte (nell'immagine non lo sono).
Fai una scansione completa e posta il log

Nessun dubbio: meglio Avira.

Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80121

Scarica Findykill:
http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe
installa FindyKill .
chiudi tutte le eventuali applicazioni aperte (antivirus, firewall e programmi "residenti")
disconnettiti da Internet
sconnetti, fisicamente, il modem dal computer.
avvia il tool e digita F per impostare la lingua;
clicca su 2 - Suppression des fichiers infectieux (Eliminazione dei file infetti)
al termine dell'operazione verrà rilasciato un log: salvalo sul Desktop, e postalo qui.
P.S:
Potranno esserci dei riavvii, non preoccuparti, è il programma che stà lavorando.

Fai anche questa:
Scarica elibagla : http://www.zonavirus.com/datos/descargas/95/elibagla.asp scorri a fondo pagina e clicca su "descargar elibagla".
Salva il file sul desktop
IMPORTANTE: Disconnettiti da internet e disattiva il tuo antivirus.
Doppio click sull'icona Elibagla.exe per avviare il programma.
Assicurati che la casella "Eliminar Ficheros Automaticamente" sia spuntata, e clicca sul pulsante "Explorar".
Posta il log che troverai in C:\InfoSat.txt