[color=#e56717]========== Processes (SafeList) ==========[/color]

Transcription

1 OTL logfile created on: 09/04/ Run 1 OTL by OldTimer - Version Folder = C:\Documents and Settings\Utente\Documenti\Downloads Windows XP Professional Edition Service Pack 3 (Version = ) - Type = NTWorkstation Internet Explorer (Version = ) Locale: Country: Italia Language: ITA Date Format: dd/mm/yyyy 511,30 Mb Total Physical Memory 59,34 Mb Available Physical Memory 11,61% Memory free 1,97 Gb Paging File 1,55 Gb Available in Paging File 78,57% Paging File free Paging file location(s): C:\pagefile.sys [binary data] %SystemDrive% = C: %SystemRoot% = C:\WINDOWS %ProgramFiles% = C:\Programmi Drive C: 232,88 Gb Total Space 216,90 Gb Free Space 93,14% Space Free Partition Type: NTFS Drive Z: 465,66 Gb Total Space 419,39 Gb Free Space 90,06% Space Free Partition Type: NTFS Computer Name: DAVIDE User Name: Utente Logged in as Administrator. Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off No Company Name Whitelist: On File Age = 60 Days [color=#e56717]========== Processes (SafeList) ==========[/color] PRC - C:\Documents and Settings\Utente\Documenti\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programmi\Google\Update\ \GoogleCrashHandler.exe (Google Inc.) PRC - C:\Programmi\Google\Chrome\Application\chrome.exe (Google Inc.) PRC - C:\Programmi\PDF Architect\HelperService.exe (pdfforge GmbH) PRC - C:\Programmi\PDF Architect\ConversionService.exe (pdfforge GmbH) PRC - C:\Programmi\Athena\IDProtect Client\Utils\IDProtect Monitor.exe (Athena Smartcard Solutions) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) [color=#e56717]========== Modules (No Company Name) ==========[/color] MOD - C:\Programmi\Google\Chrome\Application\ \PepperFlash\pepflashplayer. dll () MOD - C:\Programmi\Google\Chrome\Application\ \ppgooglenaclpluginchrome.dl l () MOD - C:\Programmi\Google\Chrome\Application\ \pdf.dll () MOD - C:\Programmi\Google\Chrome\Application\ \ffmpegsumo.dll () MOD - C:\Programmi\Google\Chrome\Application\ \chrome_elf.dll () MOD - C:\WINDOWS\system32\sso2ml3.dll () MOD - C:\WINDOWS\system32\msdmo.dll () [color=#e56717]========== Services (SafeList) ==========[/color] SRV - (AGCoreService) -- C:\Programmi\AGI\core\ \AGCoreService.exe File not found SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (SkypeUpdate) -- C:\Programmi\Skype\Updater\Updater.exe (Skype Technologies) SRV - (PDF Architect Helper Service) -- C:\Programmi\PDF Architect\HelperService.exe (pdfforge GmbH) SRV - (PDF Architect Service) -- C:\Programmi\PDF Architect\ConversionService.exe (pdfforge GmbH) SRV - (ServiceLayer) -- C:\Programmi\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (Samsung Network Fax Server) -- Pagina 1

2 C:\WINDOWS\system32\spool\drivers\w32x86\3\NetFaxServer.exe (Samsung Electronics Co., Ltd.) SRV - (MDM) -- C:\Programmi\File comuni\microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) [color=#e56717]========== Driver Services (SafeList) ==========[/color] DRV - (WDICA) -- File not found DRV - (SSPORT) -- C:\WINDOWS\system32\Drivers\SSPORT.sys File not found DRV - (Scutum50) -- System32\Drivers\Scutum50.sys File not found DRV - (RTL8192cu) -- system32\drivers\rtl8192cu.sys File not found DRV - (PDRFRAME) -- File not found DRV - (PDRELI) -- File not found DRV - (PDFRAME) -- File not found DRV - (PDCOMP) -- File not found DRV - (PCIDump) -- File not found DRV - (lbvorxtfpxqmqipm) -- C:\WINDOWS\system32\drivers\lbvorxtfpxqmqipm.sys File not found DRV - (lbrtfdc) -- File not found DRV - (i2omgmt) -- File not found DRV - (esgiguard) -- C:\Programmi\Enigma Software Group\SpyHunter\esgiguard.sys File not found DRV - (Changer) -- File not found DRV - (dg_ssudbus) -- C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.( DRV - (androidusb) -- C:\WINDOWS\system32\drivers\wsadb.sys (Google Inc) DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia) DRV - (rt2870) -- C:\WINDOWS\system32\drivers\rt2870.sys (Ralink Technology, Corp.) DRV - (THRC) -- C:\WINDOWS\system32\drivers\THRC.sys (THRC ENTERPRISE Corp.) DRV - (DgiVecp) -- C:\WINDOWS\system32\drivers\DgivEcp.sys (Samsung Electronics Co., Ltd.) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices) DRV - (ALCXWDM) -- C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.) DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation ) DRV - (xfilt) -- C:\WINDOWS\system32\drivers\xfilt.sys (VIA Technologies,Inc) DRV - (videx32) -- C:\WINDOWS\system32\drivers\videX32.sys (VIA Technologies, Inc.) DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation) DRV - (USBCCID) -- C:\WINDOWS\system32\drivers\usbccid.sys (Microsoft Corporation) [color=#e56717]========== Standard Registry (SafeList) ==========[/color] [color=#e56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D f-A0FF-E1416B8B2E3A}: "URL" = Pagina 2

3 IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S \..\SearchScopes,DefaultScope = IE - HKU\S \Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S \..\SearchScopes,DefaultScope = IE - HKU\S \..\SearchScopes,DefaultScope = IE - HKU\S \Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 Explorer\Main,Search Page = Explorer\Main,Start Page = Explorer\Main,Start Page Redirect Cache = Explorer\Main,Start Page Redirect Cache AcceptLangs = it Explorer\Search,Default_Search_URL = Explorer\Search,SearchAssistant = IE - HKU\S \..\SearchScopes,DefaultScope = IE - HKU\S \..\SearchScopes\{0633EE93-D f-A0FF-E1416B8B2E3A}: "URL" = IE - HKU\S \Software\Microsoft\Windows\Curre ntversion\internet Settings: "ProxyEnable" = 0 [color=#e56717]========== FireFox ==========[/color] FF - prefs.js..extensions.enabledaddons: %7B972ce4c6-7e a ce6fd%7D:24.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programmi\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\programmi\microsoft Silverlight\ \npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programmi\Google\Update\ \npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programmi\Google\Update\ \npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@UtilityChest_49.com/Plugin: C:\Programmi\UtilityChest_49\bar\1.bin\NP49Stub.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Programmi\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programmi\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@ecocerved.it/edw,version= : C:\Programmi\Ecocerved\Mozilla\ \npews.dll (Ecocerved scarl) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@ pdfarchitect.com: C:\Programmi\PDF Architect\FFPDFArchitectExt [2013/04/ ,000, D M] Pagina 3

4 [2013/10/ ,000, D M] (No name found) -- C:\Documents and Settings\Utente\Dati applicazioni\mozilla\extensions [2014/04/ ,000, D M] (No name found) -- C:\Documents and Settings\Utente\Dati applicazioni\mozilla\firefox\profiles\rw40e3j2.default\extensions File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\UTENTE\DATI APPLICAZIONI\MOZILLA\FIREFOX\PROFILES\RW40E3J2.DEFAULT\EXTENSIONS\A9719E64-232B- [color=#e56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseurl}search?q={searchterms}&{google:rlz}{google:originalqueryforsugge stion}{google:assistedquerystats}{google:searchfieldtrialparameter}{google:bookm arkbarpinned}{google:searchclient}{google:sourceid}{google:instantextendedenable dparameter}{google:omniboxstartmarginparameter}ie={inputencoding} CHR - default_search_provider: suggest_url = {google:basesuggesturl}search?{google:searchfieldtrialparameter}client={google:s uggestclient}&gs_ri={google:suggestrid}&xssi=t&q={searchterms}&{google:cursorpos ition}{google:currentpageurl}{google:pageclassification}sugkey={google:suggestap IKeyParameter}, CHR - plugin: Error reading preferences file CHR - Extension: Skype Click to Call = C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\google\chrome\user Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\ _0\ CHR - Extension: Google Wallet = C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\google\chrome\user Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\ _2\ O1 HOSTS File: ([2012/03/ ,000, M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: localhost O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A } - C:\Programmi\PDF Architect\PDFIEHelper.dll (pdfforge GmbH) O2 - BHO: (Guida per l'accesso a Windows Live) - {9030D464-4C02-4ABF-8ECC C6} - C:\Programmi\File comuni\microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (no name) - {DBC80044-A b-BC74-9C25C1C588A9} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S \..\Toolbar\WebBrowser: (no name) - {147D B F9B82C4} - No CLSID value found. O4 - HKLM..\Run: [IDProtect Monitor] C:\Programmi\Athena\IDProtect Client\Utils\IDProtect Monitor.exe (Athena Smartcard Solutions) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = O7 - HKU\S \Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = O7 - HKU\S \Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 Pagina 4

5 O7 - HKU\S \Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S \Software\Policies\Microsoft\Inte rnet Explorer\Control Panel present O7 - HKU\S \SOFTWARE\Microsoft\Windows\Curre ntversion\policies\explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S \SOFTWARE\Microsoft\Windows\Curre ntversion\policies\explorer: NoDriveAutoRun = O7 - HKU\S \SOFTWARE\Microsoft\Windows\Curre ntversion\policies\explorer: NoDrives = 0 O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {233C1507-6A77-46A F871F945D258} (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB9173C7-6DFE-4CD4-A F46CEA}: DhcpNameServer = O18 - Protocol\Handler\ipp\0x {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\system\ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\system\ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\system\ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF C7DD7F5D} - C:\Programmi\File comuni\skype\skype4com.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data { D725-4E58-B B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Pagina iniziale corrente) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\microsoft\wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\microsoft\wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/12/ ,000, M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#e56717]========== Files/Folders - Created Within 60 Days ==========[/color] [2014/04/ ,000, D C] -- C:\AdwCleaner [2014/04/ ,388, C] (Trend Micro Inc.) -- C:\Documents and Settings\Utente\Desktop\HijackThis.exe [2014/04/ ,000, D C] -- C:\Programmi\VS Revo Group [2014/04/ ,623, C] (VS Revo Group Ltd.) -- C:\Documents and Settings\Utente\Desktop\revosetup.exe Pagina 5

6 [2014/04/ ,000,000 RH-D C] -- C:\Documents and Settings\Utente\Recent [2014/04/ ,000, D C] -- C:\Documents and Settings\Utente\Menu Avvio\Programmi\Esecuzione automatica [2014/04/ ,000, D C] -- C:\Programmi\File comuni\wise Installation Wizard [2014/04/ ,000, D C] -- C:\Programmi\Enigma Software Group [2014/04/ ,107, C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [2014/04/ ,000, D C] -- C:\Documents and Settings\All Users\Menu Avvio\Programmi\Malwarebytes Anti-Malware [2014/04/ ,050, C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys [2014/04/ ,023, C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2014/04/ ,000, D C] -- C:\Programmi\Malwarebytes Anti-Malware [2014/04/ ,000, D C] -- C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\genesis [2014/03/ ,000, D C] -- C:\Documents and Settings\Utente\Desktop\ISPEZIONI CAMPO [2014/03/ ,777, C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe [2014/03/ ,000, D C] -- C:\Documents and Settings\Utente\Documenti\alfonso fiumarella [2014/03/ ,000,000 R--D C] -- C:\Documents and Settings\Utente\Desktop\PINK FLOYD COLLECTION [2014/02/ ,000, D C] -- C:\Documents and Settings\Utente\Desktop\voltura romeo [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#e56717]========== Files - Modified Within 60 Days ==========[/color] [2014/04/ ,001, M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2014/04/ ,002,048 --S- M] () -- C:\WINDOWS\bootstat.dat [2014/04/ ,000, M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2014/04/ ,001, M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2014/04/ ,016, M] () -- C:\Documents and Settings\Utente\Desktop\hijackthis file log.pdf [2014/04/ ,388, M] (Trend Micro Inc.) -- C:\Documents and Settings\Utente\Desktop\HijackThis.exe [2014/04/ ,623, M] (VS Revo Group Ltd.) -- C:\Documents and Settings\Utente\Desktop\revosetup.exe [2014/04/ ,552, M] () -- C:\WINDOWS\System32\perfh010.dat [2014/04/ ,502, M] () -- C:\WINDOWS\System32\perfh009.dat [2014/04/ ,103, M] () -- C:\WINDOWS\System32\perfc010.dat [2014/04/ ,087, M] () -- C:\WINDOWS\System32\perfc009.dat [2014/04/ ,000,436 -H-- M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D957C D AE8-C12D28D8245C }.job [2014/04/ ,001, M] () -- C:\Documents and Settings\Utente\Desktop\Google Chrome.lnk [2014/04/ ,001, M] () -- C:\WINDOWS\imsins.BAK [2014/04/ ,107, M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [2014/04/ ,302, M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2014/04/ ,000, M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk [2014/04/ ,042, M] () -- C:\Documents and Pagina 6

7 Settings\Utente\Desktop\Immag0509.jpg [2014/04/ ,217, M] () -- C:\Documents and Settings\Utente\Desktop\nota_920_all_B1_5feb_14.pdf [2014/04/ ,002, M] () -- C:\WINDOWS\System32\wpa.dbl [2014/04/ ,050, M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys [2014/04/ ,023, M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2014/03/ ,045, M] () -- C:\Documents and Settings\Utente\Desktop\F24 ELLECI pdf [2014/03/ ,045, M] () -- C:\Documents and Settings\Utente\Desktop\F24 ELLECI pdf [2014/03/ ,005, M] () -- C:\Documents and Settings\Utente\Desktop\DOC_ (1).pdf [2014/03/ ,005, M] () -- C:\Documents and Settings\Utente\Desktop\DOC_ pdf [2014/03/ ,292, M] () -- C:\Documents and Settings\Utente\Desktop\Mod+18+T.pdf [2014/03/ ,692, M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2014/03/ ,071, M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2014/03/ ,777, M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe [2014/03/ ,037, M] () -- C:\Documents and Settings\Utente\Documenti\curriculum vitae mauceri franco1.pdf [2014/03/ ,000,131 -H-- M] () -- C:\Documents and Settings\Utente\Desktop\.~lock.Nuovo documento password.rtf# [2014/02/ ,011, M] () -- C:\Documents and Settings\Utente\Dati applicazioni\smarthruoptions.xml [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#e56717]========== Files Created - No Company Name ==========[/color] [2014/04/ ,016, C] () -- C:\Documents and Settings\Utente\Desktop\hijackthis file log.pdf [2014/04/ ,001, C] () -- C:\WINDOWS\imsins.BAK [2014/04/ ,302, C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2014/04/ ,000, C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk [2014/04/ ,042, C] () -- C:\Documents and Settings\Utente\Desktop\Immag0509.jpg [2014/04/ ,217, C] () -- C:\Documents and Settings\Utente\Desktop\nota_920_all_B1_5feb_14.pdf [2014/04/ ,919, C] () -- C:\Documents and Settings\Utente\Desktop\c.i c.f. nino campo.pdf [2014/03/ ,045, C] () -- C:\Documents and Settings\Utente\Desktop\F24 ELLECI pdf [2014/03/ ,045, C] () -- C:\Documents and Settings\Utente\Desktop\F24 ELLECI pdf [2014/03/ ,005, C] () -- C:\Documents and Settings\Utente\Desktop\DOC_ (1).pdf [2014/03/ ,005, C] () -- C:\Documents and Settings\Utente\Desktop\DOC_ pdf [2014/03/ ,292, C] () -- C:\Documents and Settings\Utente\Desktop\Mod+18+T.pdf [2014/03/ ,037, C] () -- C:\Documents and Settings\Utente\Documenti\curriculum vitae mauceri franco1.pdf [2014/03/ ,000,131 -H-- C] () -- C:\Documents and Settings\Utente\Desktop\.~lock.Nuovo documento password.rtf# [2013/08/ ,014, C] () -- C:\WINDOWS\System32\RaCoInst.dat [2013/04/ ,308, C] () -- C:\Documents and Settings\LocalService\Impostazioni locali\dati applicazioni\wpffontcache_v0400-system.dat [2013/02/ ,974, C] () -- C:\WINDOWS\System32\cis-2.4.dll Pagina 7

8 [2013/02/ ,081, C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll [2013/02/ ,065, C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll [2013/02/ ,057, C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll [2012/03/ ,017, C] () -- C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\webpageicons.db [2012/02/ ,011, C] () -- C:\Documents and Settings\Utente\Dati applicazioni\smarthruoptions.xml [2011/10/ ,000, C] () -- C:\Documents and Settings\Utente\dikeutil.ini [2011/10/ ,000, C] () -- C:\Documents and Settings\Utente\dike.ini [2011/10/ ,213, C] () -- C:\Documents and Settings\Utente\caCertsList [2011/09/ ,000, C] () -- C:\Documents and Settings\Utente\UnifiedToolbarCleanup.bat [2007/02/ ,000, C] () -- C:\Documents and Settings\Utente\default.pls [2006/12/ ,126, C] () -- C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\dcbc2a71-70d8-4dan-ehr8-e0d61dea3fdf.ini [2006/12/ ,000, C] () -- C:\Documents and Settings\Utente\Impostazioni locali\dati applicazioni\fusioncache.dat [2006/12/ ,409, C] () -- C:\Documents and Settings\LocalService\Impostazioni locali\dati applicazioni\fontcache dat [color=#e56717]========== ZeroAccess Check ==========[/color] [2006/12/ ,000,227 RHS- M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc fd-b9a3-0c966feabec1} \InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee e-409d6c4515e9} \InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc fd-b9a3-0c966feabec1 }\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/ ,499, M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F }\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2008/04/ ,472, M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1 }\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/ ,273, M] (Microsoft Corporation) "ThreadingModel" = Both [color=#e56717]========== LOP Check ==========[/color] [2013/04/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\athena [2012/05/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\nitro PDF [2013/01/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\nokia [2011/10/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\nokiainstallercache [2011/10/ ,000, D M] -- C:\Documents and Settings\All Pagina 8

9 Users\Dati applicazioni\pc Suite [2013/08/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\ralink Driver [2013/04/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\samsung [2013/07/ ,000, D M] -- C:\Documents and Settings\All Users\Dati applicazioni\tp-link [2011/03/ ,000, D M] -- C:\Documents and Settings\TEMP\Dati applicazioni\babylon(2) [2012/05/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\downloaded Installations [2012/04/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\flightgear.org [2012/04/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\fltk.org [2011/09/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\microfatture3 [2012/05/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\nitro PDF [2013/01/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\nokia [2011/10/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\nokia Ovi Suite [2013/01/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\nokia Suite [2011/09/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\openoffice.org [2011/10/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\pc Suite [2013/04/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\pdf Architect [2013/10/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\photoscape [2013/04/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\samsung [2012/04/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\subversion [2011/08/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\unity [2013/11/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\utorrent [2013/10/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\wondershare [2011/09/ ,000, D M] -- C:\Documents and Settings\Utente\Dati applicazioni\zipgenius [color=#e56717]========== Purity Check ==========[/color] < End of report > Pagina 9