C:\WINDOWS\system32\ragent.exe
C:\WINDOWS\csrs.exe
C:\WINDOWS\regedit.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://companyweb
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\Documents and Settings\Tony\Desktop\725104142.dll (file missing)
{C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll
O4 - Startup: Popup.lnk = C:\MKT-Director\Database\Office\Popup.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesit.dll
O14 - IERESET.INF: START_PAGE_URL=http://companyweb
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) -
http://www.flyordie.com/pub/dl/msjavx86.exe
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) -
http://recserver/tsweb/msrdp.cab
O16 - DPF: {BB5DB54E-BAE2-48BF-B0BD-2FD3D9F8EB08} (Insignis SpectivaWeb) -
http://spectiva1.cieffe.com/SpectivaVisionWEB.cab
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) -
http://www.candystand.com/assets/act...cheManager.CAB
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) -
https://www14.bancobrasil.com.br/plugin/GbpDist.cab
O17 - HKLM\Software\..\Telephony: DomainName = RECITALIA.LOCAL
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = RECITALIA.LOCAL
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia LTDA - C:\Programmi\GbPlugin\GbpSv.exe
O23 - Service: Remote Agent (RAgent) - Unknown owner - C:\WINDOWS\SYSTEM32\ragent.exe
i file in neretto falli analizzare
qui