|
|||||||
|
|
|
 |
|
|
Strumenti |
14-12-2015, 13:07
|
#1 |
|
Junior Member
Iscritto dal: Dec 2015
Messaggi: 6
|
Pc si comporta in modo strano (Windows Vista)
Salve da qualche giorno ho un problema con il pc,a volte Avira è come "nascosto" e non si apre oppure quando è aperto Utorrent nei processi aperti compare anche un doppio processo chiamato Utorrentie.exe che tempo fa non compariva.
Viposto il log sperando mi possiate aiutare. Grazie,Luca. [/code]Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14.01.17, on 14/12/2015 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16723) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\Epson Software\Event Manager\EEventManager.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Avira\Launcher\Avira.Systray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_20_0_0_235.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_20_0_0_235.exe C:\Users\valerio\AppData\Roaming\uTorrent\uTorrent.exe C:\Users\valerio\AppData\Roaming\uTorrent\updates\3.4.5_41372\utorrentie.exe C:\Users\valerio\AppData\Roaming\uTorrent\updates\3.4.5_41372\utorrentie.exe C:\Users\valerio\Saved Games\Downloads\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...esario&pf=cnnb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...esario&pf=cnnb R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" O4 - HKLM\..\Run: [UpdatePDIRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0" O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [LG Smart Share] "C:\Program Files\LG Software\LG Smart Share\SmartShareStartXP.exe" tray O4 - HKLM\..\Run: [Avira SystrayStartTrigger] C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [EPSON SX130 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHJE.EXE /FU "C:\Windows\TEMP\E_SC59F.tmp" /EF "HKCU" O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_SD680.tmp" /EF "HKCU" O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: 4APoker - {47DDC1F4-8611-4f89-806E-3CBD8B7F924F} - C:\Programs\4A\4APoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: 4APoker - {47DDC1F4-8611-4f89-806E-3CBD8B7F924F} - C:\Programs\4A\4APoker\RunApp.exe (file missing) O9 - Extra button: PokerStars.it - {C4046502-6524-4d87-896C-878F57D1FF07} - C:\Program Files\PokerStars.IT\PokerStarsUpdate.exe O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe O23 - Service: Avira Pianificatore (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE O23 - Service: Avira Service Host (Avira.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MBAMService - Malwarebytes - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: ONDA Autorun CDROM Monitor - Unknown owner - C:\Windows\system32\SupportAppXL\onda_mon.exe O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SpyHunter 4 Service - Unknown owner - C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (file missing) O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe -- End of file - 9600 bytes [/code] |
|
|
|
14-12-2015, 19:47
|
#2 |
|
Member
Iscritto dal: Dec 2015
Messaggi: 54
|
ciao Pancev
ho dato un'occhiata un po' veloce e le due cose che ho notato sono le moltissime applicazioni che partono all'avvio di windows che altro non fanno che rallentare il pc e SpyHunter che consiglio sempre di rimuoverlo, per cio' che riguarda il tuo dubbio dovrebbe essere un'infezione da adware da pannello di controllo rimuovi FlashPlayer lo reinstalliamo dopo per ora fammi queste due scansioni scarica adwcleaner clicca su scan e poi su ''clean'' conferma con OK le varie finestre che ti compariranno. alla fine clicca su Report e allega il contenuto disattiva l'antivirus scarica farbar-recovery e mettilo sul desktop Devi scaricare la versione(32 o 64 bit compatibile con il tuo sistema) Avvialo e clicca su yes quando ti chiede di accettare le condizioni Clicca su SCAN Una volta terminata la scansione il tool creerà nella stessa directory di dove è posizionato FRST un log chiamato FRST.txt. Allegalo nella tua prossima risposta |
|
|
|
|
15-12-2015, 00:24
|
#3 |
|
Junior Member
Iscritto dal: Dec 2015
Messaggi: 6
|
Dove mi hai indicato di caricare i log mi segnala sito pericoloso e non mi permette di entrare..ora posto qui quello di adwcleaner ma non ha rilevato nulla.
Codice:
# AdwCleaner v5.025 - Creato file registro eventi 15/12/2015 in 01:11:42 # Aggiornato 13/12/2015 da Xplode # Database : 2015-12-13.2 [Server] # Sistema operativo : Windows Vista (TM) Home Basic Service Pack 2 (x86) # Nome utente : valerio - PC-VALERIO # In esecuzione da : C:\Users\valerio\Saved Games\Downloads\adwcleaner_5.025(1).exe # Opzione : Pulizia # Supporto : http://toolslib.net/forum ***** [ Servizi ] ***** ***** [ Cartelle ] ***** ***** [ File ] ***** ***** [ DLLs ] ***** ***** [ Collegamenti ] ***** ***** [ Attività pianificate ] ***** ***** [ Registry ] ***** ***** [ Browser web ] ***** ************************* :: Chiavi "Tracing" eliminatas :: Impostazioni Winsock azzerate ########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [751 byte] ########## |
|
|
|
|
15-12-2015, 00:37
|
#4 |
|
Junior Member
Iscritto dal: Dec 2015
Messaggi: 6
|
Ecco il log di FRST...
Codice:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:14-12-2015
Ran by valerio (administrator) on PC-VALERIO (15-12-2015 01:30:13)
Running from C:\Users\valerio\Desktop
Loaded Profiles: valerio (Available Profiles: valerio)
Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) Language: Italiano (Italia)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\stacsv.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink Corp.) C:\Program Files\HP\QuickPlay\QPService.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Macrovision Corporation) C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
(ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Motive Communications, Inc.) C:\Program Files\Common Files\Motive\McciCMService.exe
() C:\Windows\System32\SupportAppXL\onda_mon.exe
() C:\Program Files\SMINST\BLService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [QPService] => C:\Program Files\HP\QuickPlay\QPService.exe [468264 2008-09-23] (CyberLink Corp.)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl.exe] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [206128 2008-10-10] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-10-30] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDIRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [HP Health Check Scheduler] => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-10-09] (Hewlett-Packard)
HKLM\...\Run: [WirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-01-12] (Hewlett-Packard)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [979328 2010-08-30] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [782520 2015-10-27] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [450652 2009-06-03] (IDT, Inc.)
HKLM\...\Run: [LG Smart Share] => C:\Program Files\LG Software\LG Smart Share\SmartShareStartXP.exe [134744 2014-01-06] (LG Electronics Inc.)
HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-11-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\Run: [HPAdvisor] => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [966656 2008-11-18] (Hewlett-Packard)
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\Run: [ISUSPM] => C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe [222128 2007-03-29] (Macrovision Corporation)
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\Run: [EPSON SX130 Series] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHJE.EXE [208384 2010-12-07] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\Run: [EPSON Stylus DX4000 Series] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE [182272 2007-10-09] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {32aa10c2-0922-11e5-a76e-00238baf39b6} - G:\iStudio.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {638dfe97-35b7-11e0-951c-00238baf39b6} - F:\StartVMCLite.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {638dfe98-35b7-11e0-951c-00238baf39b6} - F:\StartVMCLite.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {638dfe9e-35b7-11e0-951c-00238baf39b6} - F:\StartVMCLite.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {96db6408-2810-11e2-9764-00238baf39b6} - F:\Setup.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {97375184-048a-11e1-98ab-00238baf39b6} - F:\Setup.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {c9a7e450-387f-11e0-b2fc-00238baf39b6} - F:\Windows\AutoRun.exe
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\...\MountPoints2: {d44e0212-7db5-11de-986b-00238baf39b6} - G:\LaunchU3.exe -a
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
Startup: C:\Users\valerio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2012-02-22]
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{73BD08A4-F64E-4447-A7F9-9C984A524B77}: [DhcpNameServer] 213.230.130.222 217.200.200.42
Tcpip\..\Interfaces\{F584C654-1003-4F54-A407-23DD85610F5E}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://it.yahoo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-179202480-3822300748-1852279558-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=it_it&c=91&bd=Presario&pf=cnnb
SearchScopes: HKLM -> DefaultScope {31090377-0740-419E-BEFC-A56E50500D5B} URL =
SearchScopes: HKLM -> {A94E67AD-62EF-4DFD-9E6D-995DE7CE28C8} URL = hxxp://it.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM -> {FE47ECF1-511F-4B7F-90F1-F7D5DBC1841A} URL = hxxp://it.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913930
SearchScopes: HKU\S-1-5-21-179202480-3822300748-1852279558-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-179202480-3822300748-1852279558-1000 -> {A94E67AD-62EF-4DFD-9E6D-995DE7CE28C8} URL = hxxp://it.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKU\S-1-5-21-179202480-3822300748-1852279558-1000 -> {FE47ECF1-511F-4B7F-90F1-F7D5DBC1841A} URL = hxxp://it.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913930
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-03-30] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-03-30] (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKU\S-1-5-21-179202480-3822300748-1852279558-1000 -> No Name - {5FDC8508-0DC6-4CE5-B4EF-5825FFD68981} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\valerio\AppData\Roaming\Mozilla\Firefox\Profiles\x745qhbb.default
FF Homepage: hxxps://www.google.it/
FF NetworkProxy: "no_proxies_on", "local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-09] ()
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll [No File]
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\valerio\AppData\Roaming\Mozilla\Firefox\Profiles\x745qhbb.default\Extensions\[email protected] [2015-12-15] [not signed]
FF Extension: No Name - C:\Users\valerio\AppData\Roaming\Mozilla\Firefox\Profiles\x745qhbb.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}-trash [2011-06-01] [not signed]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-11-09] [not signed]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-11-09] [not signed]
Chrome:
=======
CHR Profile: C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avira Toolbar) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangmfdabjilefmognkgcebjgcojek [2015-12-10]
CHR Extension: (Presentazioni Google) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-11]
CHR Extension: (Documenti Google) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-11]
CHR Extension: (Google Drive) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-11]
CHR Extension: (YouTube) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-11]
CHR Extension: (Google Cast) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-01-11]
CHR Extension: (Ricerca Google) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-11]
CHR Extension: (Fogli Google) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-11]
CHR Extension: (Sicurezza browser Avira) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-01-11]
CHR Extension: (Google Wallet) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-11]
CHR Extension: (Gmail) - C:\Users\valerio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-11]
CHR HKLM\...\Chrome\Extension: [aaaangmfdabjilefmognkgcebjgcojek] - C:\Users\valerio\AppData\Local\APN\GoogleCRXs\aaaangmfdabjilefmognkgcebjgcojek_7.14.1.0.crx <not found>
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [icmlaeflemplmjndnaapfdbbnpncnbda] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [916968 2015-10-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [461672 2015-10-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [461672 2015-10-27] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1210512 2015-10-27] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [249624 2015-11-23] (Avira Operations GmbH & Co. KG)
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) [File not signed]
R3 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [223232 2008-10-23] (Hewlett-Packard Development Company, L.P.) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [303104 2008-02-01] (Motive Communications, Inc.) [File not signed]
R2 ONDA Autorun CDROM Monitor; C:\Windows\system32\SupportAppXL\onda_mon.exe [86016 2008-09-16] () [File not signed]
R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-12-23] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2008-11-26] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe [217170 2009-06-03] (IDT, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswFsBlk; C:\Windows\system32\Drivers\aswFsBlk.sys [20696 2012-03-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [57688 2012-03-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\Drivers\aswRdr.sys [35672 2012-03-07] (AVAST Software)
S1 aswSnx; C:\Windows\system32\Drivers\aswSnx.sys [612184 2012-03-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\Drivers\aswSP.sys [337880 2012-03-07] (AVAST Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [53848 2012-03-07] (AVAST Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-10-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-09-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-19] (Avira Operations GmbH & Co. KG)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-12-10] ()
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-28] (Initio Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2008-03-09] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2008-03-09] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 ONDAusbmdm6k; C:\Windows\System32\DRIVERS\ONDAusbmdm6k.sys [104960 2008-09-16] (ONDA Incorporated)
S3 ONDAusbnet; C:\Windows\System32\DRIVERS\ONDAusbnet.sys [110080 2008-09-16] (ONDA Corporation)
S3 ONDAusbnmea; C:\Windows\System32\DRIVERS\ONDAusbnmea.sys [104960 2008-09-16] (ONDA Incorporated)
S3 ONDAusbser6k; C:\Windows\System32\DRIVERS\ONDAusbser6k.sys [104960 2008-09-16] (ONDA Incorporated)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-18] (Avira Operations GmbH & Co. KG)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-12-15 01:30 - 2015-12-15 01:31 - 00021152 _____ C:\Users\valerio\Desktop\FRST.txt
2015-12-15 01:30 - 2015-12-15 01:30 - 00000000 ____D C:\FRST
2015-12-15 01:25 - 2015-12-15 01:25 - 01720832 _____ (Farbar) C:\Users\valerio\Desktop\FRST.exe
2015-12-14 02:20 - 2015-12-15 01:11 - 00000000 ____D C:\AdwCleaner
2015-12-10 23:27 - 2015-12-10 23:27 - 00000799 _____ C:\Users\valerio\Desktop\µTorrent.lnk
2015-12-10 23:26 - 2015-12-14 14:01 - 00000000 ____D C:\Users\valerio\AppData\Roaming\uTorrent
2015-12-10 17:32 - 2015-12-13 20:58 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-10 17:31 - 2015-12-10 17:31 - 00000899 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-12-10 17:31 - 2015-12-10 17:31 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-12-10 17:31 - 2015-10-05 09:50 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-12-10 17:31 - 2015-10-05 09:50 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-12-10 17:31 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-12-10 15:11 - 2015-12-10 15:12 - 00000000 ____D C:\sh4ldr
2015-12-10 15:09 - 2015-12-10 15:09 - 00019984 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2015-12-10 15:09 - 2015-12-10 15:09 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-12-09 17:16 - 2015-11-06 18:05 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2015-12-09 17:16 - 2015-11-06 17:32 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-12-09 17:16 - 2015-11-06 17:32 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-12-09 17:16 - 2015-11-06 17:32 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-12-09 17:16 - 2015-11-06 17:32 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-12-09 17:16 - 2015-11-06 16:27 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-12-09 17:16 - 2015-11-06 16:26 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-12-09 17:16 - 2015-11-06 16:24 - 02068480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-12-09 17:16 - 2015-11-06 16:20 - 01073152 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-12-09 17:16 - 2015-11-06 16:20 - 00682496 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-12-09 17:16 - 2015-11-06 16:19 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-12-09 17:14 - 2015-11-02 18:04 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2015-12-09 17:13 - 2015-11-05 08:26 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-12-09 17:12 - 2015-11-10 18:03 - 01208832 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2015-12-09 17:12 - 2015-11-10 18:03 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2015-12-09 17:12 - 2015-11-05 08:34 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2015-12-09 16:56 - 2015-11-12 21:39 - 01814528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-12-09 16:56 - 2015-11-12 21:37 - 12389376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-12-09 16:56 - 2015-11-12 21:36 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-12-09 16:56 - 2015-11-12 21:34 - 09753088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-12-09 16:56 - 2015-11-12 21:34 - 01140224 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-12-09 16:56 - 2015-11-12 21:33 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-12-09 16:56 - 2015-11-12 21:32 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-12-09 16:56 - 2015-11-12 21:32 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-12-09 16:56 - 2015-11-12 21:32 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-12-09 16:56 - 2015-11-12 21:31 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-12-09 16:56 - 2015-11-12 21:31 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-12-09 16:56 - 2015-11-12 21:31 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-12-09 16:56 - 2015-11-12 21:31 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-12-09 16:56 - 2015-11-12 21:31 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-12-09 16:56 - 2015-11-12 21:31 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-12-15 01:30 - 2006-11-02 12:18 - 00000000 ____D C:\Windows
2015-12-15 01:16 - 2012-03-11 14:28 - 00011638 _____ C:\ProgramData\HPWALog.txt
2015-12-15 01:14 - 2009-04-14 03:16 - 00000286 _____ C:\ProgramData\hpqp.ini
2015-12-15 01:13 - 2006-11-02 13:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-15 01:13 - 2006-11-02 13:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-15 01:13 - 2006-11-02 13:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-15 01:12 - 2006-11-02 13:58 - 00032616 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-12-15 01:08 - 2012-04-01 12:46 - 00000978 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-14 12:16 - 2014-07-24 13:35 - 00000000 ____D C:\Users\valerio\AppData\Roaming\vlc
2015-12-14 02:25 - 2011-02-14 22:39 - 00000000 ____D C:\Users\valerio\AppData\LocalLow\Yahoo!
2015-12-10 18:16 - 2009-07-27 10:48 - 00037376 _____ C:\Users\valerio\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-12-10 17:37 - 2009-07-25 12:17 - 00000000 ____D C:\Users\valerio
2015-12-10 17:05 - 2014-08-20 12:49 - 00000000 ____D C:\ProgramData\Package Cache
2015-12-10 17:00 - 2013-02-27 14:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-12-09 19:05 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2015-12-09 18:44 - 2014-12-09 00:42 - 00334320 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-09 18:40 - 2006-11-02 13:35 - 00000000 ____D C:\Windows\system32\XPSViewer
2015-12-09 18:40 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\inf
2015-12-09 17:17 - 2010-06-05 11:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-09 17:17 - 2009-07-27 11:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-09 17:12 - 2013-08-02 02:26 - 00000000 ____D C:\Windows\system32\MRT
2015-12-09 17:04 - 2006-11-02 11:24 - 137798368 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-12-09 03:08 - 2012-04-01 12:46 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-12-09 03:08 - 2011-05-14 13:05 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-12-02 13:25 - 2009-10-08 20:56 - 00247976 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2009-07-25 12:32 - 2009-07-25 12:32 - 0000000 _____ () C:\Users\valerio\AppData\Local\AtStart.txt
2010-05-22 14:40 - 2014-08-21 13:21 - 0006080 _____ () C:\Users\valerio\AppData\Local\d3d9caps.dat
2009-07-27 10:48 - 2015-12-10 18:16 - 0037376 _____ () C:\Users\valerio\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-07-25 12:32 - 2009-07-25 12:32 - 0000000 _____ () C:\Users\valerio\AppData\Local\DSwitch.txt
2009-07-25 12:32 - 2009-07-25 12:32 - 0000000 _____ () C:\Users\valerio\AppData\Local\QSwitch.txt
2009-04-14 03:16 - 2015-12-15 01:14 - 0000286 _____ () C:\ProgramData\hpqp.ini
2010-04-11 04:59 - 2014-09-28 02:31 - 0000021 _____ () C:\ProgramData\hpqp.txt
2012-03-11 14:28 - 2015-12-15 01:16 - 0011638 _____ () C:\ProgramData\HPWALog.txt
2009-04-14 03:19 - 2009-04-14 03:19 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2009-02-26 01:13 - 2009-02-26 01:14 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2009-04-14 03:18 - 2009-04-14 03:18 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2009-02-26 01:07 - 2009-02-26 01:08 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2009-04-14 03:17 - 2009-04-14 03:17 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2009-04-14 03:19 - 2009-04-14 03:19 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2009-02-26 01:06 - 2009-02-26 01:07 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2009-02-26 01:08 - 2009-02-26 01:13 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2009-04-14 03:19 - 2009-04-14 03:19 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
Some files in TEMP:
====================
C:\Users\valerio\AppData\Local\Temp\avgnt.exe
C:\Users\valerio\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-12-15 01:20
==================== End of FRST.txt ============================
|
|
|
|
|
15-12-2015, 08:36
|
#5 |
|
Member
Iscritto dal: Dec 2015
Messaggi: 54
|
non ho trovato infezioni nei log ma dovresti rimuovere spyhunter, a volte crea solo solo problemi
quei dns li hai impostati tu? ora fai una scansione con malwarebytes, aggiorna le firme a fai una scansione completa del sistema allega il log nella tua risposta, non copiarlo ma usa la funzione gestione allegati in fondo alla pagina |
|
|
|
|
15-12-2015, 18:31
|
#6 |
|
Junior Member
Iscritto dal: Dec 2015
Messaggi: 6
|
I dns non li ho toccati,c'è qualcosa di strano?
Come detto nella risposta precedente ho qualche problema con i siti per postare il log...li posto con wikisend può andare? http://wikisend.com/download/371482/mab 151215.txt mab 151215.txt |
|
|
|
|
15-12-2015, 19:53
|
#7 |
|
Member
Iscritto dal: Dec 2015
Messaggi: 54
|
per i dns ti sapro' dire con piu' precisione dopo che avrai fatto questa scansione di controllo, e' di sola lettura non rimuove niente (come la precedente)
Scarica OTL e salvalo sul desktop Metti la spunta su SCAN ALL USERS. Sotto output, metti la spunta su minimal output Clicca sulla freccettina di File Age e seleziona 60 Days Metti la spunta a LOP Check e Purity Check. Clicca su RUN SCAN Lascia fare la scansione senza interferire. Al termine della scansione trovi due log sul desktop. OTL.txt ed Extras.txt, salvali e caricali su Wikisend oppure vai nella gestione allegati in fondo alla pagina |
|
|
|
|
15-12-2015, 21:25
|
#8 |
|
Junior Member
Iscritto dal: Dec 2015
Messaggi: 6
|
Ok ecco i log di OTL.
http://wikisend.com/download/473538/OTL.Txt OTL.Txt http://wikisend.com/download/661092/Extras.Txt Extras.Txt Grazie x ora. |
|
|
|
|
15-12-2015, 21:57
|
#9 |
|
Member
Iscritto dal: Dec 2015
Messaggi: 54
|
edit
Ultima modifica di menatwork : 15-12-2015 alle 22:28. |
|
|
|
|
15-12-2015, 22:02
|
#10 | |
|
Member
Iscritto dal: Dec 2015
Messaggi: 54
|
se non vuoi bloccare il sistema e prenderti qualche bella infezione devi rimuovere due dei tre antivirus (consiglio rimozione avg) installare piu' di un antivirus hai solamente conflitti non ti proteggi come dovresti
avg avast avira ora apri otl e copia questo codice nel box bianco del programma poi premi RUN FIX Nella cartella C:\_OTL\MovedFiles\ verrà creato un log tipo ggMMaaaa_hhmmss.log che dovrai allegare Quote:
|
|
|
|
|
|
15-12-2015, 22:34
|
#11 |
|
Junior Member
Iscritto dal: Dec 2015
Messaggi: 6
|
Io pensavo di avere solo Avira ed è l'unico che si apre..
Ecco il log richiesto. http://wikisend.com/download/433186/12152015_232319.log 12152015_232319.log |
|
|
|
|
15-12-2015, 22:43
|
#12 |
|
Member
Iscritto dal: Dec 2015
Messaggi: 54
|
lascia avast o avira, gli altri due rimuovili
hai ancora problemi? |
|
|
|
|
|
| Strumenti | |
|
|
Tutti gli orari sono GMT +1. Ora sono le: 17:15.
