| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win7: Chrome Browser nach Malware Attacke sehr langsam.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.06.2015, 14:31
| #1 |
| |  Win7: Chrome Browser nach Malware Attacke sehr langsam. Hallo, meine Mitbewohnerin hat sich vor ein paar Tagen vermutlich Malware aus dem I-net gezogen mit folgenden Auswirkungen: - Werbe Pop Ups/Tabs auf verschiedensten Seiten oeffneten sich. - Browser arbeitete extrem langsam. - extreme CPU Auslastung schwankend von 10-100% selbst wenn keine Programme geoeffnet waren. Das fing vor 3-4 Tagen an. Gestern habe ich nachdem AntivirusPro Scan nichts gebracht hat den Anti Maleware Scanner von Malewarebytes drueber laufen lassen(logs dazu unten), Chrome deinstalliert und "istartsurf" deinstalliert sowie manuell aus Chrome entfernt + Adblock Plus installiert mit folgenden Auswirkungen: - Werbe Pop Ups/Tabs tauchen nicht mehr auf. - Browser arbeitet etwas schneller. - CPU Auslastung im Ruhezustand unter 10% bei geoeffneten Browser immer nahe 100% Meine Mitbewohnerin hat bis heute eine kostenpflichtige Version von Antivirus laufen die aber nichts gefunden oder verhindert hat... Hoffe ich habe euch nicht so voll gelabert und poste jetzt noch die logs in chronologisch richtiger Reihenfolge: malware scan 1 Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 25/06/2015 Scan Time: 23:40:50 Logfile: malware scan 2.txt Administrator: Yes Version: 2.01.6.1022 Malware Database: v2015.06.25.06 Rootkit Database: v2015.06.22.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Antonello Scan Type: Threat Scan Result: Completed Objects Scanned: 365804 Time Elapsed: 46 min, 16 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 6 PUP.Optional.WProtectManager.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1516, Delete-on-Reboot, [3baf03bb5337b28495b52e590afcc53b] PUP.Optional.XTab.A, C:\Program Files (x86)\MiuiTab\ProtectService.exe, 136, Delete-on-Reboot, [1fcb7a44c7c360d6eeb80e0a34ce9769] PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\InternetEnhancer.exe, 2984, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55] PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\InternetEnhancerService.exe, 2428, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55] PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\CmdShell.exe, 3376, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f] PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\HPNotify.exe, 5744, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f] Modules: 12 PUP.Optional.SearchProtect, C:\Program Files (x86)\MiuiTab\BrowserAction.dll, Delete-on-Reboot, [d911922ca8e289ad2872291f59a9f40c], PUP.Optional.Browserwatch, C:\Program Files (x86)\MiuiTab\BrowerWatchCH.dll, Delete-on-Reboot, [b238b7078802bc7a3b310e288f779f61], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\ApiHandlr.dll, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\FiddlerCore.dll, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\Newtonsoft.Json.dll, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\IeWatchDog.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcp110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcp110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcp110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcr110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcr110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcr110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], Registry Keys: 46 PUP.Optional.WProtectManager.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, Quarantined, [3baf03bb5337b28495b52e590afcc53b], PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, Quarantined, [1fcb7a44c7c360d6eeb80e0a34ce9769], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.LuckyTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.Wajam.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WInterEnhancer Service, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [39b12d91305abe78cbd6cdba000527d9], PUP.Optional.APNToolBar.Gen, HKLM\SOFTWARE\WOW6432NODE\AskPartnerNetwork, Quarantined, [e00ae0de99f170c6a974d224f80b728e], PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, Quarantined, [9159aa146a20af87d7f320e78c78bc44], PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, Quarantined, [03e7edd1bad03afc44dd3f07d62e14ec], PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\istartsurfSoftware, Quarantined, [c624348aed9d1620f625cc519470ac54], PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, Quarantined, [5595efcf6525f343c5d877025baaf40c], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\WInterEnhancer, Quarantined, [35b5d0ee5634ce6849710d867194e61a], PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [5b8fd5e9bcceca6c7130b9ce1ee749b7], PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, Quarantined, [68827d41860449ed4567926f9470ad53], PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, Quarantined, [925856687416a98dbdee4eb38381867a], PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, Quarantined, [a04a10ae2f5b55e1e9648986b84cb34d], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, Quarantined, [608aecd24e3c6dc93377bb462fd5f010], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, Quarantined, [c822c5f90b7f69cdd8b94ccf699b43bd], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [3bafe6d8c9c14ee8b8f3c74a897b41bf], PUP.Optional.1ClickDownload.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\1ClickDownload, Quarantined, [5595209e8505e650d7434814c0450df3], PUP.Optional.APNToolBar.Gen, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\AskPartnerNetwork, Quarantined, [c3278a34a8e2e452b8646a8c22e1fc04], PUP.Optional.HomeTab.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\HomeTab, Quarantined, [6387cbf32d5d0f27e295a389ff05a35d], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\SearchProtectWS, Quarantined, [b1399826048637ff88268a77ee168c74], PUP.Optional.TNT.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\TNT2, Quarantined, [9357efcfdcae53e31a3ea16230d451af], PUP.Optional.Wajam.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\WajIEnhance, Quarantined, [0ddd8737424896a0b9a69c6d3dc7d52b], PUP.Optional.Wajam.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\WInterEnhancer, Quarantined, [1ecc9f1fb4d695a1a0191d76aa5bbc44], PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Quarantined, [effbb20c1d6d4ceabce4f394887d12ee], PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}, Quarantined, [a2484a74791176c0069a493e1fe6f808], PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [1ad02e90a0ea0d29316f681fd13402fe], PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}, Quarantined, [e802b40a87032610920ea1e6986de41c], PUP.Optional.Iminent.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, Quarantined, [0fdba41af793092d2130bb43bf4450b0], PUP.Optional.Iminent.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, Quarantined, [9a50bc021377a591c88a01fdb35041bf], PUP.Optional.Linkey.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Linkey, Quarantined, [7b6fd5e9018955e169ea3ec01ae9ba46], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, Quarantined, [a842992591f9df57885dbccfa75e22de], PUP.Optional.Vosteran.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, Quarantined, [27c3c4fae8a2b58104501ce2aa597987], PUP.Optional.Wajam.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, Quarantined, [20ca427cabdf3df958fd08f614efde22], PUP.Optional.HomeTab.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\SIMPLYTECH\HomeTab, Quarantined, [f5f51f9f74161422f87e53ee7a8a9a66], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WInterEnhancer, Quarantined, [6486a31b3d4dd264ffc3645dd62d46ba], PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\istartsurf uninstall, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], Registry Values: 12 PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, istartsurf, Quarantined, [39b12d91305abe78cbd6cdba000527d9] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Quarantined, [0fdbccf20387d2641a87800742c3867a] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, istartsurf, Quarantined, [5b8fd5e9bcceca6c7130b9ce1ee749b7] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Quarantined, [36b4ccf22d5d42f4eeb3a7e01bea36ca] PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, pcs, Quarantined, [c822c5f90b7f69cdd8b94ccf699b43bd] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&ts=1435267682&type=default&q={searchTerms}, Quarantined, [effbb20c1d6d4ceabce4f394887d12ee] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|URL, hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&ts=1435267682&type=default&q={searchTerms}, Quarantined, [a2484a74791176c0069a493e1fe6f808] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|FaviconURL, hxxp://www.istartsurf.com//favicon.ico, Quarantined, [49a1edd11179dd59920e5334ec1907f9] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|DisplayName, istartsurf, Quarantined, [1ad02e90a0ea0d29316f681fd13402fe] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&ts=1435267682&type=default&q={searchTerms}, Quarantined, [38b21f9fa4e62016bde3ddaaa4619e62] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|TopResultURL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Quarantined, [73775a642466f44277293e49ad5849b7] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}|URL, hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&ts=1435267682&type=default&q={searchTerms}, Quarantined, [e802b40a87032610920ea1e6986de41c] Registry Data: 16 PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (Chrome.exe), Bad: ("C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[bc2ed0ee96f468ce4867310efa0c3ec2] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[fcee8a34b0da9d99f8b5b18e84824fb1] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}),Replaced,[10da4678deacf64097a28bb343c3bb45] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[c327447a7a10132345f49da19f679868] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[816908b6c7c323130f2a6ed0986e3ec2] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}),Replaced,[de0cf3cbef9b1e18a891350961a526da] PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[7278dfdfc6c434020d0fb793df27a65a] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (Chrome.exe), Bad: ("C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[21c975496e1c102609a691aecb3b11ef] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[6585d2ecf7930f27a607d768b254e21e] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}),Replaced,[48a203bbbad0d36383b699a5d333c838] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[f5f566589af04ceabe7b95a99a6c36ca] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[5c8e942a9ceefc3aa396a7973dc912ee] PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75&q={searchTerms}),Replaced,[5f8beed0860468cee554bb8348be2cd4] PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[6585fbc30585e84e34e8f4566a9c52ae] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[45a5a11d2664979f7dba073756b0966a] PUP.Optional.IStartSurf.A, HKU\S-1-5-21-641276624-2576159587-653334445-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75),Replaced,[8862e1dd2e5c270fad8af8460afc8080] Folders: 41 PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Uninstall Wajam, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam, Quarantined, [6486a31b3d4dd264ffc3645dd62d46ba], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, Delete-on-Reboot, [d21804bad6b4c17535cab0244ab95ba5], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, Quarantined, [d21804bad6b4c17535cab0244ab95ba5], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, Quarantined, [38b2efcf0d7df14591c828c28182d52b], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, Quarantined, [38b2efcf0d7df14591c828c28182d52b], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\image, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\en-US, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-419, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-ES, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-BE, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CA, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CH, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-FR, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-LU, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-CH, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-IT, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pl, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt-BR, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru-MO, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\tr-TR, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\vi-VI, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-CN, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-TW, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], Files: 172 PUP.Optional.WProtectManager.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, Delete-on-Reboot, [3baf03bb5337b28495b52e590afcc53b], PUP.Optional.XTab.A, C:\Program Files (x86)\MiuiTab\ProtectService.exe, Delete-on-Reboot, [1fcb7a44c7c360d6eeb80e0a34ce9769], PUP.Optional.SearchProtect, C:\Program Files (x86)\MiuiTab\BrowserAction.dll, Delete-on-Reboot, [d911922ca8e289ad2872291f59a9f40c], PUP.Optional.Browserwatch, C:\Program Files (x86)\MiuiTab\BrowerWatchCH.dll, Delete-on-Reboot, [b238b7078802bc7a3b310e288f779f61], PUP.Optional.LuckyTab.A, C:\Program Files (x86)\MiuiTab\SupTab.dll, Quarantined, [34b6b90599f1fb3b1ce7f875bb48b848], PUP.Optional.Browserwatch, C:\Program Files (x86)\MiuiTab\BrowerWatchFF.dll, Quarantined, [4e9cb90529613ef891dbdf57679f7987], PUP.Optional.HTTOGROUP.A, C:\Users\Antonello\AppData\Local\Temp\PICCSFIT304B.exe, Quarantined, [83670ab47119c1757a2ccdb90df922de], PUP.Optional.APNToolBar.A, C:\Users\Antonello\AppData\Local\Temp\nso25BA.tmp-2\APN_ATU3_.exe, Quarantined, [7377526c4842221475e6baaab84a28d8], PUP.Optional.PCSpeedUp.A, C:\Windows\Temp\scs_setup_1.0.16.0.exe, Quarantined, [17d3c9f57218df57f38b145525dd17e9], PUP.Optional.PCSpeedUp.A, C:\Users\Antonello\Documents\PCSpeedUp-Silent-Update.exe, Quarantined, [d51538866624bf778cf281e8c93955ab], PUP.Optional.PCSpeedUp.A, C:\Users\Antonello\Documents\PCSUUpdate.exe, Quarantined, [dc0e00be92f8979f2d51c4a58c765ba5], PUP.Optional.Softonic, C:\Users\Antonello\Downloads\SoftonicDownloader_per_atube-catcher.exe, Quarantined, [12d8dfdf7614b6806cd9241926dbf60a], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Wajam Website.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Settings.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\SignIn with Facebook.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\SignIn with Twitter.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\Ask.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\Google.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\IMDb.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\Shopping.com.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\TripAdvisor.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\Wikipedia.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Search\Yahoo!.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Amazon.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Argos.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Ebay.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Etsy.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\HomeDepot.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Ikea.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Lowe's.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Mercadolivre.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\MyShopping.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Sears.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Target.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Tesco.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Walmart.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Explore Social Shopping\Zalando.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WInterEnhancer\Uninstall Wajam\uninstall.lnk, Quarantined, [4e9ca11d385253e30ed717dffe05758b], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\wajam.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\amazon.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\argos.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\ask.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\bestbuy.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\ebay.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\etsy.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\facebook.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\favicon.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\google.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\homedepot.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\ikea.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\imdb.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\lowes.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\mercado.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\mysearchweb.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\myshopping.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\searchresult.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\sears.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\setting.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\settings.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\shopping.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\target.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\tesco.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\tripadvisor.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\twitter.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\walmart.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\wiki.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\yahoo.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\Logos\zalando.ico, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\uninstall.exe, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\ApiHandlr.dll, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\FiddlerCore.dll, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\HtmlAgilityPack.dll, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\InternetEnhancer.exe, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\InternetEnhancerService.exe, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\lan-proxy-settings.dat, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\makecert.exe, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\Newtonsoft.Json.dll, Delete-on-Reboot, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\wie, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\WInterEnhancer\WInterEnhancer Internet Enhancer\WJManifest, Quarantined, [9555695596f4a78f72458112bb4aab55], PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam\uninstall.exe, Quarantined, [6486a31b3d4dd264ffc3645dd62d46ba], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, Quarantined, [d21804bad6b4c17535cab0244ab95ba5], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\527.json, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\MessageBox.xml, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\uninstallDlg2.xml, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\UninstallManager.exe, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\bg.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\bg1.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\bk_shadow.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\button.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\button1.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\checkbox.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\checkbox_select.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\checked.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\close.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\loading_bg.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\loading_light.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\min.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\scrollbar.bmp, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\Thumbs.db, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\unchecked.png, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\code1.jpg, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\code2.jpg, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\code3.jpg, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\code4.jpg, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\code5.jpg, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\code6.jpg, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.IStartSurf.A, C:\Users\Antonello\AppData\Roaming\istartsurf\images\code\Thumbs.db, Quarantined, [6f7b7c424e3ce55194ec1bbef70c19e7], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\CmdShell.exe, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\conf, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\ffsearch_toolbar!1.0.0.1031.xpi, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\HPNotify.exe, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\IeWatchDog.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\install.data, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcp110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcr110.dll, Delete-on-Reboot, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\searchProvider.xml, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\uninstall.exe, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\about.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\about_bk.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\btn.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\btn_apply.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\close.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\conf.xml, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\conf_back.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\input_bk.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\logo.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\main.xml, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\radio_1.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\radio_2.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\rigth_arrow.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\settings.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\data.html, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\indexIE.html, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\indexIE8.html, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\main.css, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\ver.txt, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\google_trends.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon128.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon16.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon48.png, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\loading.gif, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\logo32.ico, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\common.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\ga.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery-1.11.0.min.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery.autocomplete.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery.xdomainrequest.min.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\js.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\library.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xagainit-ie8.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xagainit2.0.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xdomain.min.js, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\en-US\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-419\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-ES\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-BE\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CA\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CH\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-FR\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-LU\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-CH\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-IT\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pl\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt-BR\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru-MO\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\tr-TR\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\vi-VI\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-CN\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-TW\messages.json, Quarantined, [2bbfeed0ee9c8bab92d0b440fa09e11f], PUP.Optional.IStartSurf, C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences, Good: ("session":{"restore_on_startup":4,"startup_urls":["https://www.malwarebytes.org/restorebrowser/"]}}), Bad: ("session":{"restore_on_startup":4,"startup_urls":["hxxp://www.istartsurf.com/?type=hp&ts=1435267618&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcs&uid=ST9500325AS_S2WKHA75XXXXS2WKHA75"]}}), Replaced,[b9312d91f595b482b395f5981aec8a76] Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Update, 25/06/2015 22:38:08, SYSTEM, ANTONELLO-PC, Manual, Remediation Database, 2015.3.9.1, 2015.6.15.1, Update, 25/06/2015 22:38:08, SYSTEM, ANTONELLO-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1, Update, 25/06/2015 22:38:09, SYSTEM, ANTONELLO-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.6.22.1, Update, 25/06/2015 22:38:09, SYSTEM, ANTONELLO-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1, Update, 25/06/2015 22:38:16, SYSTEM, ANTONELLO-PC, Manual, Malware Database, 2015.3.9.5, 2015.6.25.5, Error, 25/06/2015 23:31:20, SYSTEM, ANTONELLO-PC, Protection, IsLicensed, 13, Protection, 25/06/2015 23:31:20, SYSTEM, ANTONELLO-PC, Protection, Malware Protection, Stopping, Protection, 25/06/2015 23:31:20, SYSTEM, ANTONELLO-PC, Protection, Malware Protection, Stopped, Update, 25/06/2015 23:40:48, SYSTEM, ANTONELLO-PC, Manual, Malware Database, 2015.6.25.5, 2015.6.25.6, (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 26/06/2015 Scan Time: 01:59:00 Logfile: malware scan 1.txt Administrator: Yes Version: 2.01.6.1022 Malware Database: v2015.06.25.06 Rootkit Database: v2015.06.22.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Antonello Scan Type: Threat Scan Result: Completed Objects Scanned: 365738 Time Elapsed: 38 min, 52 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan, 26/06/2015 00:28:57, SYSTEM, ANTONELLO-PC, Manual, Start:25/06/2015 23:40:50, Duration:46 min 16 sec, Threat Scan, Completed, 0 Malware Detections, 305 Non-Malware Detections, Error, 26/06/2015 00:30:43, SYSTEM, ANTONELLO-PC, Protection, IsLicensed, 13, Protection, 26/06/2015 00:30:43, SYSTEM, ANTONELLO-PC, Protection, Malware Protection, Stopping, Protection, 26/06/2015 00:30:43, SYSTEM, ANTONELLO-PC, Protection, Malware Protection, Stopped, Error, 26/06/2015 01:45:22, SYSTEM, ANTONELLO-PC, Protection, IsLicensed, 13, Protection, 26/06/2015 01:45:22, SYSTEM, ANTONELLO-PC, Protection, Malware Protection, Stopping, Protection, 26/06/2015 01:45:22, SYSTEM, ANTONELLO-PC, Protection, Malware Protection, Stopped, Scan, 26/06/2015 02:37:53, SYSTEM, ANTONELLO-PC, Manual, Start:26/06/2015 01:59:00, Duration:38 min 52 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections, (end) Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-26 14:16:59
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000067 ST950032 rev.0001 465.76GB
Running: Gmer-19357.exe; Driver: C:\Users\ANTONE~1\AppData\Local\Temp\pxliyuog.sys
---- Threads - GMER 2.1 ----
Thread C:\Windows\SysWOW64\ntdll.dll [1776:1780] 0000000000dfe7ff
Thread C:\Windows\SysWOW64\ntdll.dll [1776:1892] 00000000725d8f48
Thread C:\Windows\SysWOW64\ntdll.dll [1776:2032] 00000000725d8f48
Thread C:\Windows\SysWOW64\ntdll.dll [1776:2040] 0000000072761f70
Thread C:\Windows\SysWOW64\ntdll.dll [1776:3704] 00000000721a43d0
Thread C:\Windows\SysWOW64\ntdll.dll [1776:3956] 000000006fd05810
Thread C:\Windows\SysWOW64\ntdll.dll [1776:3968] 000000006fd034b0
Thread C:\Windows\SysWOW64\ntdll.dll [1776:2828] 000000006fd05810
Thread C:\Windows\SysWOW64\ntdll.dll [1776:3836] 000000006fd05810
Thread C:\Windows\SysWOW64\ntdll.dll [1776:4804] 000000006fd05810
Thread C:\Windows\SysWOW64\ntdll.dll [1776:4564] 0000000072cf046f
Thread C:\Windows\SysWOW64\ntdll.dll [3028:2996] 0000000000201877
Thread C:\Windows\SysWOW64\ntdll.dll [3028:3292] 0000000073bbf8b0
Thread C:\Windows\SysWOW64\ntdll.dll [3028:3296] 0000000073bbe8a0
Thread C:\Windows\SysWOW64\ntdll.dll [3028:3300] 0000000073bbf2e0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\08edb9f56294
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\08edb9f56294 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by Antonello (administrator) on ANTONELLO-PC on 26-06-2015 13:44:48
Running from C:\Users\Antonello\Downloads
Loaded Profiles: Antonello & (Available Profiles: Antonello)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Italiano (Italia)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
() C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-21] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2816336 2012-03-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [368728 2011-12-09] (Alcor Micro Corp.)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CancelAutoPlay_Server] => C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe [426752 2013-08-02] ()
HKLM-x32\...\Run: [H3G_Starter] => C:\Program Files (x86)\Chiavetta Internet 21.6\H3G_Starter.exe [107776 2013-08-02] ()
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [417792 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [141608 2010-02-15] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_222_ActiveX.exe -update activex
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {01dad64b-1baa-11e3-91c2-806e6f6e6963} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {01dad6c0-1baa-11e3-91c2-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {0960a82a-2363-11e2-81f9-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {0960a847-2363-11e2-81f9-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {0bb8b101-2684-11e2-9cf7-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {18401160-be02-11e2-85eb-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {18cf9f07-1b7a-11e2-8188-08edb9f56293} - D:\setup.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {207205b2-d5d2-11e2-a007-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {34030eba-1ae4-11e3-98dc-047d7bcba56a} - D:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {34030fad-1ae4-11e3-98dc-047d7bcba56a} - D:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {38c95f11-bee5-11e3-a168-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {57abdc6c-d5c3-11e2-89ba-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {734dc1c0-5108-11e2-9e09-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {7e50ff71-2e8d-11e2-b0a0-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {7e50ff7b-2e8d-11e2-b0a0-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {a4e2c4e9-33cd-11e3-94dd-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {aeef190f-2518-11e2-b025-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {bf7deaf1-6e79-11e4-a190-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {db7fbdb8-6d19-11e2-a75b-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\Acer.scr [450048 2011-09-13] ()
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {01dad64b-1baa-11e3-91c2-806e6f6e6963} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {01dad6c0-1baa-11e3-91c2-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0960a82a-2363-11e2-81f9-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0960a847-2363-11e2-81f9-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {0bb8b101-2684-11e2-9cf7-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {18401160-be02-11e2-85eb-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {18cf9f07-1b7a-11e2-8188-08edb9f56293} - D:\setup.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {207205b2-d5d2-11e2-a007-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {34030eba-1ae4-11e3-98dc-047d7bcba56a} - D:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {34030fad-1ae4-11e3-98dc-047d7bcba56a} - D:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {38c95f11-bee5-11e3-a168-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {57abdc6c-d5c3-11e2-89ba-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {734dc1c0-5108-11e2-9e09-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {7e50ff71-2e8d-11e2-b0a0-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {7e50ff7b-2e8d-11e2-b0a0-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a4e2c4e9-33cd-11e3-94dd-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {aeef190f-2518-11e2-b025-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {bf7deaf1-6e79-11e4-a190-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {db7fbdb8-6d19-11e2-a75b-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\Acer.scr [450048 2011-09-13] ()
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_222_ActiveX.exe -update activex
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk [2012-05-04]
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/it-it/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120504063214.dll No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120504063215.dll No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-06-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-06-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2010-02-15] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll [2011-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-25] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-25] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll [2014-02-01] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
Chrome:
=======
CHR Profile: C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-25]
CHR Extension: (Google Docs) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-25]
CHR Extension: (Google Drive) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-25]
CHR Extension: (YouTube) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-25]
CHR Extension: (Adblock Plus) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-06-25]
CHR Extension: (Google Search) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-25]
CHR Extension: (Google Sheets) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-25]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-25]
CHR Extension: (Skype Click to Call) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-06-25]
CHR Extension: (Google Wallet) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-25]
CHR Extension: (Gmail) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-25]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
StartMenuInternet: Google Chrome - Chrome.exe
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [144672 2009-08-28] (Apple Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZDServ; C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe [425728 2013-08-02] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-11] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-11] (Avira Operations GmbH & Co. KG)
S3 massfilter; C:\Windows\System32\DRIVERS\ztembbmassfilter.sys [15360 2012-11-22] (MBB Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 pmx3gmdm; C:\Windows\System32\DRIVERS\pmx3gmdm.sys [118016 2009-03-26] (Olivetti) [File not signed]
S3 pmx3gnet; C:\Windows\System32\DRIVERS\pmx3gnet.sys [137216 2009-03-26] (Olivetti) [File not signed]
S3 vodafone_K3805-z_cdc_acm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_acm.sys [78336 2010-09-01] (Vodafone)
S3 vodafone_K3805-z_cdc_ecm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_ecm.sys [88064 2010-09-01] (Vodafone)
S3 vodafone_K3805-z_cpo; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cpo.sys [13824 2010-09-01] (Vodafone)
S3 ZTEusbmdm6k; C:\Windows\System32\DRIVERS\ztembbusbmdm.sys [123264 2012-11-22] (ZTE Incorporated)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ztembbusbnet.sys [158208 2012-11-22] (ZTE Corporation)
S3 ZTEusbnmea; C:\Windows\System32\DRIVERS\ztembbusbnmea.sys [123264 2012-11-22] (ZTE Incorporated)
S3 ZTEusbnmeaext; C:\Windows\System32\DRIVERS\ztembbusbnmeaext.sys [123264 2012-11-22] (ZTE Incorporated)
S3 ZTEusbser6K; C:\Windows\System32\DRIVERS\ztembbusbser6k.sys [123264 2012-11-22] (ZTE Incorporated)
S3 bcbtums; system32\drivers\bcbtums.sys [X]
S3 btwampfl; \??\C:\Windows\system32\drivers\btwampfl.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; system32\drivers\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-26 13:44 - 2015-06-26 13:45 - 00025780 _____ C:\Users\Antonello\Downloads\FRST.txt
2015-06-26 13:44 - 2015-06-26 13:44 - 02112512 _____ (Farbar) C:\Users\Antonello\Downloads\FRST64.exe
2015-06-26 13:44 - 2015-06-26 13:44 - 00000000 ____D C:\FRST
2015-06-26 13:33 - 2015-06-26 13:33 - 00000480 _____ C:\Users\Antonello\Downloads\defogger_disable.log
2015-06-26 13:33 - 2015-06-26 13:33 - 00000000 _____ C:\Users\Antonello\defogger_reenable
2015-06-26 13:22 - 2015-06-26 13:22 - 00050477 _____ C:\Users\Antonello\Downloads\Defogger.exe
2015-06-26 01:39 - 2015-06-26 01:44 - 00000000 ____D C:\AdwCleaner
2015-06-26 01:39 - 2015-06-26 01:39 - 02244096 _____ C:\Users\Antonello\Downloads\AdwCleaner_4.207.exe
2015-06-25 23:27 - 2015-06-25 23:27 - 00000000 _____ C:\Windows\prleth.sys
2015-06-25 23:27 - 2015-06-25 23:27 - 00000000 _____ C:\Windows\hgfs.sys
2015-06-25 22:38 - 2015-06-26 01:58 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-25 22:37 - 2015-06-25 22:37 - 00001066 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-25 22:37 - 2015-06-25 22:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-25 22:37 - 2015-06-25 22:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-25 22:37 - 2015-06-25 22:37 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-06-25 22:37 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-25 22:37 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-25 22:37 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-25 22:35 - 2015-06-25 22:35 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Antonello\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-25 19:46 - 2015-06-26 00:49 - 00002302 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-25 19:46 - 2015-06-25 19:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-25 19:45 - 2015-06-26 12:56 - 00001150 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-25 19:45 - 2015-06-26 01:45 - 00001146 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-25 19:45 - 2015-06-25 19:51 - 00004146 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-06-25 19:45 - 2015-06-25 19:51 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-06-23 11:24 - 2015-06-23 11:24 - 00188672 _____ C:\Users\Antonello\Downloads\Syllabus (1)
2015-06-23 11:21 - 2015-06-23 11:21 - 01448577 _____ C:\Users\Antonello\Downloads\Argentina_desde_un_punto_de_vista_econ_mico_y.pptx
2015-06-23 10:59 - 2015-06-23 10:59 - 03390424 _____ C:\Users\Antonello\Downloads\presentazione spagnolo.pptx
2015-06-21 11:38 - 2015-06-21 11:38 - 01313228 _____ C:\Users\Antonello\Downloads\Explicación subjuntivo
2015-06-18 19:18 - 2015-06-18 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-16 14:52 - 2015-06-16 14:52 - 01099250 _____ C:\Users\Antonello\Downloads\España desde un punto de vista económico y (3).pptx
2015-06-15 10:55 - 2015-06-15 10:55 - 00667968 _____ C:\Users\Antonello\Desktop\referat.pptx
2015-06-14 21:38 - 2015-06-14 22:13 - 00000000 ____D C:\Users\Antonello\Desktop\Nuova cartella (5)
2015-06-09 22:27 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-09 22:27 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-09 22:27 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-09 22:27 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-09 22:27 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-09 22:27 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-09 22:27 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-09 22:27 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-09 22:27 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-09 22:27 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-09 22:27 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-09 22:27 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-09 22:27 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-09 22:27 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-09 22:27 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-09 22:27 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-09 22:27 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-09 22:27 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-09 22:27 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-09 22:27 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-09 22:27 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-09 22:27 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-09 22:27 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-09 22:27 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-09 22:27 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-09 22:27 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-09 22:27 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-09 22:27 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-09 22:27 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-09 22:27 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-09 22:27 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-09 22:27 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-09 22:27 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-09 22:27 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-09 22:27 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-09 22:27 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-09 22:27 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-09 22:27 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-09 22:27 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-09 22:27 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-09 22:27 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-09 22:27 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-09 22:27 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-09 22:27 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-09 22:27 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-09 22:27 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-09 22:27 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-09 22:27 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-09 22:27 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-09 22:27 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-09 22:26 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-09 22:26 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-09 22:26 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-09 22:26 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-09 22:26 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-09 22:26 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-09 22:26 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-09 22:26 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-09 22:26 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-09 22:26 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-09 22:26 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-09 22:26 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-09 22:26 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-09 22:26 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-09 22:26 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-09 22:26 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-09 22:26 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-09 22:26 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-09 22:26 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 22:26 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-09 22:26 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-09 22:26 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-09 22:26 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-09 22:25 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-09 22:25 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-09 22:25 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-09 22:25 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-09 22:25 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-09 22:25 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-09 22:25 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-09 22:25 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-09 22:25 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-09 22:25 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-09 22:25 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-09 22:25 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-09 22:25 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-09 22:25 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-09 22:25 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-09 22:25 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-09 22:25 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-09 22:25 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-09 22:24 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-09 22:24 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-09 22:24 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-09 21:43 - 2015-06-09 21:43 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-01 21:59 - 2015-06-01 21:59 - 00000000 ____D C:\Users\Antonello\AppData\Local\GWX
2015-05-27 13:08 - 2015-05-27 13:08 - 00713610 _____ C:\Users\Antonello\Downloads\Lecture_16_6_Gut (1)
2015-05-27 13:01 - 2015-05-27 13:01 - 00713610 _____ C:\Users\Antonello\Downloads\Lecture_16_6_Gut
2015-05-27 13:01 - 2015-05-27 13:01 - 00188672 _____ C:\Users\Antonello\Downloads\Syllabus
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-26 13:33 - 2012-10-20 23:36 - 00000000 ____D C:\Users\Antonello
2015-06-26 13:20 - 2012-05-04 15:25 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-26 12:58 - 2009-07-14 06:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-26 12:58 - 2009-07-14 06:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-26 12:55 - 2012-06-19 12:09 - 01198608 _____ C:\Windows\WindowsUpdate.log
2015-06-26 01:45 - 2010-11-21 05:47 - 00516310 _____ C:\Windows\PFRO.log
2015-06-26 01:45 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-26 01:45 - 2009-07-14 06:51 - 00229123 _____ C:\Windows\setupact.log
2015-06-26 00:50 - 2012-10-20 23:40 - 00001367 _____ C:\Users\Antonello\Desktop\Internet Explorer.lnk
2015-06-25 19:55 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-25 19:46 - 2012-11-05 21:39 - 00000000 ____D C:\Users\Antonello\AppData\Local\Google
2015-06-25 19:46 - 2012-11-05 21:39 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-25 19:45 - 2012-11-05 21:35 - 00000000 ____D C:\Users\Antonello\AppData\Local\Deployment
2015-06-25 19:39 - 2015-03-29 20:47 - 00000000 __SHD C:\Users\Antonello\AppData\Local\EmieBrowserModeList
2015-06-25 19:39 - 2014-07-10 10:23 - 00000000 __SHD C:\Users\Antonello\AppData\Local\EmieUserList
2015-06-25 19:39 - 2014-07-10 10:23 - 00000000 __SHD C:\Users\Antonello\AppData\Local\EmieSiteList
2015-06-25 10:11 - 2012-10-20 23:36 - 00109296 _____ C:\Users\Antonello\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-23 23:50 - 2012-05-04 15:25 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-23 23:49 - 2012-05-04 15:25 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-23 23:49 - 2012-05-04 15:25 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-23 21:19 - 2015-04-07 17:29 - 01184768 ___SH C:\Users\Antonello\Desktop\Thumbs.db
2015-06-22 11:19 - 2014-01-22 15:08 - 00000000 ____D C:\Users\Antonello\AppData\Roaming\Skype
2015-06-19 13:24 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-18 19:18 - 2015-05-19 20:15 - 00002000 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-06-18 19:14 - 2014-01-28 19:08 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-18 19:14 - 2014-01-28 19:08 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-16 00:42 - 2015-04-28 11:20 - 00000000 ____D C:\Users\Antonello\Desktop\da stampare
2015-06-16 00:17 - 2015-05-18 16:57 - 00000000 ____D C:\Users\Antonello\Desktop\Nuova cartella (4)
2015-06-14 20:29 - 2015-05-09 12:29 - 00379904 ___SH C:\Users\Antonello\Downloads\Thumbs.db
2015-06-11 16:46 - 2012-06-19 21:57 - 00741636 _____ C:\Windows\system32\perfh010.dat
2015-06-11 16:46 - 2012-06-19 21:57 - 00147658 _____ C:\Windows\system32\perfc010.dat
2015-06-11 16:46 - 2009-07-14 07:13 - 01661180 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-10 21:50 - 2009-07-14 06:45 - 00415552 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-10 21:47 - 2014-12-15 08:47 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-10 21:47 - 2014-05-07 15:57 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-10 21:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 00:42 - 2013-08-19 13:05 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 00:24 - 2012-11-21 21:59 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-09 21:51 - 2012-05-04 15:24 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-06-09 09:49 - 2015-05-03 18:25 - 00000000 ____D C:\Users\Antonello\Desktop\Nuova cartella
2015-06-07 20:34 - 2012-05-04 14:27 - 00000000 ____D C:\ProgramData\Skype
2015-05-31 21:56 - 2015-03-06 13:44 - 00000000 ___RD C:\Program Files (x86)\Skype
Some files in TEMP:
====================
C:\Users\Antonello\AppData\Local\Temp\AskSLib.dll
C:\Users\Antonello\AppData\Local\Temp\avgnt.exe
C:\Users\Antonello\AppData\Local\Temp\Quarantine.exe
C:\Users\Antonello\AppData\Local\Temp\SetupMyPcCleaner.exe
C:\Users\Antonello\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Antonello\AppData\Local\Temp\sqlite3.dll
C:\Users\Antonello\AppData\Local\Temp\_is537C.exe
C:\Users\Antonello\AppData\Local\Temp\_isCB97.exe
C:\Users\Antonello\AppData\Local\Temp\{09149D86-3C7B-44BD-82AD-B5419D912A8A}-23.0.1271.64_22.0.1229.96_chrome_updater.exe
C:\Users\Antonello\AppData\Local\Temp\{5869FA5B-B005-46BE-A9E8-127427B5AD8A}-34.0.1847.137_34.0.1847.131_chrome_updater.exe
C:\Users\Antonello\AppData\Local\Temp\{8D40D044-C84F-4BC7-B6A0-3EF3E27F3DBC}-26.0.1410.43_25.0.1364.172_chrome_updater.exe
C:\Users\Antonello\AppData\Local\Temp\{EFD2B7CB-0CC6-4245-AFD5-161B86AB106C}-25.0.1364.172_25.0.1364.152_chrome_updater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 00:51
==================== End of log ============================
|
|
26.06.2015, 14:34
| #2 |
| | Win7: Chrome Browser nach Malware Attacke sehr langsam. Addition
__________________[CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by Antonello at 2015-06-26 13:46:38
Running from C:\Users\Antonello\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-641276624-2576159587-653334445-500 - Administrator - Disabled)
Antonello (S-1-5-21-641276624-2576159587-653334445-1000 - Administrator - Enabled) => C:\Users\Antonello
Guest (S-1-5-21-641276624-2576159587-653334445-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-641276624-2576159587-653334445-1002 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2624.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.2624.00 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3010 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3507 - Acer Incorporated)
Acer Games (HKLM-x32\...\WildTangent acer Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3506 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 20.11.1107.1418 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3501 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.190 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.190 - Adobe Systems Incorporated)
Adobe Reader X (10.1.14) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 1.5.42.69774 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.5.42.69774 - Alcor Micro Corp.) Hidden
AMD Catalyst Install Manager (HKLM\...\{029CA27F-8D5C-AC3C-319B-FA50664CE9F9}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{3FA365DF-2D68-45ED-8F83-8C8A33E65143}) (Version: 1.1.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{9EFC40E3-5F31-4F75-8445-286273F74D8E}) (Version: 2.6.0.32 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.574 - Avira Operations GmbH & Co. KG)
Bonjour (HKLM\...\{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}) (Version: 1.0.106 - Apple Inc.)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.100.82.112 - Broadcom Corporation)
Canali di giochi (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 6.2.0.5 - WildTangent, Inc.)
Chiavetta Internet 21.6 (HKLM-x32\...\{E167E098-518D-4673-8D51-C40A2EEF7A6F}) (Version: 1.0.0.1 - )
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\...\{D3E5A972-9A15-427D-AE78-8181A5FD943C}) (Version: 2.2.0409 - OEM)
ETDWare PS/2-X64 10.6.10.8_WHQL (HKLM\...\Elantech) (Version: 10.6.10.8 - ELAN Microelectronic Corp.)
Evernote v. 4.5.2 (HKLM-x32\...\{F77EF646-19EB-11E1-9A9E-984BE15F174E}) (Version: 4.5.2.5866 - Evernote Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fooz Kids (HKLM-x32\...\FoozKids) (Version: 3.1.2 - FUHU, Inc.)
Fooz Kids (x32 Version: 3.1.2 - FUHU, Inc.) Hidden
Fooz Kids Platform (HKLM-x32\...\{8D68CE08-9A14-4B7B-9857-3C646A2F34C7}) (Version: 2.1 - FUHU, Inc.)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
iTunes (HKLM\...\{84BC87D4-0480-4E10-B15D-1E7886D55180}) (Version: 9.0.3.15 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.15 - Acer Inc.)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}) (Version: 7.65.17.80 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.50.1123.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6581 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skip-Bo - Castaway Caper (x32 Version: 2.2.0.95 - WildTangent) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
Tradewinds Legends (x32 Version: 2.2.0.95 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3507 - Acer Incorporated)
WildTangent Games App (x32 Version: 4.0.11.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
ZDServer (HKLM-x32\...\{C8197F5F-E0DC-44f1-8AF2-1AA5A84F695D}) (Version: 1.0.0.9 - ZTE Corporation)
ZTE Mobile Broadband Device Drivers 1.0.0.12 (HKLM-x32\...\{9194B665-5134-4B6B-AD73-A5292CB072D3}_is1) (Version: - ZTE)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
21-05-2015 00:48:27 Windows Update
07-06-2015 21:02:15 Punto di controllo pianificato
10-06-2015 00:21:40 Windows Update
19-06-2015 13:22:45 Punto di controllo pianificato
25-06-2015 19:54:37 Removed WIDCOMM Bluetooth Software
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0C8B59B4-B163-4611-9DC6-7E54F8FE5121} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {23809692-AB7C-4520-B038-EC0E6E24499D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {4F6DF4E1-E890-45DF-B95C-80B0C3E413D4} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: {5E6BF205-54A7-44DA-A3AC-6FE66DF87DDD} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2012-10-27] (Microsoft Corporation)
Task: {67F4A6B9-E5AF-4BC1-B087-D6D65F9312AD} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {689C1366-5845-43DA-A512-BF25A5A87A2F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-23] (Adobe Systems Incorporated)
Task: {8133E96A-EF98-4C29-BD27-D0F875BA79D2} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {9AD68464-54C6-47F4-BF70-A1F513C08734} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {B8686CEA-FAB5-4624-ABF8-5DE38717180A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-25] (Google Inc.)
Task: {CECC854B-9AA7-4571-9059-65A795478CED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-25] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2014-11-17 19:02 - 2013-08-02 02:17 - 00425728 _____ () C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
2009-01-22 01:45 - 2009-01-22 01:45 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2014-11-17 19:02 - 2013-08-02 02:17 - 00426752 _____ () C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe
2012-01-27 08:11 - 2012-01-27 08:11 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-11-09 09:55 - 2011-11-09 09:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-11-03 16:51 - 2009-11-03 16:51 - 00039712 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ASL.dll
2009-11-03 16:51 - 2009-11-03 16:51 - 00067872 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-06-25 19:46 - 2015-06-20 07:46 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
2015-06-25 19:46 - 2015-06-20 07:46 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll
2015-06-25 19:46 - 2015-06-20 07:46 - 15003976 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Antonello\Downloads\Circolare 02-2013 (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Circolare 02-2013 (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Circolare 02-2013.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Circolare 35_2012.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Comunicazioni Lavoratori a Chiamata - Novità Decreto Sviluppo-Bis (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Comunicazioni Lavoratori a Chiamata - Novità Decreto Sviluppo-Bis (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Comunicazioni Lavoratori a Chiamata - Novità Decreto Sviluppo-Bis (3).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Comunicazioni Lavoratori a Chiamata - Novità Decreto Sviluppo-Bis.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\conclusione procedimento capo maglia misto cashemere ICP-32025292 (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\conclusione procedimento capo maglia misto cashemere ICP-32025292 (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\conclusione procedimento capo maglia misto cashemere ICP-32025292.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\COND. LESSINIA (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\COND. LESSINIA.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\CUD 2013 Scandola (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\CUD 2013 Scandola (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\CUD 2013 Scandola (3).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\CUD 2013 Scandola.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\Dalla Camera di Commercio la Visura ufficiale della Sua Impresa.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\DICHIARAZIONE DEL LAVORATORE PER RITENUTE E DETRAZIONI D'IMPOSTA ANNO 2013 SCANDOLA (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\DICHIARAZIONE DEL LAVORATORE PER RITENUTE E DETRAZIONI D'IMPOSTA ANNO 2013 SCANDOLA (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\ESAZIONE DIRITTO ANNUALE 2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\INAIL Comunica [14334568].eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL DICEMBRE 2012 SCANDOLA (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL DICEMBRE 2012 SCANDOLA (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL DICEMBRE 2012 SCANDOLA (3).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL DICEMBRE 2012 SCANDOLA.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL FEBBRAIO 2014 - SCANDOLA.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL MARZO 2013 (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL MARZO 2013 (2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL MARZO 2013 (3).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL MARZO 2013 (4).eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\LUL MARZO 2013.eml:OECustomProperty
AlternateDataStreams: C:\Users\Antonello\Downloads\postacert.eml:OECustomProperty
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-641276624-2576159587-653334445-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Antonello\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-641276624-2576159587-653334445-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Antonello\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{996EFC65-14F1-47B7-B941-BEEE7FB41ADF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{B5007182-A6B5-4DDE-A498-2E6AEAA682AD}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{772C19A2-1605-4AC8-B4FF-E532A2867FFC}] => (Allow) LPort=2869
FirewallRules: [{8507CA7C-0973-4DEC-A35F-35213F082482}] => (Allow) LPort=1900
FirewallRules: [{D6C88DE0-87F1-4A6B-A3E7-A145C434C298}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{ECE42E2B-574B-4DFD-85F9-8F86C372CCA6}] => (Allow) C:\Program Files (x86)\Acer\Acer VCM\VC.exe
FirewallRules: [{7377FA98-6085-4D34-B6A1-3375E81FBB55}] => (Allow) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
FirewallRules: [{B189D913-37CE-4F1C-A753-9EAEF78E0A3B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DB1C91CC-0D4A-4956-BF84-B51DE8B2AE76}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E097D065-0FB9-4857-90AE-3F4A72FC0DEB}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{4D7B94C0-1B54-495A-8A82-8F744524BB6D}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{FF6BFA78-01A8-4CBB-A8F4-C0D4887C773A}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/26/2015 01:46:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/26/2015 00:32:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/25/2015 11:31:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/25/2015 08:00:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/25/2015 07:32:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/25/2015 10:11:18 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/24/2015 08:45:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/24/2015 08:39:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/24/2015 11:13:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/23/2015 08:23:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (06/26/2015 01:46:22 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: All'avvio non è stato possibile caricare i seguenti driver:
cdrom
Error: (06/26/2015 01:44:32 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: Arresto imprevisto del modulo di estendibilità WLAN.
Percorso modulo: C:\Windows\System32\bcmihvsrv64.dll
Error: (06/26/2015 01:44:32 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: Arresto imprevisto del modulo di estendibilità WLAN.
Percorso modulo: C:\Windows\System32\bcmihvsrv64.dll
Error: (06/26/2015 01:44:26 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: Arresto imprevisto del modulo di estendibilità WLAN.
Percorso modulo: C:\Windows\System32\bcmihvsrv64.dll
Error: (06/26/2015 01:44:15 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Dritek WMI Service è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 3000 millisecondi: Riavvia il servizio.
Error: (06/26/2015 01:44:15 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Arresto imprevista del servizio Cache tipi di carattere Windows Presentation Foundation 3.0.0.0. Questo evento si è già verificato 2 volta(e).
Error: (06/26/2015 01:44:15 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Avira Mail Protection è stato arrestato in modo imprevisto. Questo problema si è verificato 2 volta/e. Le seguenti azioni di correzione saranno eseguite tra 0 millisecondi: Riavvia il servizio.
Error: (06/26/2015 01:44:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Programma di installazione dei moduli di Windows è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 120000 millisecondi: Riavvia il servizio.
Error: (06/26/2015 01:44:13 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Cache tipi di carattere Windows Presentation Foundation 3.0.0.0 è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 0 millisecondi: Riavvia il servizio.
Error: (06/26/2015 01:44:13 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Servizio di condivisione in rete Windows Media Player è stato arrestato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 30000 millisecondi: Riavvia il servizio.
Microsoft Office:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-05-16 15:56:02.892
Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume3\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
Date: 2013-05-16 15:55:38.933
Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume3\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
Date: 2013-05-16 15:42:13.220
Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume3\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
Date: 2013-05-16 15:12:34.609
Description: Controllo dell'integrità del codice: impossibile verificare l'integrità dell'immagine del file \Device\HarddiskVolume3\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll. Impossibile trovare l'insieme di hash dell'immagine per pagina nel sistema.
==================== Memory info ===========================
Processor: AMD C-60 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 51%
Total physical RAM: 3817.37 MB
Available physical RAM: 1847.85 MB
Total Pagefile: 7932.94 MB
Available Pagefile: 4962.03 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:452.66 GB) (Free:348.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6E62613E)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.7 GB) - (Type=07 NTFS)
==================== End of log ============================
Zu guter letzt noch die Notebook Beschreibung: CPU: AMD Dual Core c60 with turbo core Tech up to 1.333ghz memory 4gb DDR3 Und natuerlich schonmal ein Danke Schoen :-) |
|
26.06.2015, 15:49
| #3 |
| /// the machine /// TB-Ausbilder    | Win7: Chrome Browser nach Malware Attacke sehr langsam. hi,
__________________Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
27.06.2015, 16:11
| #4 |
| | Win7: Chrome Browser nach Malware Attacke sehr langsam. Hi, meine Mitbewohnerin hat die ganze zeit windows firewall off. Wahrscheinlich weil es mit der Antivirus Software in Konflikt geraet. Soll ich das so lassen? Das Notebook ist nicht mehr so schnell wie vor dem maleware problem aber es ist brauchbar. Falls in den Logs nichts mehr auffaellig ist dann lass ich es wohl so und sag nochmal Danke :-) Hier die Logs: ADW Code:
ATTFilter # AdwCleaner v4.207 - Creato file registro eventi 27/06/2015 in 16:35:39
# Aggiornato 21/06/2015 da Xplode
# Database : 2015-06-21.1 [Locale]
# Sistema operativo : Windows 7 Home Premium Service Pack 1 (x64)
# Nome utente : Antonello - ANTONELLO-PC
# In esecuzione da : C:\Users\Antonello\Downloads\AdwCleaner_4.207.exe
# Opzione : Analisi
***** [ Servizi ] *****
***** [ File / Cartelle ] *****
***** [ Attività pianificate ] *****
***** [ Collegamenti ] *****
Collegamento Infetto : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
***** [ Registry ] *****
Dati Trovato : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] -
Dati Trovato : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] -
Valore Trovato : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [DefaultConnectionSettings]
Valore Trovato : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [SavedLegacySettings]
***** [ Browser web ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Google Chrome v43.0.2357.130
*************************
AdwCleaner[R0].txt - [3037 byte] - [26/06/2015 01:39:48]
AdwCleaner[R1].txt - [1276 byte] - [27/06/2015 16:35:40]
AdwCleaner[S0].txt - [2730 byte] - [26/06/2015 01:44:14]
########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [1392 byte] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.1.9 (06.27.2015:2)
OS: Windows 7 Home Premium x64
Ran by Antonello on 27/06/2015 at 16:43:47.43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully disinfected: [Shortcut] C:\ProgramData\microsoft\windows\start menu\Programs\Google Chrome\Google Chrome.lnk
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{01E69440-2B7C-42DD-A93E-FC444F4E52D4}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{1A2CF53E-A190-4FA3-8278-CD8DF9B39328}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{1C74A70C-0CEE-4609-8A87-9739CBF484C8}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{30B7EA5A-D80D-44E9-9E7F-878B35A10E63}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{3CFE10AE-163C-4F22-B378-20B20511A248}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{5D6AE673-7439-4317-944C-CD6B06D96BBF}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{662BBB71-DEF2-4D17-BD24-CB24A1FCAC4A}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{81899EE8-2B66-44E6-9279-724FC932B5DE}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{959AE19F-7320-410B-B417-7A15CC0BFB9B}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{95C9EEE7-C611-428F-B1A1-1686F2BB2E8A}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{A76CF8E0-29B1-401E-AB31-023D21E698B4}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{BF94E084-13F5-49C3-915C-B0156D7DBF6E}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{D2542ED3-A804-4C1D-A082-3425EB4D5180}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{D5D95BA8-5C5D-46C2-94AB-EB41F332A718}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{E4648A01-A565-4CFF-A96D-57ABBB660E82}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{EEEE2077-CE4F-4C16-B3B7-DA5B9617CFF2}
Successfully deleted: [Empty Folder] C:\Users\Antonello\appdata\local\{F1844875-04A4-447E-80FE-955EAE6DBCED}
~~~ Chrome
[C:\Users\Antonello\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\Antonello\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\Antonello\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\Antonello\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27/06/2015 at 16:51:25.53
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by Antonello (administrator) on ANTONELLO-PC on 27-06-2015 16:54:24
Running from C:\Users\Antonello\Downloads
Loaded Profiles: Antonello (Available Profiles: Antonello)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Italiano (Italia)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-21] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2816336 2012-03-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [368728 2011-12-09] (Alcor Micro Corp.)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CancelAutoPlay_Server] => C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe [426752 2013-08-02] ()
HKLM-x32\...\Run: [H3G_Starter] => C:\Program Files (x86)\Chiavetta Internet 21.6\H3G_Starter.exe [107776 2013-08-02] ()
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [417792 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [141608 2010-02-15] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {01dad64b-1baa-11e3-91c2-806e6f6e6963} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {01dad6c0-1baa-11e3-91c2-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {0960a82a-2363-11e2-81f9-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {0960a847-2363-11e2-81f9-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {0bb8b101-2684-11e2-9cf7-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {18401160-be02-11e2-85eb-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {18cf9f07-1b7a-11e2-8188-08edb9f56293} - D:\setup.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {207205b2-d5d2-11e2-a007-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {34030eba-1ae4-11e3-98dc-047d7bcba56a} - D:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {34030fad-1ae4-11e3-98dc-047d7bcba56a} - D:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {38c95f11-bee5-11e3-a168-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {57abdc6c-d5c3-11e2-89ba-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {734dc1c0-5108-11e2-9e09-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {7e50ff71-2e8d-11e2-b0a0-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {7e50ff7b-2e8d-11e2-b0a0-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {a4e2c4e9-33cd-11e3-94dd-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {aeef190f-2518-11e2-b025-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {bf7deaf1-6e79-11e4-a190-08edb9f56293} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\...\MountPoints2: {db7fbdb8-6d19-11e2-a75b-047d7bcba56a} - D:\AutoRun.exe
HKU\S-1-5-21-641276624-2576159587-653334445-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\Acer.scr [450048 2011-09-13] ()
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_222_ActiveX.exe -update activex
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk [2012-05-04]
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/it-it/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120504063214.dll No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120504063215.dll No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-06-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-06-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2010-02-15] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll [2011-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-25] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-25] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll [2014-02-01] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
Chrome:
=======
CHR Profile: C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-25]
CHR Extension: (Google Docs) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-25]
CHR Extension: (Google Drive) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-25]
CHR Extension: (YouTube) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-25]
CHR Extension: (Adblock Plus) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-06-25]
CHR Extension: (Google Search) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-25]
CHR Extension: (Google Sheets) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-25]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-25]
CHR Extension: (Skype Click to Call) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-06-25]
CHR Extension: (Google Wallet) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-25]
CHR Extension: (Gmail) - C:\Users\Antonello\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-25]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
StartMenuInternet: Google Chrome - Chrome.exe
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-18] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [144672 2009-08-28] (Apple Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
S2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZDServ; C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe [425728 2013-08-02] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-11] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-11] (Avira Operations GmbH & Co. KG)
S3 massfilter; C:\Windows\System32\DRIVERS\ztembbmassfilter.sys [15360 2012-11-22] (MBB Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 pmx3gmdm; C:\Windows\System32\DRIVERS\pmx3gmdm.sys [118016 2009-03-26] (Olivetti) [File not signed]
S3 pmx3gnet; C:\Windows\System32\DRIVERS\pmx3gnet.sys [137216 2009-03-26] (Olivetti) [File not signed]
S3 vodafone_K3805-z_cdc_acm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_acm.sys [78336 2010-09-01] (Vodafone)
S3 vodafone_K3805-z_cdc_ecm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_ecm.sys [88064 2010-09-01] (Vodafone)
S3 vodafone_K3805-z_cpo; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cpo.sys [13824 2010-09-01] (Vodafone)
S3 ZTEusbmdm6k; C:\Windows\System32\DRIVERS\ztembbusbmdm.sys [123264 2012-11-22] (ZTE Incorporated)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ztembbusbnet.sys [158208 2012-11-22] (ZTE Corporation)
S3 ZTEusbnmea; C:\Windows\System32\DRIVERS\ztembbusbnmea.sys [123264 2012-11-22] (ZTE Incorporated)
S3 ZTEusbnmeaext; C:\Windows\System32\DRIVERS\ztembbusbnmeaext.sys [123264 2012-11-22] (ZTE Incorporated)
S3 ZTEusbser6K; C:\Windows\System32\DRIVERS\ztembbusbser6k.sys [123264 2012-11-22] (ZTE Incorporated)
S3 bcbtums; system32\drivers\bcbtums.sys [X]
S3 btwampfl; \??\C:\Windows\system32\drivers\btwampfl.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; system32\drivers\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-27 16:51 - 2015-06-27 16:51 - 00003080 _____ C:\Users\Antonello\Desktop\JRT.txt
2015-06-27 16:43 - 2015-06-27 16:43 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ANTONELLO-PC-Windows-7-Home-Premium-(64-bit).dat
2015-06-27 16:43 - 2015-06-27 16:43 - 00000000 ____D C:\RegBackup
2015-06-27 16:42 - 2015-06-27 16:42 - 02950961 _____ (Malwarebytes Corporation) C:\Users\Antonello\Downloads\JRT.exe
2015-06-26 14:31 - 2015-06-26 14:30 - 00001070 _____ C:\Users\Antonello\Desktop\malware scan 2.txt
2015-06-26 14:30 - 2015-06-26 14:31 - 00051791 _____ C:\Users\Antonello\Desktop\malware scan 1.txt
2015-06-26 14:21 - 2015-06-26 14:21 - 00030307 _____ C:\Users\Antonello\Desktop\Addition blocco note.txt
2015-06-26 14:20 - 2015-06-26 14:20 - 00061343 _____ C:\Users\Antonello\Desktop\FRST blocco note.txt
2015-06-26 14:18 - 2015-06-26 14:18 - 00061322 _____ C:\Users\Antonello\Desktop\FRST.txt
2015-06-26 14:18 - 2015-06-26 14:18 - 00030307 _____ C:\Users\Antonello\Desktop\Addition.txt
2015-06-26 14:16 - 2015-06-26 14:16 - 00002420 _____ C:\Users\Antonello\Desktop\gmer.txt
2015-06-26 13:54 - 2015-06-26 13:54 - 00380416 _____ C:\Users\Antonello\Downloads\Gmer-19357.exe
2015-06-26 13:46 - 2015-06-26 13:50 - 00030307 _____ C:\Users\Antonello\Downloads\Addition.txt
2015-06-26 13:44 - 2015-06-27 16:54 - 00018795 _____ C:\Users\Antonello\Downloads\FRST.txt
2015-06-26 13:44 - 2015-06-27 16:54 - 00000000 ____D C:\FRST
2015-06-26 13:44 - 2015-06-26 13:44 - 02112512 _____ (Farbar) C:\Users\Antonello\Downloads\FRST64.exe
2015-06-26 13:33 - 2015-06-26 13:33 - 00000480 _____ C:\Users\Antonello\Downloads\defogger_disable.log
2015-06-26 13:33 - 2015-06-26 13:33 - 00000000 _____ C:\Users\Antonello\defogger_reenable
2015-06-26 13:22 - 2015-06-26 13:22 - 00050477 _____ C:\Users\Antonello\Downloads\Defogger.exe
2015-06-26 01:39 - 2015-06-27 16:37 - 00000000 ____D C:\AdwCleaner
2015-06-26 01:39 - 2015-06-26 01:39 - 02244096 _____ C:\Users\Antonello\Downloads\AdwCleaner_4.207.exe
2015-06-25 23:27 - 2015-06-25 23:27 - 00000000 _____ C:\Windows\prleth.sys
2015-06-25 23:27 - 2015-06-25 23:27 - 00000000 _____ C:\Windows\hgfs.sys
2015-06-25 22:38 - 2015-06-26 14:29 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-25 22:37 - 2015-06-25 22:37 - 00001066 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-25 22:37 - 2015-06-25 22:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-25 22:37 - 2015-06-25 22:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-25 22:37 - 2015-06-25 22:37 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-06-25 22:37 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-25 22:37 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-25 22:37 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-25 22:35 - 2015-06-25 22:35 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Antonello\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-25 19:46 - 2015-06-26 00:49 - 00002302 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-25 19:46 - 2015-06-25 19:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-25 19:45 - 2015-06-27 16:26 - 00001150 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-25 19:45 - 2015-06-27 13:28 - 00001146 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-25 19:45 - 2015-06-25 19:51 - 00004146 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-06-25 19:45 - 2015-06-25 19:51 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-06-23 11:24 - 2015-06-23 11:24 - 00188672 _____ C:\Users\Antonello\Downloads\Syllabus (1)
2015-06-23 11:21 - 2015-06-23 11:21 - 01448577 _____ C:\Users\Antonello\Downloads\Argentina_desde_un_punto_de_vista_econ_mico_y.pptx
2015-06-23 10:59 - 2015-06-23 10:59 - 03390424 _____ C:\Users\Antonello\Downloads\presentazione spagnolo.pptx
2015-06-21 11:38 - 2015-06-21 11:38 - 01313228 _____ C:\Users\Antonello\Downloads\Explicación subjuntivo
2015-06-18 19:18 - 2015-06-18 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-16 14:52 - 2015-06-16 14:52 - 01099250 _____ C:\Users\Antonello\Downloads\España desde un punto de vista económico y (3).pptx
2015-06-15 10:55 - 2015-06-15 10:55 - 00667968 _____ C:\Users\Antonello\Desktop\referat.pptx
2015-06-14 21:38 - 2015-06-14 22:13 - 00000000 ____D C:\Users\Antonello\Desktop\Nuova cartella (5)
2015-06-09 22:27 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-09 22:27 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-09 22:27 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-09 22:27 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-09 22:27 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-09 22:27 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-09 22:27 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-09 22:27 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-09 22:27 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-09 22:27 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-09 22:27 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-09 22:27 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-09 22:27 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-09 22:27 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-09 22:27 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-09 22:27 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-09 22:27 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-09 22:27 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-09 22:27 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-09 22:27 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-09 22:27 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-09 22:27 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-09 22:27 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-09 22:27 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-09 22:27 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-09 22:27 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-09 22:27 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-09 22:27 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-09 22:27 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-09 22:27 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-09 22:27 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-09 22:27 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-09 22:27 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-09 22:27 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-09 22:27 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-09 22:27 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-09 22:27 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-09 22:27 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-09 22:27 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-09 22:27 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-09 22:27 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-09 22:27 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-09 22:27 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-09 22:27 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-09 22:27 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-09 22:27 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-09 22:27 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-09 22:27 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-09 22:27 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-09 22:27 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-09 22:27 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-09 22:26 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-09 22:26 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-09 22:26 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-09 22:26 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-09 22:26 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-09 22:26 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-09 22:26 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-09 22:26 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-09 22:26 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-09 22:26 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-09 22:26 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-09 22:26 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-09 22:26 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-09 22:26 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-09 22:26 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-09 22:26 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-09 22:26 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-09 22:26 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-09 22:26 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 22:26 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-09 22:26 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-09 22:26 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-09 22:26 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-09 22:25 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-09 22:25 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-09 22:25 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-09 22:25 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-09 22:25 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-09 22:25 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-09 22:25 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-09 22:25 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-09 22:25 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-09 22:25 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-09 22:25 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-09 22:25 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-09 22:25 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-09 22:25 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-09 22:25 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-09 22:25 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-09 22:25 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-09 22:25 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-09 22:25 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-09 22:25 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-09 22:25 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-09 22:25 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-09 22:25 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-09 22:25 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-09 22:24 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-09 22:24 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-09 22:24 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-09 21:43 - 2015-06-09 21:43 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-01 21:59 - 2015-06-01 21:59 - 00000000 ____D C:\Users\Antonello\AppData\Local\GWX
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-27 16:26 - 2012-05-04 15:25 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-27 15:51 - 2012-06-19 12:09 - 01217484 _____ C:\Windows\WindowsUpdate.log
2015-06-27 13:51 - 2009-07-14 06:51 - 00229235 _____ C:\Windows\setupact.log
2015-06-27 13:34 - 2009-07-14 06:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-27 13:34 - 2009-07-14 06:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-27 12:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-26 20:11 - 2014-01-22 15:08 - 00000000 ____D C:\Users\Antonello\AppData\Roaming\Skype
2015-06-26 13:33 - 2012-10-20 23:36 - 00000000 ____D C:\Users\Antonello
2015-06-26 01:45 - 2010-11-21 05:47 - 00516310 _____ C:\Windows\PFRO.log
2015-06-26 00:50 - 2012-10-20 23:40 - 00001367 _____ C:\Users\Antonello\Desktop\Internet Explorer.lnk
2015-06-25 19:55 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-25 19:46 - 2012-11-05 21:39 - 00000000 ____D C:\Users\Antonello\AppData\Local\Google
2015-06-25 19:46 - 2012-11-05 21:39 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-25 19:45 - 2012-11-05 21:35 - 00000000 ____D C:\Users\Antonello\AppData\Local\Deployment
2015-06-25 19:39 - 2015-03-29 20:47 - 00000000 __SHD C:\Users\Antonello\AppData\Local\EmieBrowserModeList
2015-06-25 19:39 - 2014-07-10 10:23 - 00000000 __SHD C:\Users\Antonello\AppData\Local\EmieUserList
2015-06-25 19:39 - 2014-07-10 10:23 - 00000000 __SHD C:\Users\Antonello\AppData\Local\EmieSiteList
2015-06-25 10:11 - 2012-10-20 23:36 - 00109296 _____ C:\Users\Antonello\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-23 23:50 - 2012-05-04 15:25 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-23 23:49 - 2012-05-04 15:25 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-23 23:49 - 2012-05-04 15:25 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-23 21:19 - 2015-04-07 17:29 - 01184768 ___SH C:\Users\Antonello\Desktop\Thumbs.db
2015-06-19 13:24 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-18 19:18 - 2015-05-19 20:15 - 00002000 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-06-18 19:14 - 2014-01-28 19:08 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-18 19:14 - 2014-01-28 19:08 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-16 00:42 - 2015-04-28 11:20 - 00000000 ____D C:\Users\Antonello\Desktop\da stampare
2015-06-16 00:17 - 2015-05-18 16:57 - 00000000 ____D C:\Users\Antonello\Desktop\Nuova cartella (4)
2015-06-14 20:29 - 2015-05-09 12:29 - 00379904 ___SH C:\Users\Antonello\Downloads\Thumbs.db
2015-06-11 16:46 - 2012-06-19 21:57 - 00741636 _____ C:\Windows\system32\perfh010.dat
2015-06-11 16:46 - 2012-06-19 21:57 - 00147658 _____ C:\Windows\system32\perfc010.dat
2015-06-11 16:46 - 2009-07-14 07:13 - 01661180 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-10 21:50 - 2009-07-14 06:45 - 00415552 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-10 21:47 - 2014-12-15 08:47 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-10 21:47 - 2014-05-07 15:57 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-10 21:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 00:42 - 2013-08-19 13:05 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 00:24 - 2012-11-21 21:59 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-09 21:51 - 2012-05-04 15:24 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-06-09 09:49 - 2015-05-03 18:25 - 00000000 ____D C:\Users\Antonello\Desktop\Nuova cartella
2015-06-07 20:34 - 2012-05-04 14:27 - 00000000 ____D C:\ProgramData\Skype
2015-05-31 21:56 - 2015-03-06 13:44 - 00000000 ___RD C:\Program Files (x86)\Skype
Some files in TEMP:
====================
C:\Users\Antonello\AppData\Local\Temp\AskSLib.dll
C:\Users\Antonello\AppData\Local\Temp\avgnt.exe
C:\Users\Antonello\AppData\Local\Temp\Quarantine.exe
C:\Users\Antonello\AppData\Local\Temp\SetupMyPcCleaner.exe
C:\Users\Antonello\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Antonello\AppData\Local\Temp\sqlite3.dll
C:\Users\Antonello\AppData\Local\Temp\_is537C.exe
C:\Users\Antonello\AppData\Local\Temp\_isCB97.exe
C:\Users\Antonello\AppData\Local\Temp\{09149D86-3C7B-44BD-82AD-B5419D912A8A}-23.0.1271.64_22.0.1229.96_chrome_updater.exe
C:\Users\Antonello\AppData\Local\Temp\{5869FA5B-B005-46BE-A9E8-127427B5AD8A}-34.0.1847.137_34.0.1847.131_chrome_updater.exe
C:\Users\Antonello\AppData\Local\Temp\{8D40D044-C84F-4BC7-B6A0-3EF3E27F3DBC}-26.0.1410.43_25.0.1364.172_chrome_updater.exe
C:\Users\Antonello\AppData\Local\Temp\{EFD2B7CB-0CC6-4245-AFD5-161B86AB106C}-25.0.1364.172_25.0.1364.152_chrome_updater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 00:51
==================== End of log ============================
|
|
28.06.2015, 12:17
| #5 |
| /// the machine /// TB-Ausbilder | Win7: Chrome Browser nach Malware Attacke sehr langsam.ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.07.2015, 20:52
| #6 |
| | Win7: Chrome Browser nach Malware Attacke sehr langsam. Hi Schrauber, der ESET Scan ist nicht mehr nötig. Meine Mitbewohnerin findet das Laptop jetzt ausreichend schnell. Oder ist dieser jetzt noch zwingend notwendig? (Falls nicht, kann dieser Thread geschlossen werden) Vielen Dank für deine Hilfe! |
|
02.07.2015, 13:53
| #7 |
| /// the machine /// TB-Ausbilder | Win7: Chrome Browser nach Malware Attacke sehr langsam. Naja, Kontrollscans sind nie verkehrt
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win7: Chrome Browser nach Malware Attacke sehr langsam. |
| .com, auslastung, avira, bonjour, browser, cpu, desktop, flash player, google, helper, iexplore.exe, install.exe, installmanager.exe, internet, internet explorer, langsam, launch, maleware, malware, miuitab, mozilla, realtek, scan, software, svchost.exe, symantec, system, vista, windows |
Linear-Darstellung
