| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System wird immer langsamer und Funde bei AVIRAWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
02.01.2016, 20:11
| #1 |
| /// TB-Ausbilder   |  System wird immer langsamer und Funde bei AVIRA Servus, Avira deaktivieren! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
Unlock: C:\WINDOWS\system32\Drivers\etc\hosts
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts:
Reboot:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
|
|
03.01.2016, 10:21
| #2 |
 | System wird immer langsamer und Funde bei AVIRA Hallo Matthias,
__________________inzwischen konnte ich meinen Schwiegervater bearbeiten und ihm klar machen, was fuer einem Sicherheitsrisiko er ausgesetzt ist. Er will sich demnaechst einen komplett neuen Computer anschaffen. Koennten wir es vielleicht so machen, dass du mir doch mit der Bereinigung des aktuellen Windows XP Systems hilfst, damit er wenigstens jetzt ein sauberes System hat ? Das waere wirklich sehr toll und ich verspreche, dass wir uns spaeter nicht nochmal an euch wenden mit dem Windows XP System. Danke Lions |
|
03.01.2016, 10:25
| #3 |
| /// TB-Ausbilder | System wird immer langsamer und Funde bei AVIRA Servus,
__________________ok.  FRST wie beschrieben ausführen und die Logdatei posten. Wenn das erledigt ist, dann nochmal ein aktueller Scan bitte:
|
|
03.01.2016, 11:49
| #4 |
| | System wird immer langsamer und Funde bei AVIRA Danke Danke Danke  Habe FRST wie du gesagt hast ausgefuehrt: Also hier ist die FIXlog.txt: Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version:31-12-2015
Ran by Angelo (2016-01-03 10:30:24) Run:1
Running from C:\Documents and Settings\Angelo\Desktop
Loaded Profiles: Angelo (Available Profiles: Angelo & Administrator)
Boot Mode: Normal
==============================================
fixlist content:
*****************
start
CloseProcesses:
Unlock: C:\WINDOWS\system32\Drivers\etc\hosts
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts:
Reboot:
end
*****************
Processes closed successfully.
"C:\WINDOWS\system32\Drivers\etc\hosts" => could not be unlocked
Could not move "C:\WINDOWS\system32\Drivers\etc\hosts" => Scheduled to move on reboot.
"C:\Windows\System32\Drivers\etc\hosts" => Could not move.
Could not restore Hosts.
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-01-03 10:33:32)
C:\WINDOWS\system32\Drivers\etc\hosts => moved successfully
==== End of Fixlog 10:33:32 ====
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:31-12-2015
Ran by Angelo (administrator) on ANGELO-84DCAD4D (03-01-2016 11:00:35)
Running from C:\Documents and Settings\Angelo\Desktop
Loaded Profiles: Angelo (Available Profiles: Angelo & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: Italiano (Italia)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avguard.exe
(Sun Microsystems, Inc.) C:\Programmi\Java\jre6\bin\jqs.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\soundman.exe
(GlobespanVirata, Inc.) C:\Program Files\D-Link\DSL-200\DslStat.exe
() C:\Program Files\D-Link\DSL-200\dslagent.exe
(Sun Microsystems, Inc.) C:\Programmi\File comuni\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe
(Mozilla Corporation) C:\Programmi\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SoundMan] => C:\WINDOWS\SOUNDMAN.EXE [90112 2005-09-22] (Realtek Semiconductor Corp.)
HKLM\...\Run: [DSLSTATEXE] => C:\Program Files\D-Link\DSL-200\dslstat.exe [356352 2004-11-26] (GlobespanVirata, Inc.)
HKLM\...\Run: [DSLAGENTEXE] => C:\Program Files\D-Link\DSL-200\dslagent.exe [16384 2004-11-26] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programmi\File comuni\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Programmi\Avira\AntiVir Desktop\avgnt.exe [704512 2015-12-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [EPSON Stylus C86 Series] => C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE [99840 2003-11-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-19\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-19\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-20\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-20\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\MountPoints2: {60a3c3b2-6911-11e1-8379-001195300101} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-18\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: Hosts file not detected in the default directory
Tcpip\..\Interfaces\{0FA1BD90-F3B2-4A5B-88D2-DD3318DB1FBF}: [NameServer] 212.52.97.15 193.70.152.15
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.it/
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programmi\Java\jre6\bin\jp2ssv.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: EpsonToolBandKicker Class -> {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} -> C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKLM - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll [2013-09-25] (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Angelo\Dati applicazioni\Mozilla\Firefox\Profiles\6etgdb37.default
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=it-it
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Programmi\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Programmi\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programmi\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programmi\Java\jre6\lib\deploy\jqs\ff [2013-09-09] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-20] [not signed]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-02]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Programmi\Avira\AntiVir Desktop\sched.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
U2 AntiVirService; C:\Programmi\Avira\AntiVir Desktop\avguard.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
R2 JavaQuickStarterService; C:\Programmi\Java\jre6\bin\jqs.exe [153376 2013-09-09] (Sun Microsystems, Inc.)
S2 MBAMService; C:\Programmi\Malwarebytes Anti-Malware2\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 Microsoft Office Groove Audit Service; C:\Programmi\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
S3 odserv; C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 Samsung UPD Service2; C:\WINDOWS\system32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics)
S2 SkypeUpdate; C:\Programmi\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
S3 WMPNetworkSvc; C:\Programmi\Windows Media Player\WMPNetwk.exe [918528 2006-11-02] (Microsoft Corporation)
S2 Skype C2C Service; "C:\Documents and Settings\All Users\Dati applicazioni\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3727680 2005-09-22] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [105864 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2014-11-27] (Avira Operations GmbH & Co. KG)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R0 nvata; C:\WINDOWS\System32\DRIVERS\nvata.sys [98432 2005-08-13] (NVIDIA Corporation)
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [34048 2005-07-30] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [12928 2005-07-30] (NVIDIA Corporation)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2014-11-27] (Avira GmbH)
R3 wanusb; C:\WINDOWS\System32\DRIVERS\gwausb.sys [150369 2004-11-26] (GlobespanVirata Inc.) [File not signed]
S4 IntelIde; no ImagePath
U1 WS2IFSL; no ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-01-03 11:00 - 2016-01-03 11:02 - 00015113 _____ C:\Documents and Settings\Angelo\Desktop\FRST.txt
2016-01-03 10:30 - 2016-01-03 10:33 - 00000958 _____ C:\Documents and Settings\Angelo\Desktop\Fixlog.txt
2016-01-02 17:54 - 2016-01-02 17:54 - 00000000 ____D C:\Programmi\Malwarebytes Anti-Malware2
2016-01-02 17:37 - 2016-01-02 17:37 - 01599336 _____ (Malwarebytes) C:\Documents and Settings\Angelo\Desktop\JRT.exe
2016-01-02 11:20 - 2016-01-03 11:00 - 00000000 ____D C:\FRST
2016-01-02 11:03 - 2016-01-02 11:04 - 01721856 _____ (Farbar) C:\Documents and Settings\Angelo\Desktop\FRST.exe
2015-12-31 16:49 - 2016-01-02 17:45 - 00000000 ____D C:\AdwCleaner
2015-12-30 09:12 - 2015-12-30 09:22 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-28 16:43 - 2016-01-03 09:34 - 00000000 ____D C:\Programmi\Mozilla Firefox
2015-12-25 20:27 - 2015-12-25 20:27 - 00725504 _____ C:\Documents and Settings\Angelo\auguri2[1].ppt
2015-12-17 17:39 - 2015-12-25 19:52 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-17
2015-12-15 19:23 - 2015-12-15 19:23 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
2015-12-11 16:56 - 2015-12-29 00:11 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-11
2015-12-11 16:55 - 2016-01-03 10:32 - 00000224 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job
2015-12-11 16:55 - 2015-12-15 18:08 - 00000218 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2934207$
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
2015-12-10 19:03 - 2015-12-10 19:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
2015-12-10 19:01 - 2015-12-10 19:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
2015-12-10 19:00 - 2015-12-10 19:00 - 00000000 ____D C:\Programmi\File comuni\DESIGNER
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe
2015-12-04 19:37 - 2015-12-04 19:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-01-03 11:02 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Temp
2016-01-03 10:46 - 2001-08-31 13:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2016-01-03 10:32 - 2006-01-01 04:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-03 10:31 - 2006-01-01 04:39 - 00032322 _____ C:\WINDOWS\SchedLgU.Txt
2016-01-03 10:30 - 2012-02-23 12:17 - 00000194 ___SH C:\Documents and Settings\Angelo\ntuser.ini
2016-01-03 10:30 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo
2016-01-03 09:34 - 2006-01-01 02:19 - 00000000 ___RD C:\Programmi
2016-01-02 18:04 - 2014-12-24 12:18 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-02 17:54 - 2014-12-24 12:18 - 00000756 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2016-01-02 17:54 - 2014-12-24 12:18 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\ Malwarebytes Anti-Malware
2016-01-02 17:49 - 2013-11-03 20:53 - 00000000 ____D C:\Documents and Settings\Angelo\Documenti\Download
2016-01-02 17:40 - 2006-01-01 02:14 - 00000000 ____D C:\WINDOWS
2016-01-02 16:15 - 2012-02-23 12:26 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\Caterina
2016-01-02 11:46 - 2012-02-23 12:19 - 00002511 _____ C:\Documents and Settings\Angelo\Desktop\Microsoft Office Word 2007.lnk
2016-01-02 10:42 - 2006-01-01 02:17 - 00000211 ___SH C:\boot.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000582 _____ C:\WINDOWS\win.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000227 _____ C:\WINDOWS\system.ini
2015-12-30 16:19 - 2014-12-31 10:28 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-12-30 16:19 - 2014-12-31 10:28 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-12-29 00:42 - 2013-08-26 16:27 - 00796864 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-12-29 00:42 - 2013-08-26 16:27 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-12-29 00:35 - 2012-02-28 14:44 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Adobe
2015-12-25 20:02 - 2013-02-18 17:58 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\foto Irene
2015-12-17 17:47 - 2012-03-13 15:24 - 00036363 _____ C:\WINDOWS\CSTBox.INI
2015-12-15 19:24 - 2006-01-01 05:50 - 00000000 ____D C:\Documents and Settings\All Users\Dati applicazioni\Microsoft Help
2015-12-15 19:23 - 2006-01-01 02:19 - 00001393 _____ C:\WINDOWS\imsins.BAK
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 RSHDC C:\WINDOWS\system32\dllcache
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 ___HD C:\WINDOWS\inf
2015-12-11 16:54 - 2013-01-20 17:10 - 00000000 ____D C:\Programmi\Microsoft Silverlight
2015-12-11 16:54 - 2006-01-01 02:18 - 00267008 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-12-10 19:00 - 2006-01-01 02:19 - 00000000 ____D C:\Programmi\File comuni
2015-12-10 18:55 - 2006-01-01 02:19 - 01035664 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-10 18:55 - 2001-08-31 13:00 - 00482130 _____ C:\WINDOWS\system32\perfh010.dat
2015-12-10 18:55 - 2001-08-31 13:00 - 00080734 _____ C:\WINDOWS\system32\perfc010.dat
2015-12-10 18:47 - 2013-01-20 17:10 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\Microsoft Silverlight
2015-12-10 18:18 - 2012-02-23 12:17 - 00000000 ___RD C:\Documents and Settings\Angelo\Documenti\Musica
==================== Files in the root of some directories =======
2012-07-17 13:46 - 2012-07-17 13:46 - 0000288 _____ () C:\Documents and Settings\Angelo\Dati applicazioni\.backup.dm
2012-08-12 12:50 - 2015-08-30 16:27 - 0037888 _____ () C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Some files in TEMP:
====================
C:\Documents and Settings\Administrator\Impostazioni locali\Temp\7z.dll
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\avgnt.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BingSvc.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcProcessor.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcUpdater.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1].exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\mpam-aa9d147b.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\sqlite3.dll
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-38a1ac41.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-3d7e978c.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-a4768524.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-da3379d1.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-e9f1d2ad.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End of FRST.txt ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:31-12-2015
Ran by Angelo (2016-01-03 11:05:37)
Running from C:\Documents and Settings\Angelo\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) (2006-01-01 00:34:11)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
Angelo (S-1-5-21- Administrator - Enabled) => %SystemDrive%\Documents and Settings\Angelo
Guest (S-1-5-21- Limited - Disabled)
HelpAssistant (S-1-5-21- Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21- Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat 5.0 (HKLM\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2544521) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2647516) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2510531) (HKLM\...\KB2510531-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2544521) (HKLM\...\KB2544521-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2647516) (HKLM\...\KB2647516-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2675157) (HKLM\...\KB2675157-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2699988) (HKLM\...\KB2699988-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2722913) (HKLM\...\KB2722913-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2744842) (HKLM\...\KB2744842-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2761465) (HKLM\...\KB2761465-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2792100) (HKLM\...\KB2792100-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2797052) (HKLM\...\KB2797052-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2799329) (HKLM\...\KB2799329-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2809289) (HKLM\...\KB2809289-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2817183) (HKLM\...\KB2817183-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2829530) (HKLM\...\KB2829530-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2838727) (HKLM\...\KB2838727-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2846071) (HKLM\...\KB2846071-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2847204) (HKLM\...\KB2847204-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2862772) (HKLM\...\KB2862772-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2870699) (HKLM\...\KB2870699-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2879017) (HKLM\...\KB2879017-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2888505) (HKLM\...\KB2888505-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2898785) (HKLM\...\KB2898785-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB2378111) (HKLM\...\KB2378111_WM9) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB2834904) (HKLM\...\KB2834904_WM11) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB2834904-v2) (HKLM\...\KB2834904-v2_WM11) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB952069) (HKLM\...\KB952069_WM9) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB954155) (HKLM\...\KB954155_WM9) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB973540) (HKLM\...\KB973540_WM9) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB975558) (HKLM\...\KB975558_WM8) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player (KB978695) (HKLM\...\KB978695_WM9) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player 11 (KB954154) (HKLM\...\KB954154_WM11) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2079403) (HKLM\...\KB2079403) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2115168) (HKLM\...\KB2115168) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2296011) (HKLM\...\KB2296011) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2347290) (HKLM\...\KB2347290) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2360937) (HKLM\...\KB2360937) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2387149) (HKLM\...\KB2387149) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2393802) (HKLM\...\KB2393802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2412687) (HKLM\...\KB2412687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2419632) (HKLM\...\KB2419632) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2423089) (HKLM\...\KB2423089) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2440591) (HKLM\...\KB2440591) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2443105) (HKLM\...\KB2443105) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2476490) (HKLM\...\KB2476490) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478960) (HKLM\...\KB2478960) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478971) (HKLM\...\KB2478971) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2479943) (HKLM\...\KB2479943) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2481109) (HKLM\...\KB2481109) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2483185) (HKLM\...\KB2483185) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2485663) (HKLM\...\KB2485663) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2506212) (HKLM\...\KB2506212) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507618) (HKLM\...\KB2507618) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507938) (HKLM\...\KB2507938) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2508429) (HKLM\...\KB2508429) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2509553) (HKLM\...\KB2509553) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2510581) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB2535512) (HKLM\...\KB2535512) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2536276-v2) (HKLM\...\KB2536276-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2544893-v2) (HKLM\...\KB2544893-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2566454) (HKLM\...\KB2566454) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570222) (HKLM\...\KB2570222) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570947) (HKLM\...\KB2570947) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2584146) (HKLM\...\KB2584146) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2585542) (HKLM\...\KB2585542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2592799) (HKLM\...\KB2592799) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2598479) (HKLM\...\KB2598479) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2603381) (HKLM\...\KB2603381) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2618451) (HKLM\...\KB2618451) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2619339) (HKLM\...\KB2619339) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2620712) (HKLM\...\KB2620712) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2621440) (HKLM\...\KB2621440) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2624667) (HKLM\...\KB2624667) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2631813) (HKLM\...\KB2631813) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2633171) (HKLM\...\KB2633171) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2641653) (HKLM\...\KB2641653) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2646524) (HKLM\...\KB2646524) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2647518) (HKLM\...\KB2647518) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2653956) (HKLM\...\KB2653956) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2655992) (HKLM\...\KB2655992) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2659262) (HKLM\...\KB2659262) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2660465) (HKLM\...\KB2660465) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2661637) (HKLM\...\KB2661637) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2676562) (HKLM\...\KB2676562) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2685939) (HKLM\...\KB2685939) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2686509) (HKLM\...\KB2686509) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2691442) (HKLM\...\KB2691442) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2695962) (HKLM\...\KB2695962) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2698365) (HKLM\...\KB2698365) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2705219) (HKLM\...\KB2705219) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2707511) (HKLM\...\KB2707511) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2709162) (HKLM\...\KB2709162) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2712808) (HKLM\...\KB2712808) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2718523) (HKLM\...\KB2718523) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2719985) (HKLM\...\KB2719985) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2723135) (HKLM\...\KB2723135) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2724197) (HKLM\...\KB2724197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2727528) (HKLM\...\KB2727528) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2731847) (HKLM\...\KB2731847) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2753842-v2) (HKLM\...\KB2753842-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2757638) (HKLM\...\KB2757638) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2758857) (HKLM\...\KB2758857) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2761226) (HKLM\...\KB2761226) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2770660) (HKLM\...\KB2770660) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2778344) (HKLM\...\KB2778344) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2779030) (HKLM\...\KB2779030) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2780091) (HKLM\...\KB2780091) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2799494) (HKLM\...\KB2799494) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2802968) (HKLM\...\KB2802968) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2807986) (HKLM\...\KB2807986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2808735) (HKLM\...\KB2808735) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813170) (HKLM\...\KB2813170) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813345) (HKLM\...\KB2813345) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820197) (HKLM\...\KB2820197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820917) (HKLM\...\KB2820917) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2829361) (HKLM\...\KB2829361) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2834886) (HKLM\...\KB2834886) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2839229) (HKLM\...\KB2839229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2845187) (HKLM\...\KB2845187) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2847311) (HKLM\...\KB2847311) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2849470) (HKLM\...\KB2849470) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850851) (HKLM\...\KB2850851) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850869) (HKLM\...\KB2850869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2859537) (HKLM\...\KB2859537) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862152) (HKLM\...\KB2862152) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862330) (HKLM\...\KB2862330) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862335) (HKLM\...\KB2862335) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2864063) (HKLM\...\KB2864063) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868038) (HKLM\...\KB2868038) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868626) (HKLM\...\KB2868626) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876217) (HKLM\...\KB2876217) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876315) (HKLM\...\KB2876315) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876331) (HKLM\...\KB2876331) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2883150) (HKLM\...\KB2883150) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2892075) (HKLM\...\KB2892075) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893294) (HKLM\...\KB2893294) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893984) (HKLM\...\KB2893984) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2898715) (HKLM\...\KB2898715) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2900986) (HKLM\...\KB2900986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2914368) (HKLM\...\KB2914368) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2916036) (HKLM\...\KB2916036) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2922229) (HKLM\...\KB2922229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2929961) (HKLM\...\KB2929961) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2930275) (HKLM\...\KB2930275) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923789) (HKLM\...\KB923789) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB941569) (HKLM\...\KB941569) (Version: - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB946648) (HKLM\...\KB946648) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB954459) (HKLM\...\KB954459) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956744) (HKLM\...\KB956744) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956802) (HKLM\...\KB956802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB958644) (HKLM\...\KB958644) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB961501) (HKLM\...\KB961501) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975713) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978601) (HKLM\...\KB978601) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979687) (HKLM\...\KB979687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981322) (HKLM\...\KB981322) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981997) (HKLM\...\KB981997) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982132) (HKLM\...\KB982132) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982665) (HKLM\...\KB982665) (Version: 1 - Microsoft Corporation)
Aggiornamento della sicurezza per Microsoft Windows (KB2564958) (HKLM\...\KB2564958) (Version: - Microsoft Corporation)
Aggiornamento per Windows XP (KB2345886) (HKLM\...\KB2345886) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2641690) (HKLM\...\KB2641690) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2661254-v2) (HKLM\...\KB2661254-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2718704) (HKLM\...\KB2718704) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2736233) (HKLM\...\KB2736233) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2749655) (HKLM\...\KB2749655) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2863058) (HKLM\...\KB2863058) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2904266) (HKLM\...\KB2904266) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2934207) (HKLM\...\KB2934207) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB898461) (HKLM\...\KB898461) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB951978) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento per Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB971029) (HKLM\...\KB971029) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973687) (HKLM\...\KB973687) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows Media Player 11 (KB939683) (HKLM\...\KB939683) (Version: - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2633952) (HKLM\...\KB2633952) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2756822) (HKLM\...\KB2756822) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2779562) (HKLM\...\KB2779562) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Canon CanoScan Toolbox 4.9 (HKLM\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )
Canon ScanGear Starter (HKLM\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )
D-Link DSL-200 ADSL Modem (HKLM\...\D-Link DSL-200 ADSL Modem) (Version: - )
EPSON PhotoQuicker3.5 (HKLM\...\{65F5B7AF-3363-11D7-BB6B-00018021113F}) (Version: - )
EPSON Web-To-Page (HKLM\...\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}) (Version: - )
ESC86 Guida di riferimento (HKLM\...\ESC86 Guida di riferimento) (Version: - )
ESC86 Guida software (HKLM\...\ESC86 Guida software) (Version: - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Manual CanoScan LiDE 25 (HKLM\...\{838BC0FB-4F8F-47B9-847F-06AE4CCE4181}) (Version: - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 43.0.2 (x86 it) (HKLM\...\Mozilla Firefox 43.0.2 (x86 it)) (Version: 43.0.2 - Mozilla)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.17 - Realtek Semiconductor Corp.)
Samsung Universal Print Driver (HKLM\...\Samsung Universal Print Driver) (Version: 2.03.01.00:36 - Samsung Electronics Co., Ltd.)
ScanToWeb (HKLM\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version: - )
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 7.8 (HKLM\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Software per stampante EPSON (HKLM\...\EPSON Printer and Utilities) (Version: - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.9.0040.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job => C:\WINDOWS\system32\xp_eos.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2012-02-22 18:51 - 2011-04-11 06:26 - 00024064 _____ () C:\WINDOWS\system32\spd__l.dll
2012-02-25 09:33 - 2004-11-26 05:05 - 00286720 ____N () C:\Program Files\D-Link\DSL-200\DbgMode.dll
2012-02-25 09:33 - 2004-11-26 05:05 - 00016384 ____N () C:\Program Files\D-Link\DSL-200\dslagent.exe
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
There are 7822 more sites.
IE trusted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\samsungsetup.com -> hxxp://www.samsungsetup.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123simsen.com -> www.123simsen.com
There are 7822 more sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
DNS Servers: 212.52.97.15 - 193.70.152.15
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Adobe ARM => "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BingSvc => C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\BingSvc\BingSvc.exe
MSCONFIG\startupreg: GrooveMonitor => "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: MSMSGS => "C:\Programmi\Messenger\msmsgs.exe" /background
MSCONFIG\startupreg: SDTray => "C:\Programmi\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Programmi\Skype\Phone\Skype.exe" /minimized /regrun
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\GROOVE.EXE] => Enabled:Microsoft Office Groove
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\ONENOTE.EXE] => Enabled:Microsoft Office OneNote
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\SUPDSvc2.exe] => Enabled:Samsung UPD Service2
StandardProfile\AuthorizedApplications: [C:\Programmi\AVG\AVG2013\avgmfapx.exe] => Enabled:AVG Installer
StandardProfile\AuthorizedApplications: [C:\Programmi\Skype\Phone\Skype.exe] => Enabled:Skype
StandardProfile\AuthorizedApplications: [C:\Programmi\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Programmi\Mozilla Firefox)
StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22004
StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22005
StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22001
StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22002
==================== Restore Points =========================
25-11-2015 10:56:06 Punto di arresto del sistema
25-11-2015 11:24:14 Installato EPSON PhotoQuicker3.5
25-11-2015 11:24:46 Installed ScanToWeb
25-11-2015 11:25:08 Installato EPSON Web-To-Page
04-12-2015 19:36:51 Software Distribution Service 3.0
10-12-2015 18:42:33 Software Distribution Service 3.0
15-12-2015 19:17:28 Software Distribution Service 3.0
29-12-2015 11:54:14 Punto di arresto del sistema
30-12-2015 09:08:14 Software Distribution Service 3.0
31-12-2015 13:01:47 Punto di arresto del sistema
02-01-2016 12:25:03 Punto di arresto del sistema
02-01-2016 17:40:05 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/03/2016 09:28:55 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Impossibile estrarre l'elenco principale di altri produttori dal file .cab di aggiornamento automatico in: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo di validità se verificato rispetto all'ora corrente del sistema o al timestamp sul file firmato.
Error: (01/03/2016 09:28:54 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Impossibile estrarre l'elenco principale di altri produttori dal file .cab di aggiornamento automatico in: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo di validità se verificato rispetto all'ora corrente del sistema o al timestamp sul file firmato.
Error: (01/02/2016 05:49:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, modulo che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, indirizzo errore 0x00021514.
Elaborazione evento specifico al supporto per [adwcleaner_5.027.exe!ws!] in corso
Error: (01/02/2016 05:49:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, modulo che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, indirizzo errore 0x00021514.
Elaborazione evento specifico al supporto per [adwcleaner_5.027.exe!ws!] in corso
Error: (01/02/2016 05:48:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.
Error: (01/02/2016 10:46:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso
Error: (01/01/2016 07:12:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso
Error: (12/04/2015 07:26:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.
Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.
Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.
System errors:
=============
Error: (01/03/2016 10:44:19 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Servizio Avira Real-Time Protection bloccato in partenza.
Error: (01/03/2016 10:30:29 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Spooler di stampa è terminato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 60000 millisecondi: Riavvia il servizio.
Error: (01/03/2016 10:30:29 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).
Error: (01/03/2016 09:26:01 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).
Error: (01/02/2016 05:59:55 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.
Error: (01/02/2016 05:40:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).
Error: (12/31/2015 06:21:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.
Error: (12/31/2015 05:05:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Servizio Gateway di livello applicazione. Questo evento si è già verificato 1 volta(e).
Error: (12/31/2015 05:05:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).
Error: (12/31/2015 05:05:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Spooler di stampa è terminato in modo imprevisto. Questo problema si è verificato 1 volta/e. Le seguenti azioni di correzione saranno eseguite tra 60000 millisecondi: Riavvia il servizio.
==================== Memory info ===========================
Processor: AMD Sempron(tm) Processor 3200+
Percentage of memory in use: 94%
Total physical RAM: 446.48 MB
Available physical RAM: 22.39 MB
Total Virtual: 1101.7 MB
Available Virtual: 180.72 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:58.59 GB) (Free:16.99 GB) NTFS ==>[drive with boot components (Windows XP)]
Drive d: () (Fixed) (Total:15.93 GB) (Free:10.67 GB) NTFS
Drive g: (Sony_16GP) (Removable) (Total:15.09 GB) (Free:1.78 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 74.5 GB) (Disk ID: 39B439B3)
Partition 1: (Active) - (Size=58.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=15.9 GB) - (Type=OF Extended)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15.1 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15.1 GB) - (Type=0C)
==================== End of Addition.txt ============================
|
|
03.01.2016, 20:13
| #5 |
| /// TB-Ausbilder | System wird immer langsamer und Funde bei AVIRA Servus, Scan mit Combofix
|
|
04.01.2016, 15:53
| #6 |
| | System wird immer langsamer und Funde bei AVIRA Hallo Matthias, ich habe das Combofix laufen lassen. Bis zum Installieren der Wiederherstellungskonsole war alles gut. Dann war geschrieben: Der Scan dauert normalerweise weniger als 10 Minuten Als sich nach 1 Stunde nichts getan hat habe ich es ueber Nacht laufen lassen. Am Morgen habe ich den genau gleichen Bildschirm ohne Veraenderung vorgefunden. Ich habe vor dem Scan die Internet-Verbindung beendet. War das in Ordnug ? Oder braucht Combofix eine Internetverbindung ? Kann ich irgendwie sehen, ob Combofix noch korrekt laueft bzw den Fortschritt sehen ? Danke fuer deine Hilfe ! Lions Direkr nach dem Download der Wiederherstellungskonsole sagt ComboFix: cure(7) could not connect to host impossible to find c:/ComboFix/nvidia.zip Kann es was damit zu tun haben, dass es nicht laueft ? |
|
04.01.2016, 22:57
| #7 |
| /// TB-Ausbilder | System wird immer langsamer und Funde bei AVIRA Servus, ja, gut möglich. Lass mal ComboFix weg, wir nehmen stattdessen MBAR: Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers |
|
| Themen zu System wird immer langsamer und Funde bei AVIRA |
| adware, antivir, antivirus, avira, browser, dnsapi.dll, flash player, frage, homepage, iexplore.exe, internet, mozilla, realtek, registry, rundll, scan, security, software, svchost.exe, system, tcp, trojaner, trojaner board, usb, windows, windows xp |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
