System wird immer langsamer und Funde bei AVIRA

Lions · 02.01.2016, 11:45

Hallo Trojaner Board Team,

ein frohes neues Jahr wuensche ich euch allen !

ich brauechte bitte Hilfe mit dem System meines Schwiegervaters.
Zugegeben ist das System veraltet (WIndows XP). Aber mein Schwiegervater will sich an kein neues System mehr gewohnen.

Da er Internet nicht so bewandert ist und auch noch das System immer langsamer wurde
wollte ich jetzt euch fragen, ob ihr euch das mal ansehen koenntet.
Ich habe die Befuerchtung, dass er sich was eingefangen hat.

DEn FRST Scan habe ich schon gemacht:
hier die FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:31-12-2015
Ran by Angelo (administrator) on ANGELO-84 (02-01-2016 11:20:26)
Running from C:\Documents and Settings\Angelo\Desktop
Loaded Profiles: Angelo (Available Profiles: Angelo & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: Italiano (Italia)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avguard.exe
(Sun Microsystems, Inc.) C:\Programmi\Java\jre6\bin\jqs.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\soundman.exe
(GlobespanVirata, Inc.) C:\Program Files\D-Link\DSL-200\DslStat.exe
() C:\Program Files\D-Link\DSL-200\dslagent.exe
(Sun Microsystems, Inc.) C:\Programmi\File comuni\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
(SEIKO EPSON CORPORATION) C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I0R2.EXE
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avshadow.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SoundMan] => C:\WINDOWS\SOUNDMAN.EXE [90112 2005-09-22] (Realtek Semiconductor Corp.)
HKLM\...\Run: [DSLSTATEXE] => C:\Program Files\D-Link\DSL-200\dslstat.exe [356352 2004-11-26] (GlobespanVirata, Inc.)
HKLM\...\Run: [DSLAGENTEXE] => C:\Program Files\D-Link\DSL-200\dslagent.exe [16384 2004-11-26] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programmi\File comuni\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Programmi\Avira\AntiVir Desktop\avgnt.exe [704512 2015-12-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [EPSON Stylus C86 Series] => C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE [99840 2003-11-25] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [MSConfig] => C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [172032 2008-04-13] (Microsoft Corporation)
HKU\S-1-5-19\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-19\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-20\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-20\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\MountPoints2: {60a3c3b2-6911-11e1-8379-001195300101} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-18\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.it/
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programmi\Java\jre6\bin\jp2ssv.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: EpsonToolBandKicker Class -> {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} -> C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKLM - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll [2013-09-25] (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Angelo\Dati applicazioni\Mozilla\Firefox\Profiles\6etgdb37.default
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=it-it
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Programmi\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Programmi\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programmi\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programmi\Java\jre6\lib\deploy\jqs\ff [2013-09-09] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-20] [not signed]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-02]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - Chrome.exe

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Programmi\Avira\AntiVir Desktop\sched.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programmi\Avira\AntiVir Desktop\avguard.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
R2 JavaQuickStarterService; C:\Programmi\Java\jre6\bin\jqs.exe [153376 2013-09-09] (Sun Microsystems, Inc.)
S3 Microsoft Office Groove Audit Service; C:\Programmi\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
S3 odserv; C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 Samsung UPD Service2; C:\WINDOWS\system32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics)
S2 SkypeUpdate; C:\Programmi\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
S3 WMPNetworkSvc; C:\Programmi\Windows Media Player\WMPNetwk.exe [918528 2006-11-02] (Microsoft Corporation)
S2 Skype C2C Service; "C:\Documents and Settings\All Users\Dati applicazioni\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3727680 2005-09-22] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [105864 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2014-11-27] (Avira Operations GmbH & Co. KG)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R0 nvata; C:\WINDOWS\System32\DRIVERS\nvata.sys [98432 2005-08-13] (NVIDIA Corporation)
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [34048 2005-07-30] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [12928 2005-07-30] (NVIDIA Corporation)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2014-11-27] (Avira GmbH)
R3 wanusb; C:\WINDOWS\System32\DRIVERS\gwausb.sys [150369 2004-11-26] (GlobespanVirata Inc.) [File not signed]
S4 IntelIde; no ImagePath
U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-02 11:20 - 2016-01-02 11:21 - 00015146 _____ C:\Documents and Settings\Angelo\Desktop\FRST.txt
2016-01-02 11:20 - 2016-01-02 11:20 - 00000000 ____D C:\FRST
2016-01-02 11:03 - 2016-01-02 11:04 - 01721856 _____ (Farbar) C:\Documents and Settings\Angelo\Desktop\FRST.exe
2015-12-31 16:49 - 2015-12-31 17:05 - 00000000 ____D C:\AdwCleaner
2015-12-30 09:12 - 2015-12-30 09:22 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-28 16:43 - 2016-01-02 11:02 - 00000000 ____D C:\Programmi\Mozilla Firefox
2015-12-25 20:27 - 2015-12-25 20:27 - 00725504 _____ C:\Documents and Settings\Angelo\auguri2[1].ppt
2015-12-17 17:39 - 2015-12-25 19:52 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-17
2015-12-15 19:23 - 2015-12-15 19:23 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
2015-12-11 16:56 - 2015-12-29 00:11 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-11
2015-12-11 16:55 - 2016-01-02 10:48 - 00000224 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job
2015-12-11 16:55 - 2015-12-15 18:08 - 00000218 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2934207$
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
2015-12-10 19:03 - 2015-12-10 19:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
2015-12-10 19:01 - 2015-12-10 19:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
2015-12-10 19:00 - 2015-12-10 19:00 - 00000000 ____D C:\Programmi\File comuni\DESIGNER
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe
2015-12-04 19:37 - 2015-12-04 19:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-02 11:21 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Temp
2016-01-02 11:20 - 2006-01-01 02:14 - 00000000 ____D C:\WINDOWS
2016-01-02 11:19 - 2013-11-03 20:53 - 00000000 ____D C:\Documents and Settings\Angelo\Documenti\Download
2016-01-02 11:02 - 2006-01-01 02:19 - 00000000 ___RD C:\Programmi
2016-01-02 10:53 - 2001-08-31 13:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2016-01-02 10:48 - 2006-01-01 04:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-02 10:47 - 2012-02-23 12:17 - 00000194 ___SH C:\Documents and Settings\Angelo\ntuser.ini
2016-01-02 10:47 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo
2016-01-02 10:47 - 2006-01-01 04:39 - 00032322 _____ C:\WINDOWS\SchedLgU.Txt
2016-01-02 10:42 - 2006-01-01 02:17 - 00000211 ___SH C:\boot.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000582 _____ C:\WINDOWS\win.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000227 _____ C:\WINDOWS\system.ini
2016-01-02 00:51 - 2012-02-23 12:26 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\Caterina
2015-12-30 16:19 - 2014-12-31 10:28 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-12-30 16:19 - 2014-12-31 10:28 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-12-29 10:33 - 2014-12-24 12:18 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-12-29 00:42 - 2013-08-26 16:27 - 00796864 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-12-29 00:42 - 2013-08-26 16:27 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-12-29 00:35 - 2012-02-28 14:44 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Adobe
2015-12-25 20:02 - 2013-02-18 17:58 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\foto Irene
2015-12-17 17:47 - 2012-03-13 15:24 - 00036363 _____ C:\WINDOWS\CSTBox.INI
2015-12-15 19:24 - 2006-01-01 05:50 - 00000000 ____D C:\Documents and Settings\All Users\Dati applicazioni\Microsoft Help
2015-12-15 19:23 - 2006-01-01 02:19 - 00001393 _____ C:\WINDOWS\imsins.BAK
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 RSHDC C:\WINDOWS\system32\dllcache
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 ___HD C:\WINDOWS\inf
2015-12-11 16:54 - 2013-01-20 17:10 - 00000000 ____D C:\Programmi\Microsoft Silverlight
2015-12-11 16:54 - 2006-01-01 02:18 - 00267008 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-12-10 19:00 - 2006-01-01 02:19 - 00000000 ____D C:\Programmi\File comuni
2015-12-10 18:55 - 2006-01-01 02:19 - 01035664 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-10 18:55 - 2001-08-31 13:00 - 00482130 _____ C:\WINDOWS\system32\perfh010.dat
2015-12-10 18:55 - 2001-08-31 13:00 - 00080734 _____ C:\WINDOWS\system32\perfc010.dat
2015-12-10 18:47 - 2013-01-20 17:10 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\Microsoft Silverlight
2015-12-10 18:18 - 2012-02-23 12:17 - 00000000 ___RD C:\Documents and Settings\Angelo\Documenti\Musica

==================== Files in the root of some directories =======

2012-07-17 13:46 - 2012-07-17 13:46 - 0000288 _____ () C:\Documents and Settings\Angelo\Dati applicazioni\.backup.dm
2012-08-12 12:50 - 2015-08-30 16:27 - 0037888 _____ () C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:
====================
C:\Documents and Settings\Administrator\Impostazioni locali\Temp\7z.dll
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\avgnt.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BingSvc.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcProcessor.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcUpdater.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1].exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\mpam-aa9d147b.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\sqlite3.dll
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-38a1ac41.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-3d7e978c.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-a4768524.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-da3379d1.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-e9f1d2ad.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

und die Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:31-12-2015
Ran by Angelo (2016-01-02 11:21:41)
Running from C:\Documents and Settings\Angelo\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) (2006-01-01 00:34:11)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
Angelo (S-1-5-21- Administrator - Enabled) => %SystemDrive%\Documents and Settings\Angelo
Guest (S-1-5-21 - Limited - Disabled)
HelpAssistant (S-1-5-21- - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat 5.0 (HKLM\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2544521) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2647516) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2510531) (HKLM\...\KB2510531-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2544521) (HKLM\...\KB2544521-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2647516) (HKLM\...\KB2647516-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2675157) (HKLM\...\KB2675157-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2699988) (HKLM\...\KB2699988-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2722913) (HKLM\...\KB2722913-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2744842) (HKLM\...\KB2744842-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2761465) (HKLM\...\KB2761465-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2792100) (HKLM\...\KB2792100-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2797052) (HKLM\...\KB2797052-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2799329) (HKLM\...\KB2799329-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2809289) (HKLM\...\KB2809289-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2817183) (HKLM\...\KB2817183-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2829530) (HKLM\...\KB2829530-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2838727) (HKLM\...\KB2838727-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2846071) (HKLM\...\KB2846071-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2847204) (HKLM\...\KB2847204-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2862772) (HKLM\...\KB2862772-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2870699) (HKLM\...\KB2870699-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2879017) (HKLM\...\KB2879017-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2888505) (HKLM\...\KB2888505-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2898785) (HKLM\...\KB2898785-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2378111) (HKLM\...\KB2378111_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2834904) (HKLM\...\KB2834904_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2834904-v2) (HKLM\...\KB2834904-v2_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB952069) (HKLM\...\KB952069_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB954155) (HKLM\...\KB954155_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB973540) (HKLM\...\KB973540_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB975558) (HKLM\...\KB975558_WM8) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB978695) (HKLM\...\KB978695_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player 11  (KB954154) (HKLM\...\KB954154_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2079403) (HKLM\...\KB2079403) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2115168) (HKLM\...\KB2115168) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2296011) (HKLM\...\KB2296011) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2347290) (HKLM\...\KB2347290) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2360937) (HKLM\...\KB2360937) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2387149) (HKLM\...\KB2387149) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2393802) (HKLM\...\KB2393802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2412687) (HKLM\...\KB2412687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2419632) (HKLM\...\KB2419632) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2423089) (HKLM\...\KB2423089) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2440591) (HKLM\...\KB2440591) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2443105) (HKLM\...\KB2443105) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2476490) (HKLM\...\KB2476490) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478960) (HKLM\...\KB2478960) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478971) (HKLM\...\KB2478971) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2479943) (HKLM\...\KB2479943) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2481109) (HKLM\...\KB2481109) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2483185) (HKLM\...\KB2483185) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2485663) (HKLM\...\KB2485663) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2506212) (HKLM\...\KB2506212) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507618) (HKLM\...\KB2507618) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507938) (HKLM\...\KB2507938) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2508429) (HKLM\...\KB2508429) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2509553) (HKLM\...\KB2509553) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2510581) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB2535512) (HKLM\...\KB2535512) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2536276-v2) (HKLM\...\KB2536276-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2544893-v2) (HKLM\...\KB2544893-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2566454) (HKLM\...\KB2566454) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570222) (HKLM\...\KB2570222) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570947) (HKLM\...\KB2570947) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2584146) (HKLM\...\KB2584146) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2585542) (HKLM\...\KB2585542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2592799) (HKLM\...\KB2592799) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2598479) (HKLM\...\KB2598479) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2603381) (HKLM\...\KB2603381) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2618451) (HKLM\...\KB2618451) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2619339) (HKLM\...\KB2619339) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2620712) (HKLM\...\KB2620712) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2621440) (HKLM\...\KB2621440) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2624667) (HKLM\...\KB2624667) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2631813) (HKLM\...\KB2631813) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2633171) (HKLM\...\KB2633171) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2641653) (HKLM\...\KB2641653) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2646524) (HKLM\...\KB2646524) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2647518) (HKLM\...\KB2647518) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2653956) (HKLM\...\KB2653956) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2655992) (HKLM\...\KB2655992) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2659262) (HKLM\...\KB2659262) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2660465) (HKLM\...\KB2660465) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2661637) (HKLM\...\KB2661637) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2676562) (HKLM\...\KB2676562) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2685939) (HKLM\...\KB2685939) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2686509) (HKLM\...\KB2686509) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2691442) (HKLM\...\KB2691442) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2695962) (HKLM\...\KB2695962) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2698365) (HKLM\...\KB2698365) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2705219) (HKLM\...\KB2705219) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2707511) (HKLM\...\KB2707511) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2709162) (HKLM\...\KB2709162) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2712808) (HKLM\...\KB2712808) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2718523) (HKLM\...\KB2718523) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2719985) (HKLM\...\KB2719985) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2723135) (HKLM\...\KB2723135) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2724197) (HKLM\...\KB2724197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2727528) (HKLM\...\KB2727528) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2731847) (HKLM\...\KB2731847) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2753842-v2) (HKLM\...\KB2753842-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2757638) (HKLM\...\KB2757638) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2758857) (HKLM\...\KB2758857) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2761226) (HKLM\...\KB2761226) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2770660) (HKLM\...\KB2770660) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2778344) (HKLM\...\KB2778344) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2779030) (HKLM\...\KB2779030) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2780091) (HKLM\...\KB2780091) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2799494) (HKLM\...\KB2799494) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2802968) (HKLM\...\KB2802968) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2807986) (HKLM\...\KB2807986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2808735) (HKLM\...\KB2808735) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813170) (HKLM\...\KB2813170) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813345) (HKLM\...\KB2813345) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820197) (HKLM\...\KB2820197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820917) (HKLM\...\KB2820917) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2829361) (HKLM\...\KB2829361) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2834886) (HKLM\...\KB2834886) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2839229) (HKLM\...\KB2839229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2845187) (HKLM\...\KB2845187) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2847311) (HKLM\...\KB2847311) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2849470) (HKLM\...\KB2849470) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850851) (HKLM\...\KB2850851) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850869) (HKLM\...\KB2850869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2859537) (HKLM\...\KB2859537) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862152) (HKLM\...\KB2862152) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862330) (HKLM\...\KB2862330) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862335) (HKLM\...\KB2862335) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2864063) (HKLM\...\KB2864063) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868038) (HKLM\...\KB2868038) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868626) (HKLM\...\KB2868626) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876217) (HKLM\...\KB2876217) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876315) (HKLM\...\KB2876315) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876331) (HKLM\...\KB2876331) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2883150) (HKLM\...\KB2883150) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2892075) (HKLM\...\KB2892075) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893294) (HKLM\...\KB2893294) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893984) (HKLM\...\KB2893984) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2898715) (HKLM\...\KB2898715) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2900986) (HKLM\...\KB2900986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2914368) (HKLM\...\KB2914368) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2916036) (HKLM\...\KB2916036) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2922229) (HKLM\...\KB2922229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2929961) (HKLM\...\KB2929961) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2930275) (HKLM\...\KB2930275) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923789) (HKLM\...\KB923789) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB941569) (HKLM\...\KB941569) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB946648) (HKLM\...\KB946648) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB954459) (HKLM\...\KB954459) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956744) (HKLM\...\KB956744) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956802) (HKLM\...\KB956802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB958644) (HKLM\...\KB958644) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB961501) (HKLM\...\KB961501) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975713) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978601) (HKLM\...\KB978601) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979687) (HKLM\...\KB979687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981322) (HKLM\...\KB981322) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981997) (HKLM\...\KB981997) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982132) (HKLM\...\KB982132) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982665) (HKLM\...\KB982665) (Version: 1 - Microsoft Corporation)
Aggiornamento della sicurezza per Microsoft Windows (KB2564958) (HKLM\...\KB2564958) (Version:  - Microsoft Corporation)
Aggiornamento per Windows XP (KB2345886) (HKLM\...\KB2345886) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2641690) (HKLM\...\KB2641690) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2661254-v2) (HKLM\...\KB2661254-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2718704) (HKLM\...\KB2718704) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2736233) (HKLM\...\KB2736233) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2749655) (HKLM\...\KB2749655) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2863058) (HKLM\...\KB2863058) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2904266) (HKLM\...\KB2904266) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2934207) (HKLM\...\KB2934207) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB898461) (HKLM\...\KB898461) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB951978) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento per Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB971029) (HKLM\...\KB971029) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973687) (HKLM\...\KB973687) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows Media Player 11  (KB939683) (HKLM\...\KB939683) (Version:  - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2633952) (HKLM\...\KB2633952) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2756822) (HKLM\...\KB2756822) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2779562) (HKLM\...\KB2779562) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Canon CanoScan Toolbox 4.9 (HKLM\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version:  - )
Canon ScanGear Starter (HKLM\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version:  - )
D-Link DSL-200 ADSL Modem (HKLM\...\D-Link DSL-200 ADSL Modem) (Version:  - )
EPSON PhotoQuicker3.5 (HKLM\...\{65F5B7AF-3363-11D7-BB6B-00018021113F}) (Version:  - )
EPSON Web-To-Page (HKLM\...\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}) (Version:  - )
ESC86 Guida di riferimento (HKLM\...\ESC86 Guida di riferimento) (Version:  - )
ESC86 Guida software (HKLM\...\ESC86 Guida software) (Version:  - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Manual CanoScan LiDE 25 (HKLM\...\{838BC0FB-4F8F-47B9-847F-06AE4CCE4181}) (Version:  - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 43.0.2 (x86 it) (HKLM\...\Mozilla Firefox 43.0.2 (x86 it)) (Version: 43.0.2 - Mozilla)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.17 - Realtek Semiconductor Corp.)
Samsung Universal Print Driver (HKLM\...\Samsung Universal Print Driver) (Version: 2.03.01.00:36 - Samsung Electronics Co., Ltd.)
ScanToWeb (HKLM\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version:  - )
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 7.8 (HKLM\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Software per stampante EPSON (HKLM\...\EPSON Printer and Utilities) (Version:  - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.9.0040.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job => C:\WINDOWS\system32\xp_eos.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2012-02-22 16:58 - 2005-10-10 21:49 - 00466944 _____ () C:\WINDOWS\system32\nvshell.dll
2012-02-22 18:51 - 2011-04-11 06:26 - 00024064 _____ () C:\WINDOWS\system32\spd__l.dll
2012-02-25 09:33 - 2004-11-26 05:05 - 00286720 ____N () C:\Program Files\D-Link\DSL-200\DbgMode.dll
2012-02-25 09:33 - 2004-11-26 05:05 - 00016384 ____N () C:\Program Files\D-Link\DSL-200\dslagent.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.

IE trusted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\samsungsetup.com -> hxxp://www.samsungsetup.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2001-08-31 13:00 - 2013-08-25 20:26 - 00447807 ____R C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1	localhost127.0.0.1	mpa.one.microsoft.com127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com
127.0.0.1	www.123moviedownload.com

There are 15368 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
DNS Servers: Media is not connected to internet.
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BingSvc => C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\BingSvc\BingSvc.exe
MSCONFIG\startupreg: GrooveMonitor => "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: MSMSGS => "C:\Programmi\Messenger\msmsgs.exe" /background
MSCONFIG\startupreg: SDTray => "C:\Programmi\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Programmi\Skype\Phone\Skype.exe" /minimized /regrun

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\GROOVE.EXE] => Enabled:Microsoft Office Groove
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\ONENOTE.EXE] => Enabled:Microsoft Office OneNote
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\SUPDSvc2.exe] => Enabled:Samsung UPD Service2
StandardProfile\AuthorizedApplications: [C:\Programmi\AVG\AVG2013\avgmfapx.exe] => Enabled:AVG Installer
StandardProfile\AuthorizedApplications: [C:\Programmi\Skype\Phone\Skype.exe] => Enabled:Skype
StandardProfile\AuthorizedApplications: [C:\Programmi\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Programmi\Mozilla Firefox)
StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22004
StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22005
StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22001
StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22002

==================== Restore Points =========================

25-11-2015 10:56:06 Punto di arresto del sistema
25-11-2015 11:24:14 Installato EPSON PhotoQuicker3.5
25-11-2015 11:24:46 Installed ScanToWeb
25-11-2015 11:25:08 Installato EPSON Web-To-Page
04-12-2015 19:36:51 Software Distribution Service 3.0
10-12-2015 18:42:33 Software Distribution Service 3.0
15-12-2015 19:17:28 Software Distribution Service 3.0
29-12-2015 11:54:14 Punto di arresto del sistema
30-12-2015 09:08:14 Software Distribution Service 3.0
31-12-2015 13:01:47 Punto di arresto del sistema

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/02/2016 10:46:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso

Error: (01/01/2016 07:12:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso

Error: (12/04/2015 07:26:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:03:05 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:03:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.


System errors:
=============
Error: (12/31/2015 06:21:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.

Error: (12/31/2015 05:05:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Servizio Gateway di livello applicazione. Questo evento si è già verificato 1 volta(e).

Error: (12/31/2015 05:05:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (12/31/2015 05:05:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Spooler di stampa è terminato in modo imprevisto. Questo problema si è verificato 1 volta/e.  Le seguenti azioni di correzione saranno eseguite tra 60000 millisecondi: Riavvia il servizio.

Error: (12/31/2015 04:13:55 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio stisvc.

Error: (12/31/2015 04:13:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio stisvc.

Error: (12/31/2015 11:39:47 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.

Error: (12/31/2015 11:39:27 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.

Error: (12/30/2015 06:53:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio stisvc.

Error: (12/30/2015 06:52:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio stisvc.


==================== Memory info =========================== 

Processor: AMD Sempron(tm) Processor 3200+
Percentage of memory in use: 63%
Total physical RAM: 446.48 MB
Available physical RAM: 160.8 MB
Total Virtual: 1179.73 MB
Available Virtual: 693.56 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:58.59 GB) (Free:16.95 GB) NTFS ==>[drive with boot components (Windows XP)]
Drive d: () (Fixed) (Total:15.93 GB) (Free:10.67 GB) NTFS
Drive g: (Sony_16GP) (Removable) (Total:15.09 GB) (Free:1.78 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 74.5 GB) (Disk ID: 39B439B3)
Partition 1: (Active) - (Size=58.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=15.9 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15.1 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15.1 GB) - (Type=0C)

==================== End of Addition.txt ======================

Vielen Dank an euch !!!
Lions

M-K-D-B · 02.01.2016, 16:24

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort als Administrator zu starten!

Lesestoff:
Windows XP

Auf deinem Rechner läuft noch Windows XP. Microsoft hat dieses Betriebssystem bereits 2001 veröffentlicht und stellte den Support endgültig ab April 2014 ein, d.h. seit Mai 2014 gab es keine weiteren Updates mehr und danach gefundene Lücken wurden nicht mehr durch Updates/Hotfixes geschlossen.

Mit Windows XP nach April 2014 zu surfen ist damit ein großes Sicherheitsrisiko. Du solltest dir jetzt unbedingt Gedanken machen, möglichst schnell auf ein aktuelleres Betriebssystem umzusteigen.

Aus dem genannten Grund bereinigen wir keine XP-Systeme mehr.

Ich empfehle einen Umstieg auf Windows 7, da ist kein großer Unterschied zu XP.
Mein Vater ist von XP auf 10 umgestiegen und hatte keine Probleme.

Lions · 02.01.2016, 17:35

Danke fuer deine ANtwort Matthias.
Leider ist der Computer schon relativ alt, sodass ein Umstieg auf Windows 7
wahrscheinlich von den Hardware Vorraussetzungen nicht machbar ist.

Koenntest du mir sagen wie ich diese

Code:

ATTFilter

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2001-08-31 13:00 - 2013-08-25 20:26 - 00447807 ____R C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1	localhost127.0.0.1	mpa.one.microsoft.com127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
usw.

There are 15368 more lines.

entfernen kann ?
Nur das bitte.

M-K-D-B · 02.01.2016, 20:11

Servus,

Avira deaktivieren!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
CloseProcesses:
Unlock: C:\WINDOWS\system32\Drivers\etc\hosts
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts: 
Reboot:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Lions · 03.01.2016, 10:21

Hallo Matthias,

inzwischen konnte ich meinen Schwiegervater bearbeiten und ihm klar machen, was fuer einem Sicherheitsrisiko er ausgesetzt ist.
Er will sich demnaechst einen komplett neuen Computer anschaffen.

Koennten wir es vielleicht so machen, dass du mir doch mit der Bereinigung des aktuellen Windows XP Systems hilfst, damit er wenigstens jetzt ein sauberes System hat ?

Das waere wirklich sehr toll und ich verspreche, dass wir uns spaeter nicht nochmal an euch wenden mit dem Windows XP System.

Danke
Lions

M-K-D-B · 03.01.2016, 10:25

Servus,

ok.

FRST wie beschrieben ausführen und die Logdatei posten.

Wenn das erledigt ist, dann nochmal ein aktueller Scan bitte:

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Lions · 03.01.2016, 11:49

Danke Danke Danke

Habe FRST wie du gesagt hast ausgefuehrt:

Also hier ist die FIXlog.txt:

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x86) Version:31-12-2015
Ran by Angelo (2016-01-03 10:30:24) Run:1
Running from C:\Documents and Settings\Angelo\Desktop
Loaded Profiles: Angelo (Available Profiles: Angelo & Administrator)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CloseProcesses:
Unlock: C:\WINDOWS\system32\Drivers\etc\hosts
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts: 
Reboot:
end
*****************

Processes closed successfully.
"C:\WINDOWS\system32\Drivers\etc\hosts" => could not be unlocked
Could not move "C:\WINDOWS\system32\Drivers\etc\hosts" => Scheduled to move on reboot.
"C:\Windows\System32\Drivers\etc\hosts" => Could not move.
Could not restore Hosts.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-01-03 10:33:32)

C:\WINDOWS\system32\Drivers\etc\hosts => moved successfully

==== End of Fixlog 10:33:32 ====

Hier der neue aktuelle Scan:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:31-12-2015
Ran by Angelo (administrator) on ANGELO-84DCAD4D (03-01-2016 11:00:35)
Running from C:\Documents and Settings\Angelo\Desktop
Loaded Profiles: Angelo (Available Profiles: Angelo & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: Italiano (Italia)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avguard.exe
(Sun Microsystems, Inc.) C:\Programmi\Java\jre6\bin\jqs.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\soundman.exe
(GlobespanVirata, Inc.) C:\Program Files\D-Link\DSL-200\DslStat.exe
() C:\Program Files\D-Link\DSL-200\dslagent.exe
(Sun Microsystems, Inc.) C:\Programmi\File comuni\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe
(Mozilla Corporation) C:\Programmi\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SoundMan] => C:\WINDOWS\SOUNDMAN.EXE [90112 2005-09-22] (Realtek Semiconductor Corp.)
HKLM\...\Run: [DSLSTATEXE] => C:\Program Files\D-Link\DSL-200\dslstat.exe [356352 2004-11-26] (GlobespanVirata, Inc.)
HKLM\...\Run: [DSLAGENTEXE] => C:\Program Files\D-Link\DSL-200\dslagent.exe [16384 2004-11-26] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programmi\File comuni\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Programmi\Avira\AntiVir Desktop\avgnt.exe [704512 2015-12-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [EPSON Stylus C86 Series] => C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE [99840 2003-11-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-19\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-19\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-20\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-20\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\MountPoints2: {60a3c3b2-6911-11e1-8379-001195300101} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-18\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: Hosts file not detected in the default directory
Tcpip\..\Interfaces\{0FA1BD90-F3B2-4A5B-88D2-DD3318DB1FBF}: [NameServer] 212.52.97.15 193.70.152.15

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.it/
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programmi\Java\jre6\bin\jp2ssv.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: EpsonToolBandKicker Class -> {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} -> C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKLM - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll [2013-09-25] (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Angelo\Dati applicazioni\Mozilla\Firefox\Profiles\6etgdb37.default
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=it-it
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Programmi\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Programmi\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programmi\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programmi\Java\jre6\lib\deploy\jqs\ff [2013-09-09] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-20] [not signed]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-02]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Programmi\Avira\AntiVir Desktop\sched.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
U2 AntiVirService; C:\Programmi\Avira\AntiVir Desktop\avguard.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
R2 JavaQuickStarterService; C:\Programmi\Java\jre6\bin\jqs.exe [153376 2013-09-09] (Sun Microsystems, Inc.)
S2 MBAMService; C:\Programmi\Malwarebytes Anti-Malware2\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 Microsoft Office Groove Audit Service; C:\Programmi\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
S3 odserv; C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 Samsung UPD Service2; C:\WINDOWS\system32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics)
S2 SkypeUpdate; C:\Programmi\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
S3 WMPNetworkSvc; C:\Programmi\Windows Media Player\WMPNetwk.exe [918528 2006-11-02] (Microsoft Corporation)
S2 Skype C2C Service; "C:\Documents and Settings\All Users\Dati applicazioni\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3727680 2005-09-22] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [105864 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2014-11-27] (Avira Operations GmbH & Co. KG)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R0 nvata; C:\WINDOWS\System32\DRIVERS\nvata.sys [98432 2005-08-13] (NVIDIA Corporation)
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [34048 2005-07-30] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [12928 2005-07-30] (NVIDIA Corporation)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2014-11-27] (Avira GmbH)
R3 wanusb; C:\WINDOWS\System32\DRIVERS\gwausb.sys [150369 2004-11-26] (GlobespanVirata Inc.) [File not signed]
S4 IntelIde; no ImagePath
U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-03 11:00 - 2016-01-03 11:02 - 00015113 _____ C:\Documents and Settings\Angelo\Desktop\FRST.txt
2016-01-03 10:30 - 2016-01-03 10:33 - 00000958 _____ C:\Documents and Settings\Angelo\Desktop\Fixlog.txt
2016-01-02 17:54 - 2016-01-02 17:54 - 00000000 ____D C:\Programmi\Malwarebytes Anti-Malware2
2016-01-02 17:37 - 2016-01-02 17:37 - 01599336 _____ (Malwarebytes) C:\Documents and Settings\Angelo\Desktop\JRT.exe
2016-01-02 11:20 - 2016-01-03 11:00 - 00000000 ____D C:\FRST
2016-01-02 11:03 - 2016-01-02 11:04 - 01721856 _____ (Farbar) C:\Documents and Settings\Angelo\Desktop\FRST.exe
2015-12-31 16:49 - 2016-01-02 17:45 - 00000000 ____D C:\AdwCleaner
2015-12-30 09:12 - 2015-12-30 09:22 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-28 16:43 - 2016-01-03 09:34 - 00000000 ____D C:\Programmi\Mozilla Firefox
2015-12-25 20:27 - 2015-12-25 20:27 - 00725504 _____ C:\Documents and Settings\Angelo\auguri2[1].ppt
2015-12-17 17:39 - 2015-12-25 19:52 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-17
2015-12-15 19:23 - 2015-12-15 19:23 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
2015-12-11 16:56 - 2015-12-29 00:11 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-11
2015-12-11 16:55 - 2016-01-03 10:32 - 00000224 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job
2015-12-11 16:55 - 2015-12-15 18:08 - 00000218 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2934207$
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
2015-12-10 19:03 - 2015-12-10 19:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
2015-12-10 19:01 - 2015-12-10 19:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
2015-12-10 19:00 - 2015-12-10 19:00 - 00000000 ____D C:\Programmi\File comuni\DESIGNER
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe
2015-12-04 19:37 - 2015-12-04 19:37 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-03 11:02 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Temp
2016-01-03 10:46 - 2001-08-31 13:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2016-01-03 10:32 - 2006-01-01 04:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-03 10:31 - 2006-01-01 04:39 - 00032322 _____ C:\WINDOWS\SchedLgU.Txt
2016-01-03 10:30 - 2012-02-23 12:17 - 00000194 ___SH C:\Documents and Settings\Angelo\ntuser.ini
2016-01-03 10:30 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo
2016-01-03 09:34 - 2006-01-01 02:19 - 00000000 ___RD C:\Programmi
2016-01-02 18:04 - 2014-12-24 12:18 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-02 17:54 - 2014-12-24 12:18 - 00000756 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2016-01-02 17:54 - 2014-12-24 12:18 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\ Malwarebytes Anti-Malware 
2016-01-02 17:49 - 2013-11-03 20:53 - 00000000 ____D C:\Documents and Settings\Angelo\Documenti\Download
2016-01-02 17:40 - 2006-01-01 02:14 - 00000000 ____D C:\WINDOWS
2016-01-02 16:15 - 2012-02-23 12:26 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\Caterina
2016-01-02 11:46 - 2012-02-23 12:19 - 00002511 _____ C:\Documents and Settings\Angelo\Desktop\Microsoft Office Word 2007.lnk
2016-01-02 10:42 - 2006-01-01 02:17 - 00000211 ___SH C:\boot.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000582 _____ C:\WINDOWS\win.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000227 _____ C:\WINDOWS\system.ini
2015-12-30 16:19 - 2014-12-31 10:28 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-12-30 16:19 - 2014-12-31 10:28 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-12-29 00:42 - 2013-08-26 16:27 - 00796864 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-12-29 00:42 - 2013-08-26 16:27 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-12-29 00:35 - 2012-02-28 14:44 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Adobe
2015-12-25 20:02 - 2013-02-18 17:58 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\foto Irene
2015-12-17 17:47 - 2012-03-13 15:24 - 00036363 _____ C:\WINDOWS\CSTBox.INI
2015-12-15 19:24 - 2006-01-01 05:50 - 00000000 ____D C:\Documents and Settings\All Users\Dati applicazioni\Microsoft Help
2015-12-15 19:23 - 2006-01-01 02:19 - 00001393 _____ C:\WINDOWS\imsins.BAK
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 RSHDC C:\WINDOWS\system32\dllcache
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 ___HD C:\WINDOWS\inf
2015-12-11 16:54 - 2013-01-20 17:10 - 00000000 ____D C:\Programmi\Microsoft Silverlight
2015-12-11 16:54 - 2006-01-01 02:18 - 00267008 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-12-10 19:00 - 2006-01-01 02:19 - 00000000 ____D C:\Programmi\File comuni
2015-12-10 18:55 - 2006-01-01 02:19 - 01035664 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-10 18:55 - 2001-08-31 13:00 - 00482130 _____ C:\WINDOWS\system32\perfh010.dat
2015-12-10 18:55 - 2001-08-31 13:00 - 00080734 _____ C:\WINDOWS\system32\perfc010.dat
2015-12-10 18:47 - 2013-01-20 17:10 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\Microsoft Silverlight
2015-12-10 18:18 - 2012-02-23 12:17 - 00000000 ___RD C:\Documents and Settings\Angelo\Documenti\Musica

==================== Files in the root of some directories =======

2012-07-17 13:46 - 2012-07-17 13:46 - 0000288 _____ () C:\Documents and Settings\Angelo\Dati applicazioni\.backup.dm
2012-08-12 12:50 - 2015-08-30 16:27 - 0037888 _____ () C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:
====================
C:\Documents and Settings\Administrator\Impostazioni locali\Temp\7z.dll
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\avgnt.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BingSvc.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcProcessor.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcUpdater.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1].exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\mpam-aa9d147b.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\sqlite3.dll
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-38a1ac41.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-3d7e978c.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-a4768524.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-da3379d1.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-e9f1d2ad.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

und die addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:31-12-2015
Ran by Angelo (2016-01-03 11:05:37)
Running from C:\Documents and Settings\Angelo\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) (2006-01-01 00:34:11)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
Angelo (S-1-5-21- Administrator - Enabled) => %SystemDrive%\Documents and Settings\Angelo
Guest (S-1-5-21- Limited - Disabled)
HelpAssistant (S-1-5-21- Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21- Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat 5.0 (HKLM\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2544521) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2647516) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2510531) (HKLM\...\KB2510531-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2544521) (HKLM\...\KB2544521-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2647516) (HKLM\...\KB2647516-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2675157) (HKLM\...\KB2675157-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2699988) (HKLM\...\KB2699988-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2722913) (HKLM\...\KB2722913-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2744842) (HKLM\...\KB2744842-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2761465) (HKLM\...\KB2761465-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2792100) (HKLM\...\KB2792100-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2797052) (HKLM\...\KB2797052-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2799329) (HKLM\...\KB2799329-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2809289) (HKLM\...\KB2809289-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2817183) (HKLM\...\KB2817183-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2829530) (HKLM\...\KB2829530-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2838727) (HKLM\...\KB2838727-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2846071) (HKLM\...\KB2846071-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2847204) (HKLM\...\KB2847204-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2862772) (HKLM\...\KB2862772-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2870699) (HKLM\...\KB2870699-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2879017) (HKLM\...\KB2879017-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2888505) (HKLM\...\KB2888505-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2898785) (HKLM\...\KB2898785-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2378111) (HKLM\...\KB2378111_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2834904) (HKLM\...\KB2834904_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2834904-v2) (HKLM\...\KB2834904-v2_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB952069) (HKLM\...\KB952069_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB954155) (HKLM\...\KB954155_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB973540) (HKLM\...\KB973540_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB975558) (HKLM\...\KB975558_WM8) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB978695) (HKLM\...\KB978695_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player 11  (KB954154) (HKLM\...\KB954154_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2079403) (HKLM\...\KB2079403) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2115168) (HKLM\...\KB2115168) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2296011) (HKLM\...\KB2296011) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2347290) (HKLM\...\KB2347290) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2360937) (HKLM\...\KB2360937) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2387149) (HKLM\...\KB2387149) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2393802) (HKLM\...\KB2393802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2412687) (HKLM\...\KB2412687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2419632) (HKLM\...\KB2419632) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2423089) (HKLM\...\KB2423089) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2440591) (HKLM\...\KB2440591) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2443105) (HKLM\...\KB2443105) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2476490) (HKLM\...\KB2476490) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478960) (HKLM\...\KB2478960) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478971) (HKLM\...\KB2478971) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2479943) (HKLM\...\KB2479943) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2481109) (HKLM\...\KB2481109) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2483185) (HKLM\...\KB2483185) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2485663) (HKLM\...\KB2485663) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2506212) (HKLM\...\KB2506212) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507618) (HKLM\...\KB2507618) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507938) (HKLM\...\KB2507938) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2508429) (HKLM\...\KB2508429) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2509553) (HKLM\...\KB2509553) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2510581) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB2535512) (HKLM\...\KB2535512) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2536276-v2) (HKLM\...\KB2536276-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2544893-v2) (HKLM\...\KB2544893-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2566454) (HKLM\...\KB2566454) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570222) (HKLM\...\KB2570222) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570947) (HKLM\...\KB2570947) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2584146) (HKLM\...\KB2584146) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2585542) (HKLM\...\KB2585542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2592799) (HKLM\...\KB2592799) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2598479) (HKLM\...\KB2598479) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2603381) (HKLM\...\KB2603381) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2618451) (HKLM\...\KB2618451) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2619339) (HKLM\...\KB2619339) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2620712) (HKLM\...\KB2620712) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2621440) (HKLM\...\KB2621440) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2624667) (HKLM\...\KB2624667) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2631813) (HKLM\...\KB2631813) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2633171) (HKLM\...\KB2633171) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2641653) (HKLM\...\KB2641653) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2646524) (HKLM\...\KB2646524) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2647518) (HKLM\...\KB2647518) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2653956) (HKLM\...\KB2653956) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2655992) (HKLM\...\KB2655992) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2659262) (HKLM\...\KB2659262) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2660465) (HKLM\...\KB2660465) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2661637) (HKLM\...\KB2661637) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2676562) (HKLM\...\KB2676562) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2685939) (HKLM\...\KB2685939) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2686509) (HKLM\...\KB2686509) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2691442) (HKLM\...\KB2691442) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2695962) (HKLM\...\KB2695962) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2698365) (HKLM\...\KB2698365) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2705219) (HKLM\...\KB2705219) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2707511) (HKLM\...\KB2707511) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2709162) (HKLM\...\KB2709162) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2712808) (HKLM\...\KB2712808) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2718523) (HKLM\...\KB2718523) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2719985) (HKLM\...\KB2719985) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2723135) (HKLM\...\KB2723135) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2724197) (HKLM\...\KB2724197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2727528) (HKLM\...\KB2727528) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2731847) (HKLM\...\KB2731847) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2753842-v2) (HKLM\...\KB2753842-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2757638) (HKLM\...\KB2757638) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2758857) (HKLM\...\KB2758857) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2761226) (HKLM\...\KB2761226) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2770660) (HKLM\...\KB2770660) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2778344) (HKLM\...\KB2778344) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2779030) (HKLM\...\KB2779030) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2780091) (HKLM\...\KB2780091) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2799494) (HKLM\...\KB2799494) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2802968) (HKLM\...\KB2802968) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2807986) (HKLM\...\KB2807986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2808735) (HKLM\...\KB2808735) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813170) (HKLM\...\KB2813170) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813345) (HKLM\...\KB2813345) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820197) (HKLM\...\KB2820197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820917) (HKLM\...\KB2820917) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2829361) (HKLM\...\KB2829361) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2834886) (HKLM\...\KB2834886) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2839229) (HKLM\...\KB2839229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2845187) (HKLM\...\KB2845187) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2847311) (HKLM\...\KB2847311) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2849470) (HKLM\...\KB2849470) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850851) (HKLM\...\KB2850851) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850869) (HKLM\...\KB2850869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2859537) (HKLM\...\KB2859537) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862152) (HKLM\...\KB2862152) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862330) (HKLM\...\KB2862330) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862335) (HKLM\...\KB2862335) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2864063) (HKLM\...\KB2864063) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868038) (HKLM\...\KB2868038) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868626) (HKLM\...\KB2868626) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876217) (HKLM\...\KB2876217) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876315) (HKLM\...\KB2876315) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876331) (HKLM\...\KB2876331) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2883150) (HKLM\...\KB2883150) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2892075) (HKLM\...\KB2892075) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893294) (HKLM\...\KB2893294) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893984) (HKLM\...\KB2893984) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2898715) (HKLM\...\KB2898715) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2900986) (HKLM\...\KB2900986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2914368) (HKLM\...\KB2914368) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2916036) (HKLM\...\KB2916036) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2922229) (HKLM\...\KB2922229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2929961) (HKLM\...\KB2929961) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2930275) (HKLM\...\KB2930275) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923789) (HKLM\...\KB923789) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB941569) (HKLM\...\KB941569) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB946648) (HKLM\...\KB946648) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB954459) (HKLM\...\KB954459) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956744) (HKLM\...\KB956744) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956802) (HKLM\...\KB956802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB958644) (HKLM\...\KB958644) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB961501) (HKLM\...\KB961501) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975713) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978601) (HKLM\...\KB978601) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979687) (HKLM\...\KB979687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981322) (HKLM\...\KB981322) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981997) (HKLM\...\KB981997) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982132) (HKLM\...\KB982132) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982665) (HKLM\...\KB982665) (Version: 1 - Microsoft Corporation)
Aggiornamento della sicurezza per Microsoft Windows (KB2564958) (HKLM\...\KB2564958) (Version:  - Microsoft Corporation)
Aggiornamento per Windows XP (KB2345886) (HKLM\...\KB2345886) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2641690) (HKLM\...\KB2641690) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2661254-v2) (HKLM\...\KB2661254-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2718704) (HKLM\...\KB2718704) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2736233) (HKLM\...\KB2736233) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2749655) (HKLM\...\KB2749655) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2863058) (HKLM\...\KB2863058) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2904266) (HKLM\...\KB2904266) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2934207) (HKLM\...\KB2934207) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB898461) (HKLM\...\KB898461) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB951978) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento per Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB971029) (HKLM\...\KB971029) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973687) (HKLM\...\KB973687) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows Media Player 11  (KB939683) (HKLM\...\KB939683) (Version:  - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2633952) (HKLM\...\KB2633952) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2756822) (HKLM\...\KB2756822) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2779562) (HKLM\...\KB2779562) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Canon CanoScan Toolbox 4.9 (HKLM\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version:  - )
Canon ScanGear Starter (HKLM\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version:  - )
D-Link DSL-200 ADSL Modem (HKLM\...\D-Link DSL-200 ADSL Modem) (Version:  - )
EPSON PhotoQuicker3.5 (HKLM\...\{65F5B7AF-3363-11D7-BB6B-00018021113F}) (Version:  - )
EPSON Web-To-Page (HKLM\...\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}) (Version:  - )
ESC86 Guida di riferimento (HKLM\...\ESC86 Guida di riferimento) (Version:  - )
ESC86 Guida software (HKLM\...\ESC86 Guida software) (Version:  - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Manual CanoScan LiDE 25 (HKLM\...\{838BC0FB-4F8F-47B9-847F-06AE4CCE4181}) (Version:  - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 43.0.2 (x86 it) (HKLM\...\Mozilla Firefox 43.0.2 (x86 it)) (Version: 43.0.2 - Mozilla)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.17 - Realtek Semiconductor Corp.)
Samsung Universal Print Driver (HKLM\...\Samsung Universal Print Driver) (Version: 2.03.01.00:36 - Samsung Electronics Co., Ltd.)
ScanToWeb (HKLM\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version:  - )
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 7.8 (HKLM\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Software per stampante EPSON (HKLM\...\EPSON Printer and Utilities) (Version:  - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.9.0040.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job => C:\WINDOWS\system32\xp_eos.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2012-02-22 18:51 - 2011-04-11 06:26 - 00024064 _____ () C:\WINDOWS\system32\spd__l.dll
2012-02-25 09:33 - 2004-11-26 05:05 - 00286720 ____N () C:\Program Files\D-Link\DSL-200\DbgMode.dll
2012-02-25 09:33 - 2004-11-26 05:05 - 00016384 ____N () C:\Program Files\D-Link\DSL-200\dslagent.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.

IE trusted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\samsungsetup.com -> hxxp://www.samsungsetup.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
DNS Servers: 212.52.97.15 - 193.70.152.15
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BingSvc => C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\BingSvc\BingSvc.exe
MSCONFIG\startupreg: GrooveMonitor => "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: MSMSGS => "C:\Programmi\Messenger\msmsgs.exe" /background
MSCONFIG\startupreg: SDTray => "C:\Programmi\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Programmi\Skype\Phone\Skype.exe" /minimized /regrun

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\GROOVE.EXE] => Enabled:Microsoft Office Groove
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\ONENOTE.EXE] => Enabled:Microsoft Office OneNote
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\SUPDSvc2.exe] => Enabled:Samsung UPD Service2
StandardProfile\AuthorizedApplications: [C:\Programmi\AVG\AVG2013\avgmfapx.exe] => Enabled:AVG Installer
StandardProfile\AuthorizedApplications: [C:\Programmi\Skype\Phone\Skype.exe] => Enabled:Skype
StandardProfile\AuthorizedApplications: [C:\Programmi\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Programmi\Mozilla Firefox)
StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22004
StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22005
StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22001
StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22002

==================== Restore Points =========================

25-11-2015 10:56:06 Punto di arresto del sistema
25-11-2015 11:24:14 Installato EPSON PhotoQuicker3.5
25-11-2015 11:24:46 Installed ScanToWeb
25-11-2015 11:25:08 Installato EPSON Web-To-Page
04-12-2015 19:36:51 Software Distribution Service 3.0
10-12-2015 18:42:33 Software Distribution Service 3.0
15-12-2015 19:17:28 Software Distribution Service 3.0
29-12-2015 11:54:14 Punto di arresto del sistema
30-12-2015 09:08:14 Software Distribution Service 3.0
31-12-2015 13:01:47 Punto di arresto del sistema
02-01-2016 12:25:03 Punto di arresto del sistema
02-01-2016 17:40:05 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/03/2016 09:28:55 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Impossibile estrarre l'elenco principale di altri produttori dal file .cab di aggiornamento automatico in: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo di validità se verificato rispetto all'ora corrente del sistema o al timestamp sul file firmato.

Error: (01/03/2016 09:28:54 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Impossibile estrarre l'elenco principale di altri produttori dal file .cab di aggiornamento automatico in: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo di validità se verificato rispetto all'ora corrente del sistema o al timestamp sul file firmato.

Error: (01/02/2016 05:49:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, modulo che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, indirizzo errore 0x00021514.
Elaborazione evento specifico al supporto per [adwcleaner_5.027.exe!ws!] in corso

Error: (01/02/2016 05:49:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, modulo che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, indirizzo errore 0x00021514.
Elaborazione evento specifico al supporto per [adwcleaner_5.027.exe!ws!] in corso

Error: (01/02/2016 05:48:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (01/02/2016 10:46:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso

Error: (01/01/2016 07:12:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso

Error: (12/04/2015 07:26:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (12/04/2015 12:10:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.


System errors:
=============
Error: (01/03/2016 10:44:19 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Servizio Avira Real-Time Protection bloccato in partenza.

Error: (01/03/2016 10:30:29 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Spooler di stampa è terminato in modo imprevisto. Questo problema si è verificato 1 volta/e.  Le seguenti azioni di correzione saranno eseguite tra 60000 millisecondi: Riavvia il servizio.

Error: (01/03/2016 10:30:29 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/03/2016 09:26:01 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/02/2016 05:59:55 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.

Error: (01/02/2016 05:40:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (12/31/2015 06:21:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio Dnscache.

Error: (12/31/2015 05:05:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Servizio Gateway di livello applicazione. Questo evento si è già verificato 1 volta(e).

Error: (12/31/2015 05:05:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (12/31/2015 05:05:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Spooler di stampa è terminato in modo imprevisto. Questo problema si è verificato 1 volta/e.  Le seguenti azioni di correzione saranno eseguite tra 60000 millisecondi: Riavvia il servizio.


==================== Memory info =========================== 

Processor: AMD Sempron(tm) Processor 3200+
Percentage of memory in use: 94%
Total physical RAM: 446.48 MB
Available physical RAM: 22.39 MB
Total Virtual: 1101.7 MB
Available Virtual: 180.72 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:58.59 GB) (Free:16.99 GB) NTFS ==>[drive with boot components (Windows XP)]
Drive d: () (Fixed) (Total:15.93 GB) (Free:10.67 GB) NTFS
Drive g: (Sony_16GP) (Removable) (Total:15.09 GB) (Free:1.78 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 74.5 GB) (Disk ID: 39B439B3)
Partition 1: (Active) - (Size=58.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=15.9 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15.1 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15.1 GB) - (Type=0C)

==================== End of Addition.txt ============================

M-K-D-B · 03.01.2016, 20:13

Servus,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die Endbenutzer-Lizenz.
Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls etwas schief geht.
Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es eine Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Lions · 04.01.2016, 15:53

Hallo Matthias,

ich habe das Combofix laufen lassen. Bis zum Installieren der Wiederherstellungskonsole war alles gut.
Dann war geschrieben: Der Scan dauert normalerweise weniger als 10 Minuten
Als sich nach 1 Stunde nichts getan hat habe ich es ueber Nacht laufen lassen.
Am Morgen habe ich den genau gleichen Bildschirm ohne Veraenderung vorgefunden.

Ich habe vor dem Scan die Internet-Verbindung beendet. War das in Ordnug ? Oder braucht Combofix eine Internetverbindung ?

Kann ich irgendwie sehen, ob Combofix noch korrekt laueft bzw den Fortschritt sehen ?

Danke fuer deine Hilfe !
Lions

Direkr nach dem Download der Wiederherstellungskonsole sagt ComboFix:
cure(7) could not connect to host
impossible to find c:/ComboFix/nvidia.zip

Kann es was damit zu tun haben, dass es nicht laueft ?

M-K-D-B · 04.01.2016, 22:57

Servus,

ja, gut möglich.

Lass mal ComboFix weg, wir nehmen stattdessen MBAR:

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Lions · 05.01.2016, 10:43

Das MBAR hat sofort funktioniert.

Hier ist das Log-File:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2016.01.04.06
  rootkit: v2015.12.26.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Angelo :: ANGELO-84DCAD4D [administrator]

05/01/2016 0.04.20
mbar-log-2016-01-05 (00-04-20).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 335629
Time elapsed: 44 minute(s), 59 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

M-K-D-B · 05.01.2016, 14:41

Servus,

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von JRT,
die beiden neuen Logdateien von FRST.

Lions · 05.01.2016, 21:08

Hallo Mathias,

hat alles funktioniert ! Hier die Log-Files:
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v5.028 - Bericht erstellt am 05/01/2016 um 16:48:44
# Aktualisiert am 04/01/2016 von Xplode
# Datenbank : 2016-01-04.2 [Server]
# Betriebssystem : Microsoft Windows XP Service Pack 3 (x86)
# Benutzername : Angelo - ANGELO-84DCAD4D
# Gestartet von : C:\Documents and Settings\Angelo\Desktop\AdwCleaner_5.028.exe
# Option : Suchlauf
# Unterstützung : hxxp://toolslib.net/forum

***** [ Dienste ] *****


***** [ Ordner ] *****


***** [ Dateien ] *****


***** [ DLL ] *****


***** [ Verknüpfungen ] *****


***** [ Aufgabenplanung ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****


########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [663 Bytes] ##########

--- --- ---

[/CODE]

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 05/01/2016
Scan Time: 16.57.50
Logfile: mbam.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.01.05.04
Rootkit Database: v2015.12.26.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: Angelo

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 335853
Time Elapsed: 1 hr, 1 min, 38 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Microsoft Windows XP x86 
Ran by Angelo (Administrator) on 05/01/2016 at 20.53.26,45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0 




Registry: 0 





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05/01/2016 at 20.54.53,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:31-12-2015
Ran by Angelo (administrator) on ANGELO-84DCAD4D (05-01-2016 20:56:45)
Running from C:\Documents and Settings\Angelo\Desktop
Loaded Profiles: Angelo &  (Available Profiles: Angelo & Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: Italiano (Italia)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Programmi\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Mozilla Corporation) C:\Programmi\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SoundMan] => C:\WINDOWS\SOUNDMAN.EXE [90112 2005-09-22] (Realtek Semiconductor Corp.)
HKLM\...\Run: [DSLSTATEXE] => C:\Program Files\D-Link\DSL-200\dslstat.exe [356352 2004-11-26] (GlobespanVirata, Inc.)
HKLM\...\Run: [DSLAGENTEXE] => C:\Program Files\D-Link\DSL-200\dslagent.exe [16384 2004-11-26] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Programmi\File comuni\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Programmi\Avira\AntiVir Desktop\avgnt.exe [704512 2015-12-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [EPSON Stylus C86 Series] => C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE [99840 2003-11-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DWQueuedReporting] => C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\MountPoints2: {60a3c3b2-6911-11e1-8379-001195300101} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {60a3c3b2-6911-11e1-8379-001195300101} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Programmi\File comuni\Microsoft Shared\DW\DWTRIG20.EXE [434080 2011-07-27] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32
HKU\S-1-5-18\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: Hosts file not detected in the default directory
Tcpip\..\Interfaces\{0FA1BD90-F3B2-4A5B-88D2-DD3318DB1FBF}: [NameServer] 212.52.97.15 193.70.152.15

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q=
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.it/
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.it/
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q={searchTerms}&src=IE-SearchBox
BHO: Adobe PDF Reader -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Programmi\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Programmi\Java\jre6\bin\jp2ssv.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2013-09-09] (Sun Microsystems, Inc.)
BHO: EpsonToolBandKicker Class -> {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} -> C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKLM - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2004-02-10] (SEIKO EPSON CORPORATION)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programmi\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll [2013-09-25] (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programmi\File comuni\System\Ole DB\MSDAIPP.DLL [2009-02-26] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Angelo\Dati applicazioni\Mozilla\Firefox\Profiles\6etgdb37.default
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: hxxp://www.msn.com/?pc=SKY2&ocid=SKY2DHP&osmkt=it-it
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Programmi\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Programmi\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programmi\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programmi\Java\jre6\lib\deploy\jqs\ff [2013-09-09] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-20] [not signed]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-02]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Programmi\Avira\AntiVir Desktop\sched.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programmi\Avira\AntiVir Desktop\avguard.exe [432888 2015-12-30] (Avira Operations GmbH & Co. KG)
S2 JavaQuickStarterService; C:\Programmi\Java\jre6\bin\jqs.exe [153376 2013-09-09] (Sun Microsystems, Inc.)
S2 MBAMService; C:\Programmi\Malwarebytes Anti-Malware2\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 Microsoft Office Groove Audit Service; C:\Programmi\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
S3 odserv; C:\Programmi\File comuni\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programmi\File comuni\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 Samsung UPD Service2; C:\WINDOWS\system32\SUPDSvc2.exe [136784 2011-12-02] (Samsung Electronics)
S2 SkypeUpdate; C:\Programmi\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
S3 WMPNetworkSvc; C:\Programmi\Windows Media Player\WMPNetwk.exe [918528 2006-11-02] (Microsoft Corporation)
S2 Skype C2C Service; "C:\Documents and Settings\All Users\Dati applicazioni\Skype\Toolbars\Skype C2C Service\c2c_service.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3727680 2005-09-22] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [105864 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2015-12-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2014-11-27] (Avira Operations GmbH & Co. KG)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R0 nvata; C:\WINDOWS\System32\DRIVERS\nvata.sys [98432 2005-08-13] (NVIDIA Corporation)
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [34048 2005-07-30] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [12928 2005-07-30] (NVIDIA Corporation)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2014-11-27] (Avira GmbH)
R3 wanusb; C:\WINDOWS\System32\DRIVERS\gwausb.sys [150369 2004-11-26] (GlobespanVirata Inc.) [File not signed]
S4 IntelIde; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-05 20:54 - 2016-01-05 20:55 - 00000553 _____ C:\Documents and Settings\Angelo\Desktop\JRT.txt
2016-01-05 20:49 - 2016-01-05 20:50 - 00001061 _____ C:\Documents and Settings\Angelo\Desktop\mbam.txt
2016-01-05 16:53 - 2016-01-05 16:53 - 00000744 _____ C:\Documents and Settings\Angelo\Desktop\AdwCleaner[S2].txt
2016-01-05 16:12 - 2016-01-05 16:13 - 01749504 _____ C:\Documents and Settings\Angelo\Desktop\AdwCleaner_5.028.exe
2016-01-05 00:51 - 2016-01-05 00:51 - 00002154 _____ C:\Documents and Settings\Angelo\Desktop\mbar-log-2016-01-05 (00-04-20).txt
2016-01-05 00:02 - 2016-01-05 00:52 - 00000000 ____D C:\Documents and Settings\All Users\Dati applicazioni\Malwarebytes' Anti-Malware (portable)
2016-01-04 23:57 - 2016-01-05 00:53 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\mbar
2016-01-04 23:52 - 2016-01-04 23:55 - 16563352 _____ (Malwarebytes Corp.) C:\Documents and Settings\Angelo\Desktop\mbar-1.09.3.1001.exe
2016-01-04 15:56 - 2016-01-04 15:56 - 00000000 _RSHD C:\cmdcons
2016-01-04 15:54 - 2016-01-04 15:58 - 00000000 ___SD C:\ComboFix
2016-01-03 23:52 - 2016-01-04 13:08 - 00000327 _____ C:\Boot.bak
2016-01-03 23:52 - 2004-08-03 23:00 - 00261312 __RSH C:\cmldr
2016-01-03 23:48 - 2016-01-03 23:48 - 00000000 ___RD C:\Documents and Settings\Angelo\Menu Avvio\Programmi\Strumenti di amministrazione
2016-01-03 23:48 - 2016-01-03 23:48 - 00000000 ____D C:\Qoobox
2016-01-03 23:48 - 2011-06-26 07:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2016-01-03 23:48 - 2010-11-07 18:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2016-01-03 23:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2016-01-03 23:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2016-01-03 23:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2016-01-03 23:48 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2016-01-03 23:48 - 2000-08-31 01:00 - 00098816 _____ C:\WINDOWS\sed.exe
2016-01-03 23:48 - 2000-08-31 01:00 - 00080412 _____ C:\WINDOWS\grep.exe
2016-01-03 23:48 - 2000-08-31 01:00 - 00068096 _____ C:\WINDOWS\zip.exe
2016-01-03 23:47 - 2016-01-03 23:47 - 00000000 ____D C:\WINDOWS\erdnt
2016-01-03 21:56 - 2016-01-03 21:58 - 05643309 ____R (Swearware) C:\Documents and Settings\Angelo\Desktop\ComboFix.exe
2016-01-03 11:05 - 2016-01-03 11:16 - 00046207 _____ C:\Documents and Settings\Angelo\Desktop\Addition.txt
2016-01-03 11:00 - 2016-01-05 20:57 - 00016253 _____ C:\Documents and Settings\Angelo\Desktop\FRST.txt
2016-01-03 10:30 - 2016-01-03 10:33 - 00000958 _____ C:\Documents and Settings\Angelo\Desktop\Fixlog.txt
2016-01-02 17:54 - 2016-01-02 17:54 - 00000000 ____D C:\Programmi\Malwarebytes Anti-Malware2
2016-01-02 17:37 - 2016-01-02 17:37 - 01599336 _____ (Malwarebytes) C:\Documents and Settings\Angelo\Desktop\JRT.exe
2016-01-02 11:20 - 2016-01-05 20:56 - 00000000 ____D C:\FRST
2016-01-02 11:03 - 2016-01-02 11:04 - 01721856 _____ (Farbar) C:\Documents and Settings\Angelo\Desktop\FRST.exe
2015-12-31 16:49 - 2016-01-05 16:48 - 00000000 ____D C:\AdwCleaner
2015-12-30 09:12 - 2015-12-30 09:22 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-28 16:43 - 2016-01-05 14:22 - 00000000 ____D C:\Programmi\Mozilla Firefox
2015-12-25 20:27 - 2015-12-25 20:27 - 00725504 _____ C:\Documents and Settings\Angelo\auguri2[1].ppt
2015-12-17 17:39 - 2015-12-25 19:52 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-17
2015-12-15 19:23 - 2015-12-15 19:23 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$
2015-12-11 16:56 - 2015-12-29 00:11 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\2015-12-11
2015-12-11 16:55 - 2016-01-05 15:55 - 00000224 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job
2015-12-11 16:55 - 2015-12-15 18:08 - 00000218 _____ C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2934207$
2015-12-10 19:06 - 2015-12-10 19:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$
2015-12-10 19:03 - 2015-12-10 19:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$
2015-12-10 19:01 - 2015-12-10 19:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$
2015-12-10 19:00 - 2015-12-10 19:00 - 00000000 ____D C:\Programmi\File comuni\DESIGNER
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe
2015-12-10 18:23 - 2014-02-27 00:28 - 00013312 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-05 20:57 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Temp
2016-01-05 16:56 - 2014-12-24 12:18 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-05 16:17 - 2013-11-03 20:53 - 00000000 ____D C:\Documents and Settings\Angelo\Documenti\Download
2016-01-05 15:54 - 2006-01-01 04:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-05 14:39 - 2006-01-01 04:39 - 00032494 _____ C:\WINDOWS\SchedLgU.Txt
2016-01-05 14:38 - 2012-02-23 12:17 - 00000194 ___SH C:\Documents and Settings\Angelo\ntuser.ini
2016-01-05 14:38 - 2012-02-23 12:17 - 00000000 ____D C:\Documents and Settings\Angelo
2016-01-05 14:22 - 2006-01-01 02:19 - 00000000 ___RD C:\Programmi
2016-01-05 01:15 - 2012-02-23 12:26 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\Caterina
2016-01-05 01:06 - 2012-02-23 12:17 - 00000000 ___RD C:\Documents and Settings\Angelo\Documenti
2016-01-05 00:02 - 2006-01-01 02:18 - 00000000 __RHD C:\Documents and Settings\All Users\Dati applicazioni
2016-01-04 23:58 - 2014-12-24 12:17 - 00121560 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-01-04 15:56 - 2006-01-01 02:17 - 00000327 __RSH C:\boot.ini
2016-01-03 23:50 - 2006-01-01 02:18 - 00000000 ___HD C:\Documents and Settings\Default User
2016-01-03 23:48 - 2012-02-23 12:17 - 00000000 ___RD C:\Documents and Settings\Angelo\Menu Avvio\Programmi
2016-01-03 23:48 - 2006-01-01 02:14 - 00000000 ____D C:\WINDOWS
2016-01-03 23:11 - 2001-08-31 13:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2016-01-02 17:54 - 2014-12-24 12:18 - 00000756 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2016-01-02 17:54 - 2014-12-24 12:18 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\ Malwarebytes Anti-Malware 
2016-01-02 11:46 - 2012-02-23 12:19 - 00002511 _____ C:\Documents and Settings\Angelo\Desktop\Microsoft Office Word 2007.lnk
2016-01-02 10:42 - 2001-08-31 13:00 - 00000582 _____ C:\WINDOWS\win.ini
2016-01-02 10:42 - 2001-08-31 13:00 - 00000227 _____ C:\WINDOWS\system.ini
2015-12-30 16:19 - 2014-12-31 10:28 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-12-30 16:19 - 2014-12-31 10:28 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-12-29 00:42 - 2013-08-26 16:27 - 00796864 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-12-29 00:42 - 2013-08-26 16:27 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-12-29 00:35 - 2012-02-28 14:44 - 00000000 ____D C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Adobe
2015-12-25 20:02 - 2013-02-18 17:58 - 00000000 ____D C:\Documents and Settings\Angelo\Desktop\foto Irene
2015-12-17 17:47 - 2012-03-13 15:24 - 00036363 _____ C:\WINDOWS\CSTBox.INI
2015-12-15 19:24 - 2006-01-01 05:50 - 00000000 ____D C:\Documents and Settings\All Users\Dati applicazioni\Microsoft Help
2015-12-15 19:23 - 2006-01-01 02:19 - 00001393 _____ C:\WINDOWS\imsins.BAK
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 RSHDC C:\WINDOWS\system32\dllcache
2015-12-15 19:23 - 2006-01-01 02:14 - 00000000 ___HD C:\WINDOWS\inf
2015-12-11 16:54 - 2013-01-20 17:10 - 00000000 ____D C:\Programmi\Microsoft Silverlight
2015-12-11 16:54 - 2006-01-01 02:18 - 00267008 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-12-10 19:00 - 2006-01-01 02:19 - 00000000 ____D C:\Programmi\File comuni
2015-12-10 18:55 - 2006-01-01 02:19 - 01035664 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-10 18:55 - 2001-08-31 13:00 - 00482130 _____ C:\WINDOWS\system32\perfh010.dat
2015-12-10 18:55 - 2001-08-31 13:00 - 00080734 _____ C:\WINDOWS\system32\perfc010.dat
2015-12-10 18:47 - 2013-01-20 17:10 - 00000000 ____D C:\Documents and Settings\All Users\Menu Avvio\Programmi\Microsoft Silverlight
2015-12-10 18:18 - 2012-02-23 12:17 - 00000000 ___RD C:\Documents and Settings\Angelo\Documenti\Musica

==================== Files in the root of some directories =======

2012-07-17 13:46 - 2012-07-17 13:46 - 0000288 _____ () C:\Documents and Settings\Angelo\Dati applicazioni\.backup.dm
2012-08-12 12:50 - 2015-08-30 16:27 - 0037888 _____ () C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:
====================
C:\Documents and Settings\Administrator\Impostazioni locali\Temp\7z.dll
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\avgnt.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BingSvc.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcProcessor.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\BSvcUpdater.exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aaa_aih[1].exe
C:\Documents and Settings\Angelo\Impostazioni locali\Temp\mpam-aa9d147b.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-38a1ac41.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-3d7e978c.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-a4768524.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-da3379d1.exe
C:\Documents and Settings\NetworkService\Impostazioni locali\Temp\mpam-e9f1d2ad.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:31-12-2015
Ran by Angelo (2016-01-05 20:58:20)
Running from C:\Documents and Settings\Angelo\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) (2006-01-01 00:34:11)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21- Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
Angelo (S-1-5-21-  Administrator - Enabled) => %SystemDrive%\Documents and Settings\Angelo
Guest (S-1-5-21-  Limited - Disabled)
HelpAssistant (S-1-5-21-  Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat 5.0 (HKLM\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2544521) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 7 (KB2647516) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2510531) (HKLM\...\KB2510531-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2544521) (HKLM\...\KB2544521-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2647516) (HKLM\...\KB2647516-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2675157) (HKLM\...\KB2675157-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2699988) (HKLM\...\KB2699988-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2722913) (HKLM\...\KB2722913-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2744842) (HKLM\...\KB2744842-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2761465) (HKLM\...\KB2761465-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2792100) (HKLM\...\KB2792100-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2797052) (HKLM\...\KB2797052-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2799329) (HKLM\...\KB2799329-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2809289) (HKLM\...\KB2809289-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2817183) (HKLM\...\KB2817183-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2829530) (HKLM\...\KB2829530-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2838727) (HKLM\...\KB2838727-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2846071) (HKLM\...\KB2846071-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2847204) (HKLM\...\KB2847204-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2862772) (HKLM\...\KB2862772-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2870699) (HKLM\...\KB2870699-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2879017) (HKLM\...\KB2879017-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2888505) (HKLM\...\KB2888505-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Internet Explorer 8 (KB2898785) (HKLM\...\KB2898785-IE8) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2378111) (HKLM\...\KB2378111_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2834904) (HKLM\...\KB2834904_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB2834904-v2) (HKLM\...\KB2834904-v2_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB952069) (HKLM\...\KB952069_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB954155) (HKLM\...\KB954155_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB973540) (HKLM\...\KB973540_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB975558) (HKLM\...\KB975558_WM8) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player  (KB978695) (HKLM\...\KB978695_WM9) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows Media Player 11  (KB954154) (HKLM\...\KB954154_WM11) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2079403) (HKLM\...\KB2079403) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2115168) (HKLM\...\KB2115168) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2229593) (HKLM\...\KB2229593) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2296011) (HKLM\...\KB2296011) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2347290) (HKLM\...\KB2347290) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2360937) (HKLM\...\KB2360937) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2387149) (HKLM\...\KB2387149) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2393802) (HKLM\...\KB2393802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2412687) (HKLM\...\KB2412687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2419632) (HKLM\...\KB2419632) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2423089) (HKLM\...\KB2423089) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2440591) (HKLM\...\KB2440591) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2443105) (HKLM\...\KB2443105) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2476490) (HKLM\...\KB2476490) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478960) (HKLM\...\KB2478960) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2478971) (HKLM\...\KB2478971) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2479943) (HKLM\...\KB2479943) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2481109) (HKLM\...\KB2481109) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2483185) (HKLM\...\KB2483185) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2485663) (HKLM\...\KB2485663) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2506212) (HKLM\...\KB2506212) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507618) (HKLM\...\KB2507618) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2507938) (HKLM\...\KB2507938) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2508429) (HKLM\...\KB2508429) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2509553) (HKLM\...\KB2509553) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2510581) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB2535512) (HKLM\...\KB2535512) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2536276-v2) (HKLM\...\KB2536276-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2544893-v2) (HKLM\...\KB2544893-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2566454) (HKLM\...\KB2566454) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570222) (HKLM\...\KB2570222) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2570947) (HKLM\...\KB2570947) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2584146) (HKLM\...\KB2584146) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2585542) (HKLM\...\KB2585542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2592799) (HKLM\...\KB2592799) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2598479) (HKLM\...\KB2598479) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2603381) (HKLM\...\KB2603381) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2618451) (HKLM\...\KB2618451) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2619339) (HKLM\...\KB2619339) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2620712) (HKLM\...\KB2620712) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2621440) (HKLM\...\KB2621440) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2624667) (HKLM\...\KB2624667) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2631813) (HKLM\...\KB2631813) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2633171) (HKLM\...\KB2633171) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2641653) (HKLM\...\KB2641653) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2646524) (HKLM\...\KB2646524) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2647518) (HKLM\...\KB2647518) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2653956) (HKLM\...\KB2653956) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2655992) (HKLM\...\KB2655992) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2659262) (HKLM\...\KB2659262) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2660465) (HKLM\...\KB2660465) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2661637) (HKLM\...\KB2661637) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2676562) (HKLM\...\KB2676562) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2685939) (HKLM\...\KB2685939) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2686509) (HKLM\...\KB2686509) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2691442) (HKLM\...\KB2691442) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2695962) (HKLM\...\KB2695962) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2698365) (HKLM\...\KB2698365) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2705219) (HKLM\...\KB2705219) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2707511) (HKLM\...\KB2707511) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2709162) (HKLM\...\KB2709162) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2712808) (HKLM\...\KB2712808) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2718523) (HKLM\...\KB2718523) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2719985) (HKLM\...\KB2719985) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2723135) (HKLM\...\KB2723135) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2724197) (HKLM\...\KB2724197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2727528) (HKLM\...\KB2727528) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2731847) (HKLM\...\KB2731847) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2753842-v2) (HKLM\...\KB2753842-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2757638) (HKLM\...\KB2757638) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2758857) (HKLM\...\KB2758857) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2761226) (HKLM\...\KB2761226) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2770660) (HKLM\...\KB2770660) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2778344) (HKLM\...\KB2778344) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2779030) (HKLM\...\KB2779030) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2780091) (HKLM\...\KB2780091) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2799494) (HKLM\...\KB2799494) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2802968) (HKLM\...\KB2802968) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2807986) (HKLM\...\KB2807986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2808735) (HKLM\...\KB2808735) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813170) (HKLM\...\KB2813170) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2813345) (HKLM\...\KB2813345) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820197) (HKLM\...\KB2820197) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2820917) (HKLM\...\KB2820917) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2829361) (HKLM\...\KB2829361) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2834886) (HKLM\...\KB2834886) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2839229) (HKLM\...\KB2839229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2845187) (HKLM\...\KB2845187) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2847311) (HKLM\...\KB2847311) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2849470) (HKLM\...\KB2849470) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850851) (HKLM\...\KB2850851) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2850869) (HKLM\...\KB2850869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2859537) (HKLM\...\KB2859537) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862152) (HKLM\...\KB2862152) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862330) (HKLM\...\KB2862330) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2862335) (HKLM\...\KB2862335) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2864063) (HKLM\...\KB2864063) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868038) (HKLM\...\KB2868038) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2868626) (HKLM\...\KB2868626) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876217) (HKLM\...\KB2876217) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876315) (HKLM\...\KB2876315) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2876331) (HKLM\...\KB2876331) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2883150) (HKLM\...\KB2883150) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2892075) (HKLM\...\KB2892075) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893294) (HKLM\...\KB2893294) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2893984) (HKLM\...\KB2893984) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2898715) (HKLM\...\KB2898715) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2900986) (HKLM\...\KB2900986) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2914368) (HKLM\...\KB2914368) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2916036) (HKLM\...\KB2916036) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2922229) (HKLM\...\KB2922229) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2929961) (HKLM\...\KB2929961) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB2930275) (HKLM\...\KB2930275) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923561) (HKLM\...\KB923561) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB923789) (HKLM\...\KB923789) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB941569) (HKLM\...\KB941569) (Version:  - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB946648) (HKLM\...\KB946648) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950762) (HKLM\...\KB950762) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB950974) (HKLM\...\KB950974) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB951376-v2) (HKLM\...\KB951376-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952004) (HKLM\...\KB952004) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB952954) (HKLM\...\KB952954) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB954459) (HKLM\...\KB954459) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956572) (HKLM\...\KB956572) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956744) (HKLM\...\KB956744) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956802) (HKLM\...\KB956802) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB956844) (HKLM\...\KB956844) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB958644) (HKLM\...\KB958644) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB959426) (HKLM\...\KB959426) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960803) (HKLM\...\KB960803) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB960859) (HKLM\...\KB960859) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB961501) (HKLM\...\KB961501) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB969059) (HKLM\...\KB969059) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB970430) (HKLM\...\KB970430) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB971657) (HKLM\...\KB971657) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB972270) (HKLM\...\KB972270) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973507) (HKLM\...\KB973507) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973869) (HKLM\...\KB973869) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB973904) (HKLM\...\KB973904) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974112) (HKLM\...\KB974112) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974318) (HKLM\...\KB974318) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974392) (HKLM\...\KB974392) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB974571) (HKLM\...\KB974571) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975025) (HKLM\...\KB975025) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975467) (HKLM\...\KB975467) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975560) (HKLM\...\KB975560) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB975713) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento della protezione per Windows XP (KB977816) (HKLM\...\KB977816) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB977914) (HKLM\...\KB977914) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978338) (HKLM\...\KB978338) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978542) (HKLM\...\KB978542) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978601) (HKLM\...\KB978601) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB978706) (HKLM\...\KB978706) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979309) (HKLM\...\KB979309) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979482) (HKLM\...\KB979482) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB979687) (HKLM\...\KB979687) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981322) (HKLM\...\KB981322) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB981997) (HKLM\...\KB981997) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982132) (HKLM\...\KB982132) (Version: 1 - Microsoft Corporation)
Aggiornamento della protezione per Windows XP (KB982665) (HKLM\...\KB982665) (Version: 1 - Microsoft Corporation)
Aggiornamento della sicurezza per Microsoft Windows (KB2564958) (HKLM\...\KB2564958) (Version:  - Microsoft Corporation)
Aggiornamento per Windows XP (KB2345886) (HKLM\...\KB2345886) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2641690) (HKLM\...\KB2641690) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2661254-v2) (HKLM\...\KB2661254-v2) (Version: 2 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2718704) (HKLM\...\KB2718704) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2736233) (HKLM\...\KB2736233) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2749655) (HKLM\...\KB2749655) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2863058) (HKLM\...\KB2863058) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2904266) (HKLM\...\KB2904266) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB2934207) (HKLM\...\KB2934207) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB898461) (HKLM\...\KB898461) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB951978) (Version: 1 - Microsoft Corporation) Hidden
Aggiornamento per Windows XP (KB955759) (HKLM\...\KB955759) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB968389) (HKLM\...\KB968389) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB971029) (HKLM\...\KB971029) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973687) (HKLM\...\KB973687) (Version: 1 - Microsoft Corporation)
Aggiornamento per Windows XP (KB973815) (HKLM\...\KB973815) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows Media Player 11  (KB939683) (HKLM\...\KB939683) (Version:  - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2633952) (HKLM\...\KB2633952) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2756822) (HKLM\...\KB2756822) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB2779562) (HKLM\...\KB2779562) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB952287) (HKLM\...\KB952287) (Version: 1 - Microsoft Corporation)
Aggiornamento rapido per Windows XP (KB961118) (HKLM\...\KB961118) (Version: 1 - Microsoft Corporation)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Canon CanoScan Toolbox 4.9 (HKLM\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version:  - )
Canon ScanGear Starter (HKLM\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version:  - )
D-Link DSL-200 ADSL Modem (HKLM\...\D-Link DSL-200 ADSL Modem) (Version:  - )
EPSON PhotoQuicker3.5 (HKLM\...\{65F5B7AF-3363-11D7-BB6B-00018021113F}) (Version:  - )
EPSON Web-To-Page (HKLM\...\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}) (Version:  - )
ESC86 Guida di riferimento (HKLM\...\ESC86 Guida di riferimento) (Version:  - )
ESC86 Guida software (HKLM\...\ESC86 Guida software) (Version:  - )
Java(TM) 6 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Manual CanoScan LiDE 25 (HKLM\...\{838BC0FB-4F8F-47B9-847F-06AE4CCE4181}) (Version:  - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 43.0.2 (x86 it) (HKLM\...\Mozilla Firefox 43.0.2 (x86 it)) (Version: 43.0.2 - Mozilla)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version:  - )
Realtek AC'97 Audio (HKLM\...\{FB08F381-6533-4108-B7DD-039E11FBC27E}) (Version: 5.17 - Realtek Semiconductor Corp.)
Samsung Universal Print Driver (HKLM\...\Samsung Universal Print Driver) (Version: 2.03.01.00:36 - Samsung Electronics Co., Ltd.)
ScanToWeb (HKLM\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version:  - )
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 7.8 (HKLM\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Software per stampante EPSON (HKLM\...\EPSON Printer and Utilities) (Version:  - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.9.0040.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Accesso.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Notifica di interruzione del servizio per Microsoft Windows XP - Mensile.job => C:\WINDOWS\system32\xp_eos.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2012-02-22 18:51 - 2011-04-11 06:26 - 00024064 _____ () C:\WINDOWS\system32\spd__l.dll
2012-02-22 16:58 - 2005-10-10 21:49 - 00466944 _____ () C:\WINDOWS\system32\nvshell.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.

IE trusted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\samsungsetup.com -> hxxp://www.samsungsetup.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.

IE trusted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\samsungsetup.com -> hxxp://www.samsungsetup.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\123simsen.com -> www.123simsen.com

There are 7822 more sites.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> (Nessuno)
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> (Nessuno)
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\Wallpaper1.bmp
DNS Servers: 212.52.97.15 - 193.70.152.15
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BingSvc => C:\Documents and Settings\Angelo\Impostazioni locali\Dati applicazioni\Microsoft\BingSvc\BingSvc.exe
MSCONFIG\startupreg: GrooveMonitor => "C:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: MSMSGS => "C:\Programmi\Messenger\msmsgs.exe" /background
MSCONFIG\startupreg: SDTray => "C:\Programmi\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Programmi\Skype\Phone\Skype.exe" /minimized /regrun

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\GROOVE.EXE] => Enabled:Microsoft Office Groove
StandardProfile\AuthorizedApplications: [C:\Programmi\Microsoft Office\Office12\ONENOTE.EXE] => Enabled:Microsoft Office OneNote
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\SUPDSvc2.exe] => Enabled:Samsung UPD Service2
StandardProfile\AuthorizedApplications: [C:\Programmi\AVG\AVG2013\avgmfapx.exe] => Enabled:AVG Installer
StandardProfile\AuthorizedApplications: [C:\Programmi\Skype\Phone\Skype.exe] => Enabled:Skype
StandardProfile\AuthorizedApplications: [C:\Programmi\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Programmi\Mozilla Firefox)
StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22004
StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22005
StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22001
StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22002

==================== Restore Points =========================

25-11-2015 10:56:06 Punto di arresto del sistema
25-11-2015 11:24:14 Installato EPSON PhotoQuicker3.5
25-11-2015 11:24:46 Installed ScanToWeb
25-11-2015 11:25:08 Installato EPSON Web-To-Page
04-12-2015 19:36:51 Software Distribution Service 3.0
10-12-2015 18:42:33 Software Distribution Service 3.0
15-12-2015 19:17:28 Software Distribution Service 3.0
29-12-2015 11:54:14 Punto di arresto del sistema
30-12-2015 09:08:14 Software Distribution Service 3.0
31-12-2015 13:01:47 Punto di arresto del sistema
02-01-2016 12:25:03 Punto di arresto del sistema
02-01-2016 17:40:05 JRT Pre-Junkware Removal
03-01-2016 20:57:51 Punto di arresto del sistema
03-01-2016 23:41:02 combofix
05-01-2016 11:32:34 Punto di arresto del sistema
05-01-2016 20:53:31 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/03/2016 10:11:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (01/03/2016 10:11:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (01/03/2016 10:11:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (01/03/2016 09:28:55 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Impossibile estrarre l'elenco principale di altri produttori dal file .cab di aggiornamento automatico in: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo di validità se verificato rispetto all'ora corrente del sistema o al timestamp sul file firmato.

Error: (01/03/2016 09:28:54 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Impossibile estrarre l'elenco principale di altri produttori dal file .cab di aggiornamento automatico in: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> a causa del seguente errore: Un certificato richiesto non rientra nel suo periodo di validità se verificato rispetto all'ora corrente del sistema o al timestamp sul file firmato.

Error: (01/02/2016 05:49:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, modulo che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, indirizzo errore 0x00021514.
Elaborazione evento specifico al supporto per [adwcleaner_5.027.exe!ws!] in corso

Error: (01/02/2016 05:49:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, modulo che ha provocato l'errore adwcleaner_5.027.exe, versione 5.0.2.7, indirizzo errore 0x00021514.
Elaborazione evento specifico al supporto per [adwcleaner_5.027.exe!ws!] in corso

Error: (01/02/2016 05:48:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Applicazione in stallo iexplore.exe, versione 8.0.6001.18702, modulo in stallo hungapp, versione 0.0.0.0, indirizzo stallo 0x00000000.

Error: (01/02/2016 10:46:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso

Error: (01/01/2016 07:12:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Applicazione che ha provocato l'errore plugin-container.exe, versione 43.0.2.5833, modulo che ha provocato l'errore mozglue.dll, versione 43.0.2.5833, indirizzo errore 0x0000ed36.
Elaborazione evento specifico al supporto per [plugin-container.exe!ws!] in corso


System errors:
=============
Error: (01/05/2016 08:53:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Scheda WMI Performance. Questo evento si è già verificato 1 volta(e).

Error: (01/05/2016 04:03:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/05/2016 03:57:01 PM) (Source: Windows Update Agent) (EventID: 16) (User: )
Description: Impossibile stabilire la connessione. Impossibile connettersi al servizio Aggiornamenti automatici e quindi scaricare e installare gli aggiornamenti in base alla pianificazione impostata. Verranno effettuati altri tentativi di stabilire una connessione.

Error: (01/05/2016 10:32:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/04/2016 08:27:28 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/04/2016 03:40:28 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Tentativo di eseguire un'azione di correzione (Riavvia il servizio) dopo la terminazione imprevista del servizio Strumentazione gestione Windows. Tentativo non riuscito per l'errore: 
%%1056

Error: (01/03/2016 10:57:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/03/2016 09:53:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Interruzione imprevista del servizio Java Quick Starter. Questo evento si è già verificato 1 volta(e).

Error: (01/03/2016 10:44:19 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Servizio Avira Real-Time Protection bloccato in partenza.

Error: (01/03/2016 10:30:29 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Il servizio Spooler di stampa è terminato in modo imprevisto. Questo problema si è verificato 1 volta/e.  Le seguenti azioni di correzione saranno eseguite tra 60000 millisecondi: Riavvia il servizio.


==================== Memory info =========================== 

Processor: AMD Sempron(tm) Processor 3200+
Percentage of memory in use: 91%
Total physical RAM: 446.48 MB
Available physical RAM: 37.16 MB
Total Virtual: 1111.3 MB
Available Virtual: 447.5 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:58.59 GB) (Free:19.09 GB) NTFS ==>[drive with boot components (Windows XP)]
Drive d: () (Fixed) (Total:15.93 GB) (Free:10.67 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 74.5 GB) (Disk ID: 39B439B3)
Partition 1: (Active) - (Size=58.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=15.9 GB) - (Type=OF Extended)

==================== End of Addition.txt ============================

Vielen Dank !!!
Lions

M-K-D-B · 06.01.2016, 11:09

Servus,

sieht schon gut aus.

wir entfernen die letzten Reste und kontrollieren nochmal alles.

Hinweis: Der Suchlauf mit ESET kann länger dauern.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
CloseProcesses:
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-1220945662-1647877149-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

Starte die HitmanPro.exe
Klicke auf
Entferne den Haken bei
Klicke auf
und
Akzeptiere die Lizenzbedingungen und klicke auf
Klicke auf

und auf
Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
und speichere die Logdatei auf Deinem Desktop.
Schließe HitmanPro und poste mir das Log.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei von HitmanPro,
die Logdatei von ESET,
die beiden neuen Logdateien von FRST,
die Beantwortung der gestellten Fragen.

Lions · 08.01.2016, 11:04

Servus Matthias,

entschldige bitte. es wird noch etwas dauern. Ich hoffe, daß ich alles am WE machen kann. Wenn nicht gebe ich dir nochmal Bescheid !

Danke !
Lions

System wird immer langsamer und Funde bei AVIRA

Plagegeister aller Art und deren Bekämpfung: System wird immer langsamer und Funde bei AVIRA