PROBLEMA Pagine pubblicitarie che si aprono da sole.

Malor · 25 Giugno 2014

Come si può capire dal titolo da un paio di giorni mi si aprono su chrome pagine pubblicitarie.
Ho visto che è un problema di molti ,ho scaricato anche malwarebytes spostato tutto in quarantena ma purtroppo le fastidiose pubblicità continuano ad aprirsi . Trovando questo forum ho seguito i vostri consigli scaricando OTL
i due risultati sono stati
OTL: OTL.Txt
Extras: Extras.Txt

Adesso purtroppo non so come continuare !
P.S. il problema non è solo di chrome , succede anche su explorer.

Lele1990 · 25 Giugno 2014

il log che hai postato non so analizzarli (attendi qualcuno piu esperto di me), nel frattempo scarica Adwcleaner da https://toolslib.net/downloads/finish/1/ chiudi tutti i browser che hai e avvialo premi su "scansiona", attendi la fine e infine premi "pulisci", alla richiesta di riavvio accetta.

Posta il relativo log e fammi sapere.

Malor · 25 Giugno 2014

Lele1990 ha detto:
il log che hai postato non so analizzarli (attendi qualcuno piu esperto di me), nel frattempo scarica Adwcleaner da https://toolslib.net/downloads/finish/1/ chiudi tutti i browser che hai e avvialo premi su "scansiona", attendi la fine e infine premi "pulisci", alla richiesta di riavvio accetta.

Posta il relativo log e fammi sapere.

# AdwCleaner v3.213 - Report created 25/06/2014 at 12:37:53
# Updated 23/06/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : marty_000 - MARTA-PC
# Running from : C:\Users\marty_000\Desktop\adwcleaner_3.213.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\globalUpdate
Folder Deleted : C:\Program Files (x86)\predm
Folder Deleted : C:\Program Files (x86)\SupTab
Folder Deleted : C:\Users\marty_000\AppData\Local\globalUpdate
Folder Deleted : C:\Users\marty_000\AppData\Local\pgcchelper
Folder Deleted : C:\Users\Public\Pokki
Folder Deleted : C:\Users\Public\Documents\Goobzo
Folder Deleted : C:\Users\Public\Documents\ShopperPro

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\pokki
Key Deleted : HKLM\SOFTWARE\Classes\speedupmypc
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455825592}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466826692}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440444824492}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550455825592}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660466826692}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Key Deleted : HKCU\Software\Goobzo
Key Deleted : HKCU\Software\TutoTag
Key Deleted : HKLM\Software\Free_soft_today
Key Deleted : HKLM\Software\Goobzo
Key Deleted : HKLM\Software\SupDp
Key Deleted : HKLM\Software\SupTab
Key Deleted : HKLM\Software\Uniblue
Key Deleted : HKLM\Software\Wpm
Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~1.DLL
Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~2.DLL
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DatamngrCoordinator.exe

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17126

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Setting Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Google Chrome v35.0.1916.153

[ File : C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [3295 octets] - [25/06/2014 12:37:04]
AdwCleaner[S0].txt - [2919 octets] - [25/06/2014 12:37:53]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2979 octets] ##########

Lele1990 · 25 Giugno 2014

hai risolto il problema?

Malor · 25 Giugno 2014

No, purtroppo continuano ad aprirsi pubblicità fastidiose chiedendomi se ho problemi di erezione

Lele1990 · 25 Giugno 2014

Malor ha detto:
No, purtroppo continuano ad aprirsi pubblicità fastidiose chiedendomi se ho problemi di erezione

fai queste scansioni :
- scarica http://dl.surfright.nl/HitmanPro_x64.exe avvialo e fai la scansione (importante durante la scansione DEVI avere la scansione attiva).
- scarica Norton Power Eraser http://liveupdate.symantec.com/upgrade/NPE/1040/NPE.exe avvialo e fai la scansione.

Se non lo hai gia scarica l'estensione Adblockplus per chrome da https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb?hl=it mentre per internet explorer https://adblockplus.org/en/internet-explorer.

Posta i relitivi log.

Malor · 25 Giugno 2014

Avevo già installato precedentemente Adblock
Comunque questo è quello che mi ha dato HitmanPRO

Codice:

HitmanPro 3.7.9.219
www.hitmanpro.com


   Computer name . . . . : MARTA-PC
   Windows . . . . . . . : 6.3.0.9600.X64/4
   User name . . . . . . : MARTA-PC\marty_000
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free


   Scan date . . . . . . : 2014-06-25 15:27:28
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 5m 40s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No


   Threats . . . . . . . : 0
   Traces  . . . . . . . : 12


   Objects scanned . . . : 1.406.058
   Files scanned . . . . : 34.627
   Remnants scanned  . . : 405.843 files / 965.588 keys


Cookies _____________________________________________________________________


   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.c-web.it
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zanox.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:adultfriendfinder.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:fuckbook.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:in.getclicky.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:ranaporno.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:soltantoporno.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:solutions.tradedoubler.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.fuckbook.com
   C:\Users\marty_000\AppData\Local\Google\Chrome\User Data\Default\Cookies:xiti.com

Lele1990 · 25 Giugno 2014

rimuovi cio che ha trovato e scarica Malwarebytes Malwarebytes: anti-Malware gratuito installalo mettilo in italiano (lo trovi in opzioni) poi vai su rilevamento e protezione e abilita la ricerca rootkit. Successivamente aggiornalo e fai una scansione completa, se per rimuovere le minacce ti chiede di riavviare fallo. Posta il report.

Malor · 25 Giugno 2014

Ho già scritto che malwarebytes l'ho già provato in precedenza , avevo spostato tutto in quarantena ma il problema continua.
Se faccio la scansione non da alcun problema

Lele1990 · 26 Giugno 2014

Hai usato anche il secondo programma che ti ho suggerito ovvero http://liveupdate.symantec.com/upgrade/NPE/1040/NPE.exe ? poi fai una scansione anche con http://www.bleepingcomputer.com/download/combof/dl/12/ DEVE essere scaricato da Internet Explorer. Prima di avviarlo disattiva la connessione, la protezione antivirus, chiudi tutte le applicazioni aperte, e infine disabilita il Ripristino Configurazione di Sistema.

Posta i due report.

Malor · 26 Giugno 2014

Ho disinstallato e installato nuovamente AdBlock ed il problema sembra essersi risolto , non capisco il perchè onestamente dato che avevo già fatto questo "lavoro".

tecnico24 · 26 Giugno 2014

@Malor
Le infezioni sono ancora attive.
Apri OTL e incolla questo codice
:otl
PRC - C:\Program Files (x86)\LSM\lsm.exe (MS)
PRC - C:\Program Files (x86)\LSM\aus.exe (MS)
SRV - (Log S.M.) -- C:\Program Files (x86)\LSM\lsm.exe (MS)
SRV - (AUS) -- C:\Program Files (x86)\LSM\aus.exe (MS)
[2014/06/19 08:11:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LSM
@alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:56E2E879

clicca Run fix ed aspetta il riavvio del pc senza interferire.
Al ritorno posta il log che ti appare e verifica.

Malor · 27 Giugno 2014

OTL : OTL.Txt
Extras : [URL=http://wikisend.com/download/123742/Extras.Txt]Extras.Txt[/URL]
Spero di aver fatto bene

biasion118 · 16 Dicembre 2014

ciao scusate anchi o da qualche giorno il problema che mi si aprono pagine pubblicitarie in continuazione, ho fatto scansione con adaware e OTL, posto log di OTL fatemi sapere sono disperato
OTL logfile created on: 16/12/2014 12:26:58 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\BIASION\Documents\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000410 | Country: Italia | Language: ITA | Date Format: dd/MM/yyyy

7,97 Gb Total Physical Memory | 5,34 Gb Available Physical Memory | 67,01% Memory free
15,94 Gb Paging File | 12,81 Gb Available in Paging File | 80,33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,62 Gb Total Space | 4,31 Gb Free Space | 7,22% Space Free | Partition Type: NTFS
Drive F: | 465,76 Gb Total Space | 344,62 Gb Free Space | 73,99% Space Free | Partition Type: NTFS

Computer Name: BIASION-PC | User Name: BIASION | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/12/16 12:26:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\BIASION\Documents\Downloads\OTL.exe
PRC - [2014/12/06 02:50:53 | 000,856,904 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2014/07/11 13:17:04 | 000,601,584 | ---- | M] () -- C:\Users\BIASION\AppData\Local\ContextTrue\nvhlpr.exe
PRC - [2014/07/11 13:17:04 | 000,601,584 | ---- | M] () -- C:\Users\BIASION\AppData\Local\ContextTrue\cnthlpr.exe
PRC - [2013/10/28 17:21:00 | 002,289,952 | ---- | M] (FSPro Labs) -- C:\Programmi\My Lockbox\mylbx.exe
PRC - [2012/10/01 22:19:12 | 008,356,008 | ---- | M] (AVM Software Inc.) -- C:\Program Files (x86)\Paltalk Messenger\paltalk.exe
PRC - [2012/06/03 20:25:46 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\NLSSRV32.EXE
PRC - [2011/11/03 09:29:04 | 004,657,048 | ---- | M] (Almico Software (Almico's Home Page)) -- C:\Program Files (x86)\SpeedFan\speedfan.exe
PRC - [2011/09/22 10:09:20 | 002,656,536 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011/09/22 10:09:18 | 000,325,912 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/09/30 22:26:54 | 000,393,216 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
PRC - [2006/11/03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
PRC - [2006/09/19 08:07:28 | 000,827,392 | ---- | M] () -- C:\Windows\vsnpstd3.exe

========== Modules (No Company Name) ==========

MOD - [2014/12/16 12:24:18 | 000,192,512 | ---- | M] () -- C:\Users\BIASION\AppData\Local\Temp\sfamcc00001.dll
MOD - [2014/12/16 12:24:18 | 000,172,032 | ---- | M] () -- C:\Users\BIASION\AppData\Local\Temp\sfareca00001.dll
MOD - [2014/12/06 02:50:50 | 009,009,480 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll
MOD - [2014/12/06 02:50:46 | 001,077,064 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll
MOD - [2014/12/06 02:50:45 | 000,211,272 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll
MOD - [2014/12/06 02:50:44 | 001,677,128 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll
MOD - [2014/07/11 13:17:04 | 000,601,584 | ---- | M] () -- C:\Users\BIASION\AppData\Local\ContextTrue\nvhlpr.exe
MOD - [2014/07/11 13:17:04 | 000,601,584 | ---- | M] () -- C:\Users\BIASION\AppData\Local\ContextTrue\cnthlpr.exe
MOD - [2012/10/01 22:19:16 | 001,842,832 | ---- | M] () -- C:\Program Files (x86)\Paltalk Messenger\Images.dll
MOD - [2012/10/01 22:19:16 | 000,050,832 | ---- | M] () -- C:\Program Files (x86)\Paltalk Messenger\ctrlkey.dll
MOD - [2011/03/16 23:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2010/09/30 22:26:26 | 000,094,208 | ---- | M] () -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraIta.dll
MOD - [2006/09/19 08:07:28 | 000,827,392 | ---- | M] () -- C:\Windows\vsnpstd3.exe

========== Services (SafeList) ==========

SRV:64bit: - [2014/02/25 08:44:14 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013/12/06 21:52:10 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/07/14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014/12/13 19:01:55 | 001,025,920 | ---- | M] (Enigma Software Group USA, LLC.) [Auto | Running] -- C:\Programmi\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service)
SRV - [2014/06/07 17:21:29 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/04/03 19:21:48 | 000,315,008 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/27 10:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programmi\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013/01/27 10:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programmi\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/12/19 09:49:34 | 000,732,648 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2012/07/17 14:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012/07/09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012/06/03 20:25:46 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\NLSSRV32.EXE -- (nlsX86cc)
SRV - [2011/09/22 10:09:20 | 002,656,536 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/09/22 10:09:18 | 000,325,912 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/01/09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programmi\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/12/13 19:02:02 | 000,022,704 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\EsgScanner.sys -- (EsgScanner)
DRV:64bit: - [2014/02/24 17:49:19 | 000,014,456 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\gfibto.sys -- (gfibto)
DRV:64bit: - [2013/12/06 22:52:14 | 013,207,552 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2013/12/06 22:52:14 | 013,207,552 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2013/12/06 21:21:44 | 000,626,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2013/09/24 15:53:50 | 000,094,208 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2013/03/18 16:51:08 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2013/01/20 14:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/10/17 13:53:46 | 000,026,112 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2012/06/04 21:42:54 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/09/29 16:30:34 | 000,646,248 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/09/22 10:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2011/09/21 09:25:54 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135)
DRV:64bit: - [2011/06/03 23:59:38 | 000,057,648 | ---- | M] (FSPro Labs) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\FSPFltd2.sys -- (FSProFilter2)
DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/10 14:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011/02/10 14:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/11/20 05:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 03:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 03:03:44 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010/11/20 02:43:58 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2007/03/27 17:18:58 | 010,550,272 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\snpstd3.sys -- (SNPSTD3)
DRV:64bit: - [2006/12/05 11:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV - [2011/01/06 11:06:56 | 000,011,888 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Setup Files\Ms7672vI70\NTIOLib_X64.sys -- (NTIOLib_1_0_6)
DRV - [2010/10/21 17:37:36 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys -- (NTIOLib_1_0_4)
DRV - [2010/05/09 17:44:40 | 000,033,592 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys -- (MSI_MSIBIOS_010507)
DRV - [2009/10/05 23:10:14 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\CLICKBIOSII\NTIOLib_X64.sys -- (NTIOLib_1_0_1)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google
IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\BIASION\Desktop\RICAMBI IN VENDITA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = it-IT
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google
IE - HKCU\..\SearchScopes,Backup.Old.DefaultScope = {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: faststartff%40gmail.com:4.3.0
FF - prefs.js..extensions.enabledAddons: %7B9223aa12-22a3-4ecb-98d8-e717501ae561%7D:1.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.40.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.40.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: File not found
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\BIASION\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/06/07 17:21:27 | 000,000,000 | ---D | M]

[2012/09/09 08:41:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\Extensions
[2012/07/31 10:17:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012/07/13 21:55:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\extensions
[2012/07/13 21:55:50 | 000,000,000 | ---D | M] (uTorrentBar_IT Community Toolbar) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\extensions\{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}
[2014/05/10 13:22:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\0\extensions
[2014/12/16 12:23:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\gpd5zl69.default\extensions
[2012/08/31 12:54:24 | 000,000,000 | ---D | M] (FT Evo) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\gpd5zl69.default\extensions\{5c8c1470-d247-11e0-9572-0800200c9a66}
[2014/05/25 18:26:26 | 000,000,000 | ---D | M] ("Yahoo Community Smartbar") -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\gpd5zl69.default\extensions\{9223aa12-22a3-4ecb-98d8-e717501ae561}
[2014/12/13 18:04:56 | 000,000,000 | ---D | M] (AS Magic Player) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\gpd5zl69.default\extensions\magicplayer@acestream.org
[2014/06/04 17:53:36 | 000,000,000 | ---D | M] ("Nuvola") -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\gpd5zl69.default\extensions\NuvolaFF@paenglab.ch
[2014/06/04 17:53:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\Firefox\Profiles\gpd5zl69.default\extensions\NuvolaFF@paenglab.ch\mozapps\extensions
[2013/03/14 17:28:54 | 000,005,958 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\4sharedCopyLinks.xpi.tmp
[2014/06/11 18:25:36 | 000,088,730 | R--- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\Noia4Options@ArisT2.xpi
[2014/06/11 18:25:33 | 000,084,390 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\NoiaButtons@ArisT2_Noia4dev.xpi
[2012/11/24 19:05:52 | 001,230,904 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\Office2007Black@JBBS.xpi
[2014/06/07 17:19:04 | 000,967,387 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/06/11 18:25:36 | 001,493,384 | R--- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\{faf13420-5e24-11e0-80e3-0800200c9a66}.xpi
[2014/06/04 17:53:33 | 000,000,066 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\NuvolaFF@paenglab.ch\mozapps\extensions\xpinstallConfirm.css
[2014/06/04 17:53:33 | 000,001,767 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\NuvolaFF@paenglab.ch\mozapps\xpinstall\xpinstallConfirm.css
[2014/06/04 17:53:33 | 000,002,214 | ---- | M] () (No name found) -- C:\Users\BIASION\AppData\Roaming\mozilla\firefox\profiles\gpd5zl69.default\extensions\NuvolaFF@paenglab.ch\mozapps\xpinstall\xpinstallItemGeneric.png
[2014/08/09 18:48:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014/06/07 17:21:30 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\USERS\BIASION\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GPD5ZL69.DEFAULT\EXTENSIONS\23FB8BB3-AC21-4230-BBFA-49B94968BC63@GMAIL.COM
File not found (No name found) -- C:\USERS\BIASION\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GPD5ZL69.DEFAULT\EXTENSIONS\B6E4F54065FF48DD97DB30CA@C9B45F807BF54A45A4669E51C.COM
File not found (No name found) -- C:\USERS\BIASION\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GPD5ZL69.DEFAULT\EXTENSIONS\FASTSTARTFF@GMAIL.COM
[2004/08/19 10:07:18 | 000,049,272 | ---- | M] (JavaSoft / Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\NPJava11.dll
[2004/08/19 10:07:18 | 000,053,368 | ---- | M] (JavaSoft / Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\NPJava12.dll
[2004/08/19 10:07:18 | 000,053,365 | ---- | M] (JavaSoft / Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\NPJava131_13.dll
[2004/08/19 10:07:18 | 000,049,272 | ---- | M] (JavaSoft / Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\NPJava32.dll
[2004/08/19 10:07:18 | 000,045,177 | ---- | M] (JavaSoft / Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npoji600.dll

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - plugin: Error reading preferences file
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.8_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahmilhmcinpmpohfoiccaplbhgelbnim\1.0.0_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.8.8_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.0_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\fndlhnanhedoklpdaacidomdnplcjcpj\2.6.4.3_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp\6.4.3_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.15_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpifmiaadiihnkolggaepacodfmgceki\1.3_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\4.4.0_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncdfeghkpohnalmpblddmnppfooljekh\1.7.3_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\okanipcmceoeemlbjnmnbdibhgpbllgc\2.2.2_0\
CHR - Extension: No name found = C:\Users\BIASION\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2014/12/14 12:48:24 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programmi\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programmi\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2:64bit: - BHO: (Adblock Plus for IE Browser Helper Object) - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Programmi\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
O2 - BHO: (IE7Pro BHO) - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files (x86)\IEPro\iepro.dll (IE7Pro.com)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Adblock Plus for IE Browser Helper Object) - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Programmi\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
O3:64bit: - HKLM\..\Toolbar: (no name) - !{47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {96A25A24-2E87-4374-8A50-CC6F943FCE4D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe (FSPro Labs)
O4:64bit: - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [cnthlpr] C:\Users\BIASION\AppData\Local\ContextTrue\cnthlpr.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O4 - HKCU..\Run: [nvhlpr] C:\Users\BIASION\AppData\Local\ContextTrue\nvhlpr.exe ()
O4 - Startup: C:\Users\BIASION\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PalTalk.lnk = C:\Program Files (x86)\Paltalk Messenger\paltalk.exe (AVM Software Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O9:64bit: - Extra Button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programmi\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: &Note collegate di OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programmi\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : &Note collegate di OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programmi\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
O9 - Extra Button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files (x86)\IEPro\iepro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files (x86)\IEPro\iepro.dll (IE7Pro.com)
O9 - Extra Button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files (x86)\IEPro\iepro.dll (IE7Pro.com)
O9 - Extra 'Tools' menuitem : IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files (x86)\IEPro\iepro.dll (IE7Pro.com)
O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files (x86)\Paltalk Messenger\Paltalk.exe (AVM Software Inc.)
O9 - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programmi\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O15 - HKCU\..Trusted Domains: milanofinanza.it ([www] https in Siti attendibili)
O15 - HKCU\..Trusted Domains: poste.it ([postepay] https in Siti attendibili)
O16:64bit: - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} http://download.easetuner.com/download/SOPCORE.CAB (Reg Error: Key error.)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-1_3_1_13-windows-i586.cab (Java Plug-in 1.3.1_13)
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} Reg Error: Value error. (SopCore Control)
O16 - DPF: {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_3_1_13-windows-i586.cab (Java Plug-in 1.3.1_13)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 10.40.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{069F0E78-362F-4431-9D15-8B83419C67CF}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22F5EB6D-3FAF-419C-B40A-7173ABB7C6ED}: DhcpNameServer = 62.101.93.101 83.103.25.250
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22F5EB6D-3FAF-419C-B40A-7173ABB7C6ED}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23F24D81-C060-4558-9A97-A4C3F6C42420}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A017DA99-8341-4E49-9F67-108559935442}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programmi\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programmi\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2014/12/13 19:03:40 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/12/14 12:48:25 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2014/12/14 12:44:20 | 000,000,000 | ---D | C] -- C:\ComboFix
[2014/12/13 19:03:29 | 000,000,000 | ---D | C] -- C:\Users\BIASION\AppData\Roaming\Enigma Software Group
[2014/12/13 19:03:28 | 000,000,000 | ---D | C] -- C:\Users\BIASION\Start Menu
[2014/12/13 19:03:07 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2014/12/13 19:01:46 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2014/12/13 18:28:22 | 001,376,736 | ---- | C] (Cinema ProV13.12) -- C:\Users\BIASION\AppData\Roaming\VXPSKG.exe
[2014/12/13 18:28:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7972ece5-91ee-4380-9310-6c089d5325f1
[2014/12/13 18:27:55 | 002,031,072 | ---- | C] (Cinema ProV13.12) -- C:\Users\BIASION\AppData\Roaming\ZYIQFHO.exe
[2014/12/13 18:17:51 | 000,000,000 | ---D | C] -- C:\Users\BIASION\AppData\Local\com
[2014/12/13 18:16:24 | 001,567,200 | ---- | C] (Enter) -- C:\Users\BIASION\AppData\Roaming\YCPZP.exe
[2014/12/13 18:16:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7336eb5e-5f60-4fde-8669-e9ad7a944a0c
[2014/12/13 18:15:59 | 001,883,616 | ---- | C] (Enter) -- C:\Users\BIASION\AppData\Roaming\SSXUC.exe
[2014/12/13 18:14:31 | 000,000,000 | ---D | C] -- C:\Users\BIASION\AppData\Local\ContextTrue
[2014/12/13 18:05:27 | 000,000,000 | ---D | C] -- C:\_acestream_cache_
[2014/12/13 18:05:26 | 000,000,000 | ---D | C] -- C:\Users\BIASION\AppData\Roaming\.ACEStream
[2014/12/13 18:04:41 | 000,000,000 | ---D | C] -- C:\Users\BIASION\AppData\Roaming\ACEStream
[2014/12/13 15:40:02 | 000,000,000 | ---D | C] -- C:\Users\BIASION\Desktop\aviator
[2014/12/11 23:40:57 | 000,000,000 | ---D | C] -- C:\Users\BIASION\Desktop\music kate perry
[2014/12/09 11:55:05 | 000,000,000 | ---D | C] -- C:\ProgramData\AMMYY
[2014/12/08 23:09:25 | 000,174,080 | ---- | C] (RAD Game Tools, Inc.) -- C:\Windows\SysNative\binkw32.dll
[2014/12/08 23:08:28 | 000,174,080 | ---- | C] (RAD Game Tools, Inc.) -- C:\Windows\binkw32.dll
[2014/12/08 23:02:46 | 000,174,080 | ---- | C] (RAD Game Tools, Inc.) -- C:\Windows\SysWow64\binkw32.dll
[2014/12/08 23:02:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Logs
[2014/12/04 15:44:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2014/12/04 15:44:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/12/16 12:24:21 | 000,001,346 | ---- | M] () -- C:\Windows\tasks\VXPSKG.job
[2014/12/16 12:24:21 | 000,001,344 | ---- | M] () -- C:\Windows\tasks\SSXUC.job
[2014/12/16 12:24:17 | 000,001,692 | ---- | M] () -- C:\Windows\tasks\ZYIQFHO.job
[2014/12/16 12:24:17 | 000,001,344 | ---- | M] () -- C:\Windows\tasks\YCPZP.job
[2014/12/16 12:24:17 | 000,001,146 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/12/16 12:24:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/12/16 12:24:07 | 2124,701,695 | -HS- | M] () -- C:\hiberfil.sys
[2014/12/16 12:08:40 | 001,669,324 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/12/16 12:08:40 | 000,744,296 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat
[2014/12/16 12:08:40 | 000,657,212 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/12/16 12:08:40 | 000,148,470 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat
[2014/12/16 12:08:40 | 000,123,024 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/12/15 23:56:00 | 000,001,150 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/12/15 22:40:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-16355953-3418566716-1553465738-1000UA.job
[2014/12/15 22:40:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-16355953-3418566716-1553465738-1000Core.job
[2014/12/15 16:19:54 | 000,000,029 | -H-- | M] () -- C:\Users\BIASION\Desktop\setting.ini
[2014/12/14 12:48:24 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014/12/13 20:23:17 | 000,001,348 | ---- | M] () -- C:\Users\Public\Desktop\the.lnk
[2014/12/13 20:22:34 | 000,001,055 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2014/12/13 20:01:33 | 005,600,944 | R--- | M] (Swearware) -- C:\Users\BIASION\Desktop\ComboFix.exe
[2014/12/13 19:03:40 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2014/12/13 19:02:02 | 000,022,704 | ---- | M] () -- C:\Windows\SysNative\drivers\EsgScanner.sys
[2014/12/13 18:28:22 | 001,376,736 | ---- | M] (Cinema ProV13.12) -- C:\Users\BIASION\AppData\Roaming\VXPSKG.exe
[2014/12/13 18:27:55 | 002,031,072 | ---- | M] (Cinema ProV13.12) -- C:\Users\BIASION\AppData\Roaming\ZYIQFHO.exe
[2014/12/13 18:26:28 | 000,002,379 | ---- | M] () -- C:\Windows\patsearch.bin
[2014/12/13 18:26:27 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_webinstrNewH_01009.Wdf
[2014/12/13 18:16:24 | 001,567,200 | ---- | M] (Enter) -- C:\Users\BIASION\AppData\Roaming\YCPZP.exe
[2014/12/13 18:15:59 | 001,883,616 | ---- | M] (Enter) -- C:\Users\BIASION\AppData\Roaming\SSXUC.exe
[2014/12/12 13:21:06 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/12/12 13:21:06 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/12/04 15:44:43 | 000,002,515 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/12/13 19:03:40 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2014/12/13 19:02:02 | 000,022,704 | ---- | C] () -- C:\Windows\SysNative\drivers\EsgScanner.sys
[2014/12/13 18:28:24 | 000,001,346 | ---- | C] () -- C:\Windows\tasks\VXPSKG.job
[2014/12/13 18:27:56 | 000,001,692 | ---- | C] () -- C:\Windows\tasks\ZYIQFHO.job
[2014/12/13 18:26:28 | 000,002,379 | ---- | C] () -- C:\Windows\patsearch.bin
[2014/12/13 18:26:27 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_webinstrNewH_01009.Wdf
[2014/12/13 18:16:25 | 000,001,344 | ---- | C] () -- C:\Windows\tasks\YCPZP.job
[2014/12/13 18:16:00 | 000,001,344 | ---- | C] () -- C:\Windows\tasks\SSXUC.job
[2014/09/03 22:36:48 | 000,002,086 | ---- | C] () -- C:\Users\BIASION\AppData\Roaming\YCPZP
[2014/09/03 22:36:48 | 000,001,248 | ---- | C] () -- C:\Users\BIASION\AppData\Roaming\SSXUC
[2014/09/01 09:18:44 | 000,002,086 | ---- | C] () -- C:\Users\BIASION\AppData\Roaming\VXPSKG
[2014/09/01 09:18:44 | 000,001,248 | ---- | C] () -- C:\Users\BIASION\AppData\Roaming\ZYIQFHO
[2014/01/26 09:21:54 | 000,001,120 | RHS- | C] () -- C:\Users\BIASION\ntuser.pol
[2013/12/29 15:58:04 | 000,036,972 | ---- | C] () -- C:\Windows\SysWow64\ActPanel.dll
[2013/12/20 13:28:06 | 000,000,029 | ---- | C] () -- C:\Users\BIASION\AppData\Roaming\WB.CFG
[2013/12/06 22:38:38 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013/12/06 22:38:38 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013/12/06 21:39:24 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013/12/06 21:39:24 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013/12/06 16:44:26 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2013/05/26 18:51:57 | 000,004,991 | ---- | C] () -- C:\ProgramData\xhbjddli.elu
[2013/02/05 16:52:50 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2013/02/05 16:52:50 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2013/02/05 16:52:50 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2013/02/05 16:52:50 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012/09/09 20:47:08 | 000,004,052 | ---- | C] () -- C:\Users\BIASION\AppData\Local\unins000.dat
[2012/01/22 16:14:16 | 000,003,584 | ---- | C] () -- C:\Users\BIASION\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:24105FF3 @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E8956AB5

< End of report >

- - - Updated - - -

ciao scusate anchi o da qualche giorno il problema che mi si aprono pagine pubblicitarie in continuazione, ho fatto scansione con adaware e OTL, posto log di OTL fatemi sapere sono disperato

tecnico24 · 16 Dicembre 2014

@biasion118
1)I LOG vanno allegati
2)C'è una discussione ufficiale
http://www.tomshw.it/forum/sicurezza/276953-apertura-pagine-pubblicitarie-postate-qui.html

PROBLEMA Pagine pubblicitarie che si aprono da sole.

Malor

Nuovo Utente

Lele1990

Utente Attivo

Malor

Nuovo Utente

Lele1990

Utente Attivo

Malor

Nuovo Utente

Lele1990

Utente Attivo

Malor

Nuovo Utente

Lele1990

Utente Attivo

Malor

Nuovo Utente

Lele1990

Utente Attivo

Malor

Nuovo Utente

tecnico24

Malor

Nuovo Utente

biasion118

Utente Attivo

Allegati

tecnico24