Errore in explorer.exe: L'applicazione verrà chiusa

di **pepper70** » 09/05/10 16:20

Salve ragazzi,un ennesimo aiuto da parte vostra.
Stavo provando a sentire un file mp3 con Windows Media Player e mi è comparso ripetutamente il seguente messaggio:
Si è verificato un errore in explorer.exe.
L'applicazione verrà chiusa.
Quindi scompaiono tutte le cartelle dallo schermo e poi ricompaiono di nuovo.
Ho beccato l'ennesimo virus?
Oppure è internet explorer 6 che dà noie?
Grazie a tutti per eventuali ed auspicabili suggerimenti.
Buon lavoro

di **antoo69** » 10/05/10 00:23

posta un log di Hijackthis, altrimenti è difficile stabilire se hai o non hai infezioni.

di **-> EleKtrA <-** » 10/05/10 08:08

Ciao pepper70, potrebbe essere un problema legato ai codec che hai installato oppure molto più semplicemente un bug del sistema non aggiornato, il che mi fa pensare che ci potrebbero essere ospiti indesiderati.

Un pagliativo potrebbe essere quello di disattivare l'anteprima
Start > esegui, digita: regsvr32 /u shmedia.dll e dai l'ok

Per la visualizzazione e l'esplorazione delle cartelle usa explorer.exe (ovvero la shell di Windows) che richiama le parti necessarie all'anteprima, all'estrazione dei dati quali dimensione, spazio occupato su disco, nome etc...
Il problema (noto) risiede nell'incopatibilità di explorer con alcuni codec "crackati" o altri "open source" anche se sono altresì noti problemi simili con codec originali.

Resta il fatto che sarebbe meglio controllare il sistema, iniziando proprio da un log di Hijackthis.
E magari installare il Service Pack3

di **pepper70** » 10/05/10 18:14

Salve a tutti e grazie per l'interessamento.
Ecco il rapporto di hj.

Codice: Seleziona tutto: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19.12.00, on 10/05/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Programmi\Alwil Software\Avast5\afwServ.exe D:\Programmi\Alwil Software\Avast5\AvastSvc.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\SOUNDMAN.EXE D:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe D:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe D:\WINDOWS\system32\ctfmon.exe D:\Programmi\IObit\Advanced SystemCare 3\AWC.exe D:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe D:\WINDOWS\system32\wscntfy.exe D:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE D:\Programmi\uTorrent\uTorrent.exe D:\WINDOWS\explorer.exe D:\Documents and Settings\Falco\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe D:\Documents and Settings\Falco\Impostazioni locali\Dati applicazioni\Google\Chrome\Application\chrome.exe D:\Programmi\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?ptnrS=ZKxdm200YYIT&ptb=ZiTdY8JEgVGjRLy416Mopg&n=77ced087 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [GrooveMonitor] "D:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "D:\Programmi\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKLM\..\Run: [avast5] D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Advanced SystemCare 3] "D:\Programmi\IObit\Advanced SystemCare 3\AWC.exe" /startup O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O4 - Startup: Ritaglio schermata e avvio di OneNote 2007.lnk = D:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = D:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{34791712-14DF-4B36-B393-769A0DB611A4}: NameServer = 217.12.180.19,217.12.181.97 O17 - HKLM\System\CS1\Services\Tcpip\..\{34791712-14DF-4B36-B393-769A0DB611A4}: NameServer = 217.12.180.19,217.12.181.97 O17 - HKLM\System\CS2\Services\Tcpip\..\{34791712-14DF-4B36-B393-769A0DB611A4}: NameServer = 217.12.180.19,217.12.181.97 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing) O23 - Service: avast! Antivirus - ALWIL Software - D:\Programmi\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Firewall - ALWIL Software - D:\Programmi\Alwil Software\Avast5\afwServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Programmi\Alwil Software\Avast5\AvastSvc.exe O23 - Service: MBAMService - Malwarebytes Corporation - D:\Programmi\Malwarebytes' Anti-Malware\mbamservice.exe -- End of file - 6184 bytes

di **antoo69** » 11/05/10 10:12

Il log non presenta particolari problemi, comunque fixa queste due voci

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = D:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe

Successivamente fai ulteriori analisi del sistema utilizzando Combofix e Malwarebyte come spiegato in questo topic
viewtopic.php?f=25&t=86108&p=489721&hilit=hijackthis#p489721

di **-> EleKtrA <-** » 11/05/10 11:41

antoo69 io opterei per una manutenzione, che ne dici?
Malwarebytes è già installato, ma un giretto di Combofix non farebbe male.

@pepper70, prova a seguire questi step:

Step 1: Fixamo i valori superflui
Con tutte le applicazioni chiuse e disconnesso da internet
Avvia Hijackthis e clicca su "do a system scan only"
Metti la spunta a queste voci e clicca su "fix checked"

Codice: Seleziona tutto: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml ... n=77ced087 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [GrooveMonitor] "D:\Programmi\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKCU\..\Run: [Advanced SystemCare 3] "D:\Programmi\IObit\Advanced SystemCare 3\AWC.exe" /startup O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVIZIO LOCALE') O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVIZIO DI RETE') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Step 2: Pulizia dei file temporanei
Scarica TFC by OldTimer sul desktop
chiudi tutti i programmi
avvia TFC, clicca su "star"
al termine della scansione ti chiederà il riavvio, dai ok.

Step 3: Controllo Sistema
Disattiva momentaneamente l'antivirus
Scarica Combofix | Tutorial
Tasto destro sull'exe, esegui come amministratore
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

Step 4: Aggiornamento dei software
- Scarica e installa l'ultima versione di Adobe Reader
- Scarica e installa l'ultima versione di Java Sun
- Aggiorna Adobe FlashPlayer:
1. Scarica il programma di disinstallazione di FlashPlayer
2. Scarica l'ultima versione di FlashPlayer per IE
3. Scarica l'ultima versione di FlashPlayer per FF
4. Chiudi tutti i browser (IE, Opera, Firefox, Chrome, etc)
5. Esegui il programma di disinstallazione scaricato al punto 1.
6. Esegui il programma di installazione scaricato al punto 2.
7. Esegui il programma di installazione scaricato al punto 3.

Step 5: Aggiorna il Sistema con in service pack3

di **pepper70** » 11/05/10 12:15

Ciao, ho rifatto la scansione con hj ma la seconda stringa che mi hai indicato
non la trovo.
Ecco comunque il apporto di combo:

Codice: Seleziona tutto: ComboFix 10-05-10.03 - Falco 11/05/2010 12.08.48.4.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1022.554 [GMT 2:00] Eseguito da: d:\documents and settings\Falco\Desktop\ComboFix.exe AV: avast! Internet Security *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: avast! Internet Security *disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D} ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !! . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . d:\documents and settings\Falco\Dati applicazioni\inst.exe d:\programmi\eMule\lang\ar_AE.dll d:\programmi\eMule\lang\ba_BA.dll d:\programmi\eMule\lang\bg_BG.dll d:\programmi\eMule\lang\ca_ES.dll d:\programmi\eMule\lang\cz_CZ.dll d:\programmi\eMule\lang\da_DK.dll d:\programmi\eMule\lang\de_DE.dll d:\programmi\eMule\lang\el_GR.dll d:\programmi\eMule\lang\es_AS.dll d:\programmi\eMule\lang\es_ES_T.dll d:\programmi\eMule\lang\et_EE.dll d:\programmi\eMule\lang\fa_IR.dll d:\programmi\eMule\lang\fi_FI.dll d:\programmi\eMule\lang\fr_BR.dll d:\programmi\eMule\lang\fr_FR.dll d:\programmi\eMule\lang\gl_ES.dll d:\programmi\eMule\lang\he_IL.dll d:\programmi\eMule\lang\hu_HU.dll d:\programmi\eMule\lang\it_IT.dll d:\programmi\eMule\lang\jp_JP.dll d:\programmi\eMule\lang\ko_KR.dll d:\programmi\eMule\lang\lt_LT.dll d:\programmi\eMule\lang\lv_LV.dll d:\programmi\eMule\lang\mt_MT.dll d:\programmi\eMule\lang\nb_NO.dll d:\programmi\eMule\lang\nl_NL.dll d:\programmi\eMule\lang\nn_NO.dll d:\programmi\eMule\lang\pl_PL.dll d:\programmi\eMule\lang\pt_BR.dll d:\programmi\eMule\lang\pt_PT.dll d:\programmi\eMule\lang\ro_RO.dll d:\programmi\eMule\lang\ru_RU.dll d:\programmi\eMule\lang\sl_SI.dll d:\programmi\eMule\lang\sq_AL.dll d:\programmi\eMule\lang\sv_SE.dll d:\programmi\eMule\lang\tr_TR.dll d:\programmi\eMule\lang\ua_UA.dll d:\programmi\eMule\lang\ug_CN.dll d:\programmi\eMule\lang\va_ES.dll d:\programmi\eMule\lang\va_ES_RACV.dll d:\programmi\eMule\lang\vi_VN.dll d:\programmi\eMule\lang\zh_CN.dll d:\programmi\eMule\lang\zh_TW.dll . ((((((((((((((((((((((((((((((((((((((( Driver/Servizi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MYWEBSEARCHSERVICE ((((((((((((((((((((((((( Files Creati Da 2010-04-11 al 2010-05-11 ))))))))))))))))))))))))))))))))))) . 2010-05-11 09:53 . 2010-05-11 09:53 397824 ----a-w- d:\windows\system32\CF1716.exe 2010-05-06 20:28 . 2010-05-06 20:28 -------- d-----w- d:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Google 2010-05-06 20:23 . 2010-05-06 20:23 -------- d-----w- d:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\Google 2010-05-06 20:22 . 2010-05-06 20:49 -------- d-----w- d:\programmi\Google 2010-05-05 20:21 . 2010-05-05 20:21 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\AVS4YOU 2010-05-05 20:20 . 2010-05-05 20:20 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\AVS4YOU 2010-05-05 20:16 . 2010-05-05 20:17 -------- d-----w- d:\programmi\File comuni\AVSMedia 2010-05-05 20:16 . 2003-05-21 22:50 1700352 ----a-w- d:\windows\system32\GdiPlus.dll 2010-05-05 20:14 . 2010-05-05 20:14 -------- d-----w- d:\windows\system32\drivers\umdf 2010-05-05 20:14 . 2006-08-11 18:14 22752 ----a-w- d:\windows\system32\spupdsvc.exe 2010-05-05 20:13 . 2003-05-21 10:50 24576 ----a-w- d:\windows\system32\msxml3a.dll 2010-05-05 20:13 . 2010-05-05 22:01 -------- d-----w- d:\programmi\AVS4YOU 2010-05-02 18:40 . 2010-05-02 18:40 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\AccurateRip 2010-05-02 18:39 . 2010-05-02 18:40 -------- d-----w- d:\programmi\Exact Audio Copy 2010-04-30 20:36 . 2010-04-30 20:36 -------- d-----w- d:\programmi\Alwil Software 2010-04-30 20:36 . 2010-04-30 20:36 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\Alwil Software 2010-04-30 10:12 . 2010-04-30 10:12 -------- d--h--w- d:\windows\PIF 2010-04-28 12:33 . 2010-04-28 12:33 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\Malwarebytes 2010-04-28 12:32 . 2010-04-29 13:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys 2010-04-28 12:32 . 2010-04-28 12:32 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\Malwarebytes 2010-04-28 12:32 . 2010-04-29 13:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys 2010-04-28 12:32 . 2010-04-30 05:47 -------- d-----w- d:\programmi\Malwarebytes' Anti-Malware 2010-04-27 20:32 . 2010-04-27 20:32 -------- d-----w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\ESET 2010-04-27 12:49 . 2010-04-27 12:49 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\ESET 2010-04-27 10:59 . 2010-04-27 10:59 -------- d-----w- d:\programmi\Trend Micro 2010-04-26 21:26 . 2010-04-26 21:26 -------- d-----w- d:\windows\system32\wbem\Repository 2010-04-26 07:45 . 2010-04-26 07:45 -------- d-----w- d:\documents and settings\NetworkService\Menu Avvio 2010-04-25 22:11 . 2009-03-24 14:08 55640 ----a-w- d:\windows\system32\drivers\avgntflt.sys 2010-04-25 22:11 . 2010-04-26 20:52 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\Avira 2010-04-25 08:05 . 2010-04-25 08:05 -------- d-----w- d:\programmi\uTorrent 2010-04-25 08:04 . 2010-05-11 10:33 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\uTorrent 2010-04-25 07:17 . 2010-04-25 07:17 -------- d-----w- d:\programmi\EasyPrediction 2010-04-24 18:34 . 2010-04-24 18:34 -------- d-----w- d:\programmi\eMule 2010-04-22 19:53 . 2010-05-06 20:30 -------- d-----w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Temp 2010-04-22 19:53 . 2010-05-06 20:31 -------- d-----w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google 2010-04-22 15:16 . 2010-04-22 15:16 184320 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\wlan4.dll 2010-04-22 15:16 . 2010-04-22 15:16 10752 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\system.dll 2010-04-22 15:16 . 2010-04-22 15:16 90624 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\secure.dll 2010-04-22 15:16 . 2010-04-22 15:16 116736 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\roting4.dll 2010-04-22 15:16 . 2010-04-22 15:16 71168 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\mpls.dll 2010-04-22 15:16 . 2010-04-22 15:16 109056 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\ppp.dll 2010-04-22 15:16 . 2010-04-22 15:16 69632 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\dhcp.dll 2010-04-22 15:16 . 2010-04-22 15:16 69632 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\advtool.dll 2010-04-22 15:15 . 2010-04-22 15:16 1531904 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\roteros.dll 2010-04-22 15:15 . 2010-04-22 15:15 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-25 21:45 . 2009-11-01 14:45 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\avg9 2010-04-25 21:45 . 2009-06-20 20:33 -------- d-----w- d:\programmi\AVG 2010-04-25 05:36 . 2010-03-15 08:53 -------- d---a-w- d:\docume~1\ALLUSE~1\DATIAP~1\TEMP 2010-04-25 05:35 . 2010-03-15 08:53 -------- d-----w- d:\programmi\SpywareBlaster 2010-04-15 20:37 . 2010-04-08 09:29 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\Vso 2010-04-14 16:47 . 2010-04-30 20:37 38848 ----a-w- d:\windows\system32\avastSS.scr 2010-04-14 16:47 . 2010-04-30 20:37 153184 ----a-w- d:\windows\system32\aswBoot.exe 2010-04-14 16:37 . 2010-04-30 20:37 102736 ----a-w- d:\windows\system32\drivers\aswFW.sys 2010-04-14 16:37 . 2010-04-30 20:37 297552 ----a-w- d:\windows\system32\drivers\aswSnx.sys 2010-04-14 16:36 . 2010-04-30 20:37 196048 ----a-w- d:\windows\system32\drivers\aswNdis2.sys 2010-04-14 16:35 . 2010-04-30 20:37 46672 ----a-w- d:\windows\system32\drivers\aswTdi.sys 2010-04-14 16:35 . 2010-04-30 20:37 162768 ----a-w- d:\windows\system32\drivers\aswSP.sys 2010-04-14 16:31 . 2010-04-30 20:37 23376 ----a-w- d:\windows\system32\drivers\aswRdr.sys 2010-04-14 16:31 . 2010-04-30 20:37 100432 ----a-w- d:\windows\system32\drivers\aswmon2.sys 2010-04-14 16:31 . 2010-04-30 20:37 94800 ----a-w- d:\windows\system32\drivers\aswmon.sys 2010-04-14 16:31 . 2010-04-30 20:37 19024 ----a-w- d:\windows\system32\drivers\aswFsBlk.sys 2010-04-14 16:30 . 2010-04-30 20:37 28880 ----a-w- d:\windows\system32\drivers\aavmker4.sys 2010-04-10 18:48 . 2009-07-05 18:26 69224 ----a-w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT 2010-04-08 09:29 . 2010-04-08 09:29 47360 ----a-w- d:\windows\system32\drivers\pcouffin.sys 2010-04-08 09:29 . 2010-04-08 09:29 47360 ----a-w- d:\documents and settings\Falco\Dati applicazioni\pcouffin.sys 2010-04-08 09:29 . 2010-04-08 09:29 47360 ----a-w- d:\documents and settings\Falco\Dati applicazioni\pcouffin.sys 2010-04-08 09:29 . 2010-04-08 09:29 -------- d-----w- d:\programmi\vso 2010-03-28 08:36 . 2001-08-31 18:00 48568 ----a-w- d:\windows\system32\perfc010.dat 2010-03-28 08:36 . 2001-08-31 18:00 347866 ----a-w- d:\windows\system32\perfh010.dat 2010-03-19 19:10 . 2010-04-30 20:37 12112 ----a-w- d:\windows\system32\drivers\aswNdis.sys . ------- Sigcheck ------- [-] 2006-04-11 . 744BE027C16680791A6AC13E0EF35F8F . 1548288 . . [5.1.2600.2180] . . d:\windows\system32\sfcfiles.dll . ((((((((((((((((((((((((((((( SnapShot@2009-10-01_20.14.16 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-11 22:02 . 2009-07-11 22:02 51008 d:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll + 2007-11-07 00:19 . 2007-11-07 00:19 54272 d:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll + 2009-07-11 22:02 . 2009-07-11 22:02 59728 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll + 2009-07-11 22:02 . 2009-07-11 22:02 42832 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll + 2009-07-11 22:02 . 2009-07-11 22:02 43344 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll + 2009-07-11 22:02 . 2009-07-11 22:02 61264 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll + 2009-07-11 22:02 . 2009-07-11 22:02 62800 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll + 2009-07-11 22:02 . 2009-07-11 22:02 61760 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll + 2009-07-11 22:02 . 2009-07-11 22:02 61776 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll + 2009-07-11 22:02 . 2009-07-11 22:02 53568 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll + 2009-07-11 22:02 . 2009-07-11 22:02 63296 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll + 2009-07-11 22:02 . 2009-07-11 22:02 36688 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll + 2009-07-11 22:02 . 2009-07-11 22:02 35648 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll + 2008-07-29 06:05 . 2008-07-29 06:05 62976 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll + 2008-07-29 06:05 . 2008-07-29 06:05 46080 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll + 2008-07-29 06:05 . 2008-07-29 06:05 46592 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll + 2008-07-29 06:05 . 2008-07-29 06:05 64512 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll + 2008-07-29 06:05 . 2008-07-29 06:05 66048 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll + 2008-07-29 06:05 . 2008-07-29 06:05 65024 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll + 2008-07-29 06:05 . 2008-07-29 06:05 65024 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll + 2008-07-29 06:05 . 2008-07-29 06:05 56832 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll + 2008-07-29 06:05 . 2008-07-29 06:05 66560 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll + 2008-07-29 06:05 . 2008-07-29 06:05 39936 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll + 2008-07-29 06:05 . 2008-07-29 06:05 38912 d:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll + 2009-07-11 22:05 . 2009-07-11 22:05 59904 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll + 2009-07-11 22:05 . 2009-07-11 22:05 59904 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll + 2008-07-29 04:07 . 2008-07-29 04:07 59904 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll + 2008-07-29 04:07 . 2008-07-29 04:07 59904 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll + 2009-07-11 19:54 . 2009-07-11 19:54 65536 d:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723\vcomp.dll - 2006-12-01 22:08 . 2006-12-01 22:08 49152 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll + 2010-03-07 11:12 . 2006-12-01 21:08 49152 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll + 2010-03-07 11:12 . 2006-12-01 21:08 49152 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll - 2006-12-01 22:08 . 2006-12-01 22:08 49152 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll - 2006-12-01 22:08 . 2006-12-01 22:08 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll + 2010-03-07 11:12 . 2006-12-01 21:08 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll - 2006-12-01 22:08 . 2006-12-01 21:08 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll + 2010-03-07 11:12 . 2006-12-01 21:08 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll - 2006-12-01 22:08 . 2006-12-01 21:08 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll + 2010-03-07 11:12 . 2006-12-01 21:08 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll - 2006-12-01 22:08 . 2006-12-01 21:08 57344 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll + 2010-03-07 11:12 . 2006-12-01 21:08 57344 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll - 2006-12-01 22:08 . 2006-12-01 21:08 65536 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll + 2010-03-07 11:12 . 2006-12-01 21:08 65536 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll + 2010-03-07 11:12 . 2006-12-01 21:08 45056 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll - 2006-12-01 22:08 . 2006-12-01 21:08 45056 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll - 2006-12-01 22:08 . 2006-12-01 21:08 40960 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll + 2010-03-07 11:12 . 2006-12-01 21:08 40960 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll + 2009-07-11 19:32 . 2009-07-11 19:32 49152 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80KOR.dll + 2009-07-11 19:32 . 2009-07-11 19:32 49152 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80JPN.dll + 2009-07-11 19:32 . 2009-07-11 19:32 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ITA.dll + 2009-07-11 19:32 . 2009-07-11 19:32 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80FRA.dll + 2009-07-11 19:32 . 2009-07-11 19:32 61440 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ESP.dll + 2009-07-11 19:32 . 2009-07-11 19:32 57344 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ENU.dll + 2009-07-11 19:32 . 2009-07-11 19:32 65536 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80DEU.dll + 2009-07-11 19:32 . 2009-07-11 19:32 45056 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80CHT.dll + 2009-07-11 19:32 . 2009-07-11 19:32 40960 d:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80CHS.dll - 2006-12-01 22:26 . 2006-12-01 22:26 57856 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll + 2010-03-07 11:12 . 2006-12-01 21:26 57856 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll - 2006-12-01 22:25 . 2006-12-01 22:25 69632 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll + 2010-03-07 11:12 . 2006-12-01 21:25 69632 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll + 2009-07-12 00:07 . 2009-07-12 00:07 57856 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfcm80u.dll + 2009-07-12 00:19 . 2009-07-12 00:19 69632 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfcm80.dll + 2010-03-07 11:12 . 2006-12-01 19:56 96256 d:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll - 2006-12-01 20:56 . 2006-12-01 20:56 96256 d:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll + 2009-07-11 18:41 . 2009-07-11 18:41 97280 d:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll + 2006-08-24 18:26 . 2006-08-24 18:26 17408 d:\windows\system32\wpdshextautoplay.exe + 2005-01-27 23:36 . 2006-08-24 20:30 63488 d:\windows\system32\wpdmtpus.dll + 2005-01-27 23:36 . 2006-08-24 20:30 35840 d:\windows\system32\wpdconns.dll + 2004-08-19 19:39 . 2006-08-24 20:30 37376 d:\windows\system32\wmdmps.dll + 2004-08-19 19:39 . 2006-08-24 20:30 33792 d:\windows\system32\wmdmlog.dll + 2010-03-20 18:28 . 2005-04-27 14:09 69632 d:\windows\system32\SolarWinds.scr + 2010-03-20 18:28 . 2005-04-27 14:09 57344 d:\windows\system32\Plasma.scr + 2001-08-31 18:00 . 2010-03-28 08:36 40836 d:\windows\system32\perfc009.dat - 2001-08-31 18:00 . 2009-10-01 16:47 40836 d:\windows\system32\perfc009.dat + 2010-03-20 18:28 . 2005-04-27 14:09 90112 d:\windows\system32\OpenAL32.dll + 2004-08-19 19:39 . 2006-08-24 20:30 27648 d:\windows\system32\mspmsnsv.dll + 2010-04-22 20:23 . 2010-04-22 20:23 84661 d:\windows\system32\Macromed\Flash\uninstall_plugin.exe + 2009-10-25 09:03 . 2009-10-25 09:03 88589 d:\windows\system32\Macromed\Flash\uninstall_activeX.exe + 2004-08-19 19:39 . 2006-08-24 20:30 11264 d:\windows\system32\LAPRXY.dll + 2010-03-20 18:28 . 2005-04-27 14:09 69632 d:\windows\system32\Flux.scr + 2010-03-20 18:28 . 2005-04-27 14:09 77824 d:\windows\system32\Flocks.scr + 2010-03-20 18:28 . 2005-04-27 14:09 81408 d:\windows\system32\FieldLines.scr + 2005-01-27 23:36 . 2006-08-24 18:26 38656 d:\windows\system32\drivers\wpdusb.sys + 2009-10-01 13:07 . 2009-10-01 13:07 96408 d:\windows\system32\drivers\epfwtdir.sys + 2004-08-19 19:39 . 2006-08-24 20:30 37376 d:\windows\system32\dllcache\wmdmps.dll + 2004-08-19 19:39 . 2006-08-24 20:30 33792 d:\windows\system32\dllcache\wmdmlog.dll + 2004-08-19 19:39 . 2006-08-24 20:30 27648 d:\windows\system32\dllcache\mspmsnsv.dll + 2004-08-19 19:39 . 2006-08-24 20:30 11264 d:\windows\system32\dllcache\LAPRXY.dll + 2010-03-20 18:28 . 2005-04-27 14:09 95744 d:\windows\system32\Cyclone.scr + 2009-08-24 20:49 . 2009-08-24 20:49 48128 d:\windows\Installer\17f501.msi + 2010-05-06 20:31 . 2010-05-06 20:31 25214 d:\windows\Installer\{08C0729E-3E50-11DF-9D81-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\wmvdmoe2.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\wmvdmod.dll + 2005-01-28 06:53 . 2006-08-24 20:30 4096 d:\windows\system32\WMVADVE.DLL + 2005-01-28 11:32 . 2006-08-24 20:30 4096 d:\windows\system32\WMVADVD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\wmsdmoe2.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\wmsdmod.dll + 2005-01-27 23:36 . 2006-08-24 20:42 8704 d:\windows\system32\wdfmgr.exe + 2005-01-27 23:35 . 2006-08-24 20:30 4096 d:\windows\system32\wdfapi.dll + 2005-01-27 23:36 . 2006-08-24 20:42 8704 d:\windows\system32\uwdf.exe + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\MPG4DMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\MP4SDMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\MP43DMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\wmvdmoe2.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\wmvdmod.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\wmsdmoe2.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\wmsdmod.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\MPG4DMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\MP4SDMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 4096 d:\windows\system32\dllcache\MP43DMOD.dll + 2009-07-11 22:02 . 2009-07-11 22:02 653120 d:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll + 2009-07-11 22:02 . 2009-07-11 22:02 569664 d:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll + 2009-07-11 22:05 . 2009-07-11 22:05 225280 d:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll + 2008-07-29 06:05 . 2008-07-29 06:05 655872 d:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll + 2008-07-29 06:05 . 2008-07-29 06:05 572928 d:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll + 2008-07-29 01:54 . 2008-07-29 01:54 225280 d:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll + 2009-07-11 22:02 . 2009-07-11 22:02 159032 d:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll + 2008-07-29 06:05 . 2008-07-29 06:05 161784 d:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll - 2006-12-01 20:54 . 2006-12-01 20:54 626688 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll + 2010-03-07 11:12 . 2006-12-01 19:54 626688 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll - 2006-12-01 20:54 . 2006-12-01 20:54 548864 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll + 2010-03-07 11:12 . 2006-12-01 19:54 548864 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll + 2010-03-07 11:12 . 2006-12-01 19:54 479232 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll - 2006-12-01 20:54 . 2006-12-01 19:54 479232 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll + 2009-07-12 00:12 . 2009-07-12 00:12 632656 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll + 2009-07-12 00:09 . 2009-07-12 00:09 554832 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll + 2009-07-12 00:08 . 2009-07-12 00:08 479232 d:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll + 2005-01-27 23:36 . 2006-08-24 20:30 349184 d:\windows\system32\wpdsp.dll + 2006-08-24 20:30 . 2006-08-24 20:30 133120 d:\windows\system32\WPDShServiceObj.dll + 2005-01-27 23:36 . 2006-08-24 20:30 154624 d:\windows\system32\wpdmtp.dll + 2005-01-27 23:36 . 2006-08-24 20:30 629760 d:\windows\system32\wpd_ci.dll + 2006-08-24 20:30 . 2006-08-24 20:30 656896 d:\windows\system32\WMVXENCD.dll + 2006-08-24 20:30 . 2006-08-24 20:30 790016 d:\windows\system32\WMVSENCD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 603648 d:\windows\system32\WMSPDMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 937984 d:\windows\system32\WMNetMgr.dll + 2004-08-19 19:39 . 2006-08-24 20:30 157184 d:\windows\system32\wmidx.dll + 2006-08-24 20:30 . 2006-08-24 20:30 532992 d:\windows\system32\wmdrmsdk.dll + 2005-01-28 06:53 . 2006-08-24 20:30 347648 d:\windows\system32\wmdrmnet.dll + 2005-01-28 06:53 . 2006-08-24 20:30 428032 d:\windows\system32\wmdrmdev.dll + 2004-08-19 19:39 . 2006-08-24 20:30 222208 d:\windows\system32\wmasf.dll + 2004-08-19 19:39 . 2006-08-24 20:30 757248 d:\windows\system32\WMADMOD.dll + 2010-03-20 18:28 . 2006-03-01 21:32 117248 d:\windows\system32\ribbons.scr + 2004-08-19 19:39 . 2006-08-24 20:30 210432 d:\windows\system32\qasf.dll + 2006-08-24 20:30 . 2006-08-24 20:30 198144 d:\windows\system32\PortableDeviceWMDRM.dll + 2006-08-24 20:30 . 2006-08-24 20:30 132096 d:\windows\system32\PortableDeviceWiaCompat.dll + 2006-08-24 20:30 . 2006-08-24 20:30 166912 d:\windows\system32\PortableDeviceTypes.dll + 2006-08-24 20:30 . 2006-08-24 20:30 101888 d:\windows\system32\PortableDeviceClassExtension.dll + 2006-08-24 20:30 . 2006-08-24 20:30 284160 d:\windows\system32\PortableDeviceApi.dll - 2001-08-31 18:00 . 2009-10-01 16:47 314508 d:\windows\system32\perfh009.dat + 2001-08-31 18:00 . 2010-03-28 08:36 314508 d:\windows\system32\perfh009.dat + 2004-08-19 19:39 . 2006-08-24 20:30 320512 d:\windows\system32\mswmdm.dll + 2004-08-19 19:39 . 2006-08-24 20:30 414208 d:\windows\system32\msscp.dll + 2004-08-19 19:39 . 2006-08-24 20:30 175104 d:\windows\system32\mspmsp.dll + 2004-08-19 19:39 . 2006-08-24 20:30 179712 d:\windows\system32\msnetobj.dll + 2006-08-24 20:30 . 2006-08-24 20:30 259072 d:\windows\system32\MPG4DECD.dll + 2006-08-24 20:30 . 2006-08-24 20:30 316928 d:\windows\system32\MP4SDECD.dll + 2006-08-24 20:30 . 2006-08-24 20:30 258560 d:\windows\system32\MP43DECD.dll + 2006-08-24 20:30 . 2006-08-24 20:30 211968 d:\windows\system32\MFPLAT.dll + 2010-01-27 01:07 . 2010-01-27 01:07 256280 d:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe + 2009-07-18 03:12 . 2009-07-18 03:12 257440 d:\windows\system32\Macromed\Flash\FlashUtil10c.exe + 2004-08-19 19:39 . 2006-08-24 18:31 100864 d:\windows\system32\logagent.exe + 2010-03-20 18:28 . 2005-04-27 14:09 294912 d:\windows\system32\Helios.scr + 2009-06-13 22:44 . 2010-03-21 17:34 265416 d:\windows\system32\FNTCACHE.DAT + 2010-03-20 18:28 . 2005-04-27 14:09 294912 d:\windows\system32\Euphoria.scr + 2004-08-19 19:39 . 2006-08-24 20:30 990208 d:\windows\system32\drmv2clt.dll + 2006-08-24 18:27 . 2006-08-24 18:27 249344 d:\windows\system32\drmupgds.exe + 2006-08-24 20:30 . 2006-08-24 20:30 667648 d:\windows\system32\drivers\umdf\wpdmtpdr.dll + 2009-10-01 13:06 . 2009-10-01 13:06 108792 d:\windows\system32\drivers\ehdrv.sys + 2009-10-01 13:03 . 2009-10-01 13:03 116008 d:\windows\system32\drivers\eamon.sys + 2004-08-19 19:39 . 2006-08-24 20:30 603648 d:\windows\system32\dllcache\WMSPDMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 937984 d:\windows\system32\dllcache\WMNetMgr.dll + 2004-08-19 19:39 . 2006-08-24 20:30 157184 d:\windows\system32\dllcache\wmidx.dll + 2004-08-19 19:39 . 2006-08-24 20:30 222208 d:\windows\system32\dllcache\WMASF.dll + 2004-08-19 19:39 . 2006-08-24 20:30 757248 d:\windows\system32\dllcache\WMADMOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 210432 d:\windows\system32\dllcache\qasf.dll + 2004-08-19 19:39 . 2006-08-24 20:30 320512 d:\windows\system32\dllcache\mswmdm.dll + 2004-08-19 19:39 . 2006-08-24 20:30 414208 d:\windows\system32\dllcache\msscp.dll + 2004-08-19 19:39 . 2006-08-24 20:30 175104 d:\windows\system32\dllcache\mspmsp.dll + 2004-08-19 19:39 . 2006-08-24 20:30 179712 d:\windows\system32\dllcache\msnetobj.dll + 2004-08-19 19:39 . 2006-08-24 18:31 100864 d:\windows\system32\dllcache\logagent.exe + 2004-08-19 19:39 . 2006-08-24 20:30 990208 d:\windows\system32\dllcache\drmv2clt.dll + 2004-08-19 19:39 . 2006-08-24 20:30 228352 d:\windows\system32\dllcache\cewmdm.dll + 2004-08-19 19:39 . 2006-08-24 20:30 537600 d:\windows\system32\dllcache\blackbox.dll + 2004-08-19 19:39 . 2006-08-24 20:30 228352 d:\windows\system32\cewmdm.dll + 2010-03-20 18:28 . 2006-03-01 21:32 773120 d:\windows\system32\bubbles.scr + 2010-03-20 18:28 . 2001-11-14 09:54 291840 d:\windows\system32\Bliss.scr + 2004-08-19 19:39 . 2006-08-24 20:30 537600 d:\windows\system32\blackbox.dll + 2005-01-28 13:22 . 2006-08-24 20:30 276480 d:\windows\system32\audiodev.dll + 2010-03-20 18:28 . 2001-10-16 16:12 696320 d:\windows\system32\americanflag.scr + 2009-11-01 14:45 . 2009-11-01 14:45 424448 d:\windows\Installer\a309e.msi + 2010-03-21 17:38 . 2010-03-21 17:38 228352 d:\windows\Installer\4a7ab.msi + 2010-05-05 20:13 . 2010-05-05 20:13 331264 d:\windows\Installer\3c22d.msi + 2009-06-13 21:04 . 2009-06-13 21:04 265216 d:\windows\Installer\3a506.msi + 2010-04-30 20:37 . 2010-04-30 20:37 219648 d:\windows\Installer\33b6263.msi + 2009-08-24 20:50 . 2009-08-24 20:50 503296 d:\windows\Installer\17f52e.msi + 2009-08-24 20:50 . 2009-08-24 20:50 506880 d:\windows\Installer\17f528.msi + 2009-08-24 20:50 . 2009-08-24 20:50 516608 d:\windows\Installer\17f521.msi + 2009-08-24 20:50 . 2009-08-24 20:50 513536 d:\windows\Installer\17f51a.msi + 2009-08-24 20:49 . 2009-08-24 20:49 512512 d:\windows\Installer\17f513.msi + 2009-07-11 22:02 . 2009-07-11 22:02 3780424 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll + 2009-07-11 22:02 . 2009-07-11 22:02 3765048 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll + 2008-07-29 06:05 . 2008-07-29 06:05 3783672 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll + 2008-07-29 06:05 . 2008-07-29 06:05 3768312 d:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll - 2006-12-01 22:25 . 2006-12-01 22:25 1093120 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll + 2010-03-07 11:12 . 2006-12-01 21:25 1093120 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll - 2006-12-01 22:25 . 2006-12-01 22:25 1101824 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll + 2010-03-07 11:12 . 2006-12-01 21:25 1101824 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll + 2009-07-11 19:46 . 2009-07-11 19:46 1093120 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80u.dll + 2009-07-11 19:46 . 2009-07-11 19:46 1105920 d:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80.dll + 2006-08-24 20:30 . 2006-08-24 20:30 2589184 d:\windows\system32\WpdShext.dll + 2006-08-24 20:30 . 2006-08-24 20:30 1392128 d:\windows\system32\WMVSDECD.dll + 2006-08-24 20:30 . 2006-08-24 20:30 1532416 d:\windows\system32\WMVENCOD.dll + 2006-08-24 20:30 . 2006-08-24 20:30 1539584 d:\windows\system32\WMVDECOD.dll + 2004-08-19 19:39 . 2006-08-24 20:30 2450944 d:\windows\system32\wmvcore.dll + 2004-08-19 19:39 . 2006-08-24 20:30 1327616 d:\windows\system32\WMSPDMOE.dll + 2004-08-19 19:39 . 2006-08-24 20:30 1118208 d:\windows\system32\WMADMOE.dll + 2004-07-17 15:35 . 2004-07-17 15:35 1354240 d:\windows\system32\webfldrs.msi + 2010-03-20 18:28 . 2005-04-27 14:09 5906432 d:\windows\system32\Skyrocket.scr + 2010-01-27 01:07 . 2010-01-27 01:07 3884312 d:\windows\system32\Macromed\Flash\NPSWF32.dll + 2010-03-20 18:28 . 2005-04-27 14:09 1724416 d:\windows\system32\Lattice.scr + 2004-08-19 19:39 . 2006-08-24 20:30 2450944 d:\windows\system32\dllcache\wmvcore.dll + 2004-08-19 19:39 . 2006-08-24 20:30 1327616 d:\windows\system32\dllcache\WMSPDMOE.dll + 2004-08-19 19:39 . 2006-08-24 20:30 1118208 d:\windows\system32\dllcache\WMADMOE.dll + 2010-03-20 18:27 . 2006-03-01 21:31 1263616 d:\windows\system32\aurora.scr + 2010-03-20 18:28 . 2001-09-26 21:11 1634304 d:\windows\system32\3dwindowsxp.scr + 2009-06-13 21:01 . 2009-06-13 21:01 3065344 d:\windows\Installer\3a500.msi + 2009-08-24 20:50 . 2009-08-24 20:50 1644032 d:\windows\Installer\17f549.msi + 2009-08-24 20:50 . 2009-08-24 20:50 1656320 d:\windows\Installer\17f543.msi + 2009-08-24 20:50 . 2009-08-24 20:50 1656320 d:\windows\Installer\17f53c.msi + 2009-08-24 20:50 . 2009-08-24 20:50 1656320 d:\windows\Installer\17f535.msi + 2009-08-24 20:49 . 2009-08-24 20:49 2365440 d:\windows\Installer\17f50d.msi + 2009-08-24 20:49 . 2009-08-24 20:49 1650688 d:\windows\Installer\17f507.msi + 2009-08-24 20:49 . 2009-08-24 20:49 1644544 d:\windows\Installer\17f4f8.msi + 2009-08-24 20:49 . 2009-08-24 20:49 2027008 d:\windows\Installer\17f4f1.msi + 2009-08-24 20:48 . 2009-08-24 20:48 1753088 d:\windows\Installer\17f4ea.msi + 2009-08-24 20:48 . 2009-08-24 20:48 2417152 d:\windows\Installer\17f4e4.msi + 2009-08-24 20:53 . 2009-08-24 20:53 18181632 d:\windows\Installer\17f555.msi . -- Snapshot per reimpostare la data corrente -- . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell] @="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}" [HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}] 2010-04-14 16:33 140288 ----a-w- d:\programmi\Alwil Software\Avast5\snxPlugins.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Advanced SystemCare 3"="d:\programmi\IObit\Advanced SystemCare 3\AWC.exe" [2008-12-21 2250256] "Google Update"="d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2010-04-22 136176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536] "GrooveMonitor"="d:\programmi\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "Malwarebytes' Anti-Malware"="d:\programmi\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584] "avast5"="d:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-19 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "nlhr"="d:\windows\System32\AdvPack.Dll" [2004-08-19 101888] "tscuninstall"="d:\windows\system32\tscupgrd.exe" [2004-08-19 44544] d:\documents and settings\Falco\Menu Avvio\Programmi\Esecuzione automatica\ Ritaglio schermata e avvio di OneNote 2007.lnk - d:\programmi\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] d:\docume~1\ALLUSE~1\MENUAV~1\PROGRA~1\ESECUZ~1\ Avvio veloce di Adobe Reader.lnk - d:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "d:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"= "d:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\Programmi\\eMule\\emule.exe"= "d:\\Programmi\\uTorrent\\uTorrent.exe"= R0 aswNdis;avast! Firewall NDIS Filter Service;d:\windows\system32\drivers\aswNdis.sys [30/04/2010 22.37.02 12112] R0 aswNdis2;avast! Firewall Core Firewall Service;d:\windows\system32\drivers\aswNdis2.sys [30/04/2010 22.37.23 196048] R1 aswFW;avast! TDI Firewall driver;d:\windows\system32\drivers\aswFW.sys [30/04/2010 22.37.35 102736] R1 aswSnx;aswSnx;d:\windows\system32\drivers\aswSnx.sys [30/04/2010 22.37.35 297552] R1 aswSP;aswSP;d:\windows\system32\drivers\aswSP.sys [30/04/2010 22.37.36 162768] R1 ehdrv;ehdrv;d:\windows\system32\drivers\ehdrv.sys [01/10/2009 15.06.40 108792] R1 epfwtdir;epfwtdir;d:\windows\system32\drivers\epfwtdir.sys [01/10/2009 15.07.30 96408] R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [30/04/2010 22.37.36 19024] R2 avast! Firewall;avast! Firewall;d:\programmi\Alwil Software\Avast5\afwServ.exe [30/04/2010 22.37.02 119200] R2 MBAMService;MBAMService;d:\programmi\Malwarebytes' Anti-Malware\mbamservice.exe [28/04/2010 14.33.01 304464] R3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [28/04/2010 14.32.54 20952] . Contenuto della cartella 'Scheduled Tasks' 2010-05-11 d:\windows\Tasks\AWC AutoSweep.job - d:\programmi\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-10-01 10:17] 2010-05-10 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-606747145-1801674531-1003Core.job - d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-04-22 19:53] 2010-05-11 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-606747145-1801674531-1003UA.job - d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-04-22 19:53] . . ------- Scansione supplementare ------- . uStart Page = hxxp://home.mywebsearch.com/index.jhtml?ptnrS=ZKxdm200YYIT&ptb=ZiTdY8JEgVGjRLy416Mopg&n=77ced087 IE: E&sporta in Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {34791712-14DF-4B36-B393-769A0DB611A4} = 217.12.180.19,217.12.181.97 . - - - - CHIAVI ORFANE RIMOSSE - - - - Notify-avgrsstarter - avgrsstx.dll ************************************************************************** scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: ************************************************************************** . --------------------- Dlls caricate dai processi in esecuzione --------------------- - - - - - - - > 'explorer.exe'(2560) d:\windows\system32\msi.dll d:\windows\system32\WPDShServiceObj.dll d:\windows\system32\PortableDeviceTypes.dll d:\windows\system32\PortableDeviceApi.dll . ------------------------ Altri processi in esecuzione ------------------------ . d:\programmi\Alwil Software\Avast5\AvastSvc.exe d:\windows\SOUNDMAN.EXE d:\windows\system32\wscntfy.exe . ************************************************************************** . Ora fine scansione: 2010-05-11 12:38:09 - Il pc è stato riavviato ComboFix-quarantined-files.txt 2010-05-11 10:38 ComboFix2.txt 2009-10-02 07:12 ComboFix3.txt 2009-10-01 20:16 Pre-Run: 3.528.200.192 byte disponibili Post-Run: 3.778.289.664 byte disponibili - - End Of File - - 451EB241A281BA5255D0D7EA083E1D52

di **pepper70** » 11/05/10 20:51

Ciao Elektra, grazie per l'intervento.
Ho seguito i tuoi consigli, ecco come richiesto il rapporto di Combofix:
ComboFix 10-05-10.03 - Falco 11/05/2010 21.08.27.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1022.743 [GMT 2:00]
Eseguito da: d:\documents and settings\Falco\Desktop\ComboFix.exe
AV: avast! Internet Security *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((( Files Creati Da 2010-04-11 al 2010-05-11 )))))))))))))))))))))))))))))))))))
.

2010-05-11 09:53 . 2010-05-11 09:53 397824 ----a-w- d:\windows\system32\CF1716.exe
2010-05-06 20:28 . 2010-05-06 20:28 -------- d-----w- d:\documents and settings\NetworkService\Impostazioni locali\Dati applicazioni\Google
2010-05-06 20:23 . 2010-05-06 20:23 -------- d-----w- d:\documents and settings\LocalService\Impostazioni locali\Dati applicazioni\Google
2010-05-06 20:22 . 2010-05-06 20:49 -------- d-----w- d:\programmi\Google
2010-05-05 20:21 . 2010-05-05 20:21 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\AVS4YOU
2010-05-05 20:20 . 2010-05-05 20:20 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\AVS4YOU
2010-05-05 20:16 . 2010-05-05 20:17 -------- d-----w- d:\programmi\File comuni\AVSMedia
2010-05-05 20:16 . 2003-05-21 22:50 1700352 ----a-w- d:\windows\system32\GdiPlus.dll
2010-05-05 20:14 . 2010-05-05 20:14 -------- d-----w- d:\windows\system32\drivers\umdf
2010-05-05 20:14 . 2006-08-11 18:14 22752 ----a-w- d:\windows\system32\spupdsvc.exe
2010-05-05 20:13 . 2003-05-21 10:50 24576 ----a-w- d:\windows\system32\msxml3a.dll
2010-05-05 20:13 . 2010-05-05 22:01 -------- d-----w- d:\programmi\AVS4YOU
2010-05-02 18:40 . 2010-05-02 18:40 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\AccurateRip
2010-05-02 18:39 . 2010-05-02 18:40 -------- d-----w- d:\programmi\Exact Audio Copy
2010-04-30 20:36 . 2010-04-30 20:36 -------- d-----w- d:\programmi\Alwil Software
2010-04-30 20:36 . 2010-04-30 20:36 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\Alwil Software
2010-04-30 10:12 . 2010-04-30 10:12 -------- d--h--w- d:\windows\PIF
2010-04-28 12:33 . 2010-04-28 12:33 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\Malwarebytes
2010-04-28 12:32 . 2010-04-29 13:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-04-28 12:32 . 2010-04-28 12:32 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\Malwarebytes
2010-04-28 12:32 . 2010-04-29 13:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-04-28 12:32 . 2010-04-30 05:47 -------- d-----w- d:\programmi\Malwarebytes' Anti-Malware
2010-04-27 20:32 . 2010-04-27 20:32 -------- d-----w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\ESET
2010-04-27 12:49 . 2010-04-27 12:49 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\ESET
2010-04-27 10:59 . 2010-04-27 10:59 -------- d-----w- d:\programmi\Trend Micro
2010-04-26 21:26 . 2010-04-26 21:26 -------- d-----w- d:\windows\system32\wbem\Repository
2010-04-26 07:45 . 2010-04-26 07:45 -------- d-----w- d:\documents and settings\NetworkService\Menu Avvio
2010-04-25 22:11 . 2009-03-24 14:08 55640 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-04-25 22:11 . 2010-04-26 20:52 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\Avira
2010-04-25 08:05 . 2010-04-25 08:05 -------- d-----w- d:\programmi\uTorrent
2010-04-25 08:04 . 2010-05-11 18:10 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\uTorrent
2010-04-25 07:17 . 2010-04-25 07:17 -------- d-----w- d:\programmi\EasyPrediction
2010-04-24 18:34 . 2010-04-24 18:34 -------- d-----w- d:\programmi\eMule
2010-04-22 19:53 . 2010-05-06 20:30 -------- d-----w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Temp
2010-04-22 19:53 . 2010-05-06 20:31 -------- d-----w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google
2010-04-22 15:16 . 2010-04-22 15:16 184320 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\wlan4.dll
2010-04-22 15:16 . 2010-04-22 15:16 10752 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\system.dll
2010-04-22 15:16 . 2010-04-22 15:16 90624 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\secure.dll
2010-04-22 15:16 . 2010-04-22 15:16 116736 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\roting4.dll
2010-04-22 15:16 . 2010-04-22 15:16 71168 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\mpls.dll
2010-04-22 15:16 . 2010-04-22 15:16 109056 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\ppp.dll
2010-04-22 15:16 . 2010-04-22 15:16 69632 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\dhcp.dll
2010-04-22 15:16 . 2010-04-22 15:16 69632 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\advtool.dll
2010-04-22 15:15 . 2010-04-22 15:16 1531904 ----a-w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik\Winbox\4.5\roteros.dll
2010-04-22 15:15 . 2010-04-22 15:15 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\Mikrotik

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-25 21:45 . 2009-11-01 14:45 -------- d-----w- d:\docume~1\ALLUSE~1\DATIAP~1\avg9
2010-04-25 21:45 . 2009-06-20 20:33 -------- d-----w- d:\programmi\AVG
2010-04-25 05:36 . 2010-03-15 08:53 -------- d---a-w- d:\docume~1\ALLUSE~1\DATIAP~1\TEMP
2010-04-25 05:35 . 2010-03-15 08:53 -------- d-----w- d:\programmi\SpywareBlaster
2010-04-15 20:37 . 2010-04-08 09:29 -------- d-----w- d:\documents and settings\Falco\Dati applicazioni\Vso
2010-04-14 16:47 . 2010-04-30 20:37 38848 ----a-w- d:\windows\system32\avastSS.scr
2010-04-14 16:47 . 2010-04-30 20:37 153184 ----a-w- d:\windows\system32\aswBoot.exe
2010-04-14 16:37 . 2010-04-30 20:37 102736 ----a-w- d:\windows\system32\drivers\aswFW.sys
2010-04-14 16:37 . 2010-04-30 20:37 297552 ----a-w- d:\windows\system32\drivers\aswSnx.sys
2010-04-14 16:36 . 2010-04-30 20:37 196048 ----a-w- d:\windows\system32\drivers\aswNdis2.sys
2010-04-14 16:35 . 2010-04-30 20:37 46672 ----a-w- d:\windows\system32\drivers\aswTdi.sys
2010-04-14 16:35 . 2010-04-30 20:37 162768 ----a-w- d:\windows\system32\drivers\aswSP.sys
2010-04-14 16:31 . 2010-04-30 20:37 23376 ----a-w- d:\windows\system32\drivers\aswRdr.sys
2010-04-14 16:31 . 2010-04-30 20:37 100432 ----a-w- d:\windows\system32\drivers\aswmon2.sys
2010-04-14 16:31 . 2010-04-30 20:37 94800 ----a-w- d:\windows\system32\drivers\aswmon.sys
2010-04-14 16:31 . 2010-04-30 20:37 19024 ----a-w- d:\windows\system32\drivers\aswFsBlk.sys
2010-04-14 16:30 . 2010-04-30 20:37 28880 ----a-w- d:\windows\system32\drivers\aavmker4.sys
2010-04-10 18:48 . 2009-07-05 18:26 69224 ----a-w- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-04-08 09:29 . 2010-04-08 09:29 47360 ----a-w- d:\windows\system32\drivers\pcouffin.sys
2010-04-08 09:29 . 2010-04-08 09:29 47360 ----a-w- d:\documents and settings\Falco\Dati applicazioni\pcouffin.sys
2010-04-08 09:29 . 2010-04-08 09:29 47360 ----a-w- d:\documents and settings\Falco\Dati applicazioni\pcouffin.sys
2010-04-08 09:29 . 2010-04-08 09:29 -------- d-----w- d:\programmi\vso
2010-03-28 08:36 . 2001-08-31 18:00 48568 ----a-w- d:\windows\system32\perfc010.dat
2010-03-28 08:36 . 2001-08-31 18:00 347866 ----a-w- d:\windows\system32\perfh010.dat
2010-03-19 19:10 . 2010-04-30 20:37 12112 ----a-w- d:\windows\system32\drivers\aswNdis.sys
.

------- Sigcheck -------

[-] 2006-04-11 . 744BE027C16680791A6AC13E0EF35F8F . 1548288 . . [5.1.2600.2180] . . d:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-04-14 16:33 140288 ----a-w- d:\programmi\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2010-04-22 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"Malwarebytes' Anti-Malware"="d:\programmi\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
"avast5"="d:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="d:\windows\system32\tscupgrd.exe" [2004-08-19 44544]

d:\documents and settings\Falco\Menu Avvio\Programmi\Esecuzione automatica\
Ritaglio schermata e avvio di OneNote 2007.lnk - d:\programmi\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

d:\docume~1\ALLUSE~1\MENUAV~1\PROGRA~1\ESECUZ~1\
Avvio veloce di Adobe Reader.lnk - d:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Programmi\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Programmi\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Programmi\\eMule\\emule.exe"=
"d:\\Programmi\\uTorrent\\uTorrent.exe"=

R0 aswNdis;avast! Firewall NDIS Filter Service;d:\windows\system32\drivers\aswNdis.sys [30/04/2010 22.37.02 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;d:\windows\system32\drivers\aswNdis2.sys [30/04/2010 22.37.23 196048]
R1 aswFW;avast! TDI Firewall driver;d:\windows\system32\drivers\aswFW.sys [30/04/2010 22.37.35 102736]
R1 aswSnx;aswSnx;d:\windows\system32\drivers\aswSnx.sys [30/04/2010 22.37.35 297552]
R1 aswSP;aswSP;d:\windows\system32\drivers\aswSP.sys [30/04/2010 22.37.36 162768]
R1 ehdrv;ehdrv;d:\windows\system32\drivers\ehdrv.sys [01/10/2009 15.06.40 108792]
R1 epfwtdir;epfwtdir;d:\windows\system32\drivers\epfwtdir.sys [01/10/2009 15.07.30 96408]
R2 aswFsBlk;aswFsBlk;d:\windows\system32\drivers\aswFsBlk.sys [30/04/2010 22.37.36 19024]
R3 MBAMProtector;MBAMProtector;d:\windows\system32\drivers\mbam.sys [28/04/2010 14.32.54 20952]
S2 avast! Firewall;avast! Firewall;d:\programmi\Alwil Software\Avast5\afwServ.exe [30/04/2010 22.37.02 119200]
S2 MBAMService;MBAMService;d:\programmi\Malwarebytes' Anti-Malware\mbamservice.exe [28/04/2010 14.33.01 304464]
.
Contenuto della cartella 'Scheduled Tasks'

2010-05-11 d:\windows\Tasks\AWC AutoSweep.job
- d:\programmi\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-10-01 10:17]

2010-05-10 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-606747145-1801674531-1003Core.job
- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-04-22 19:53]

2010-05-11 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-606747145-1801674531-1003UA.job
- d:\documents and settings\Falco\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2010-04-22 19:53]
.
.
------- Scansione supplementare -------
.
IE: E&sporta in Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {34791712-14DF-4B36-B393-769A0DB611A4} = 217.12.180.19,217.12.181.97
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 21:23
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(2432)
d:\windows\system32\msi.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
Ora fine scansione: 2010-05-11 21:24:54
ComboFix-quarantined-files.txt 2010-05-11 19:24
ComboFix2.txt 2010-05-11 10:38
ComboFix3.txt 2009-10-02 07:12
ComboFix4.txt 2009-10-01 20:16

Pre-Run: 3.943.571.456 byte disponibili
Post-Run: 3.916.386.304 byte disponibili

- - End Of File - - 16C5954F24ED0A17C6CD6F3983E1CFA9

Errore in explorer.exe: L'applicazione verrà chiusa

Errore in explorer.exe: L'applicazione verrà chiusa

Re: Errore in explorer.exe...? Altro virus?

Re: Errore in explorer.exe...? Altro virus?

Re: Errore in explorer.exe: L'applicazione verrà chiusa

Re: Errore in explorer.exe: L'applicazione verrà chiusa

Re: Errore in explorer.exe: L'applicazione verrà chiusa

Re: Errore in explorer.exe: L'applicazione verrà chiusa

Re: Errore in explorer.exe: L'applicazione verrà chiusa

Topic correlati a "Errore in explorer.exe: L'applicazione verrà chiusa":

Chi c’è in linea