di @manu@ » 30/08/08 22:24
HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ avgnt Antivirus System Tray Tool (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\avgnt.exe
+ Easy-PrintToolBox BJPSMAIN (Not verified) CANON INC. c:\programmi\canon\easy-printtoolbox\bjpsmain.exe
+ I downloaded pirated Software from P2P File not found: Virtua
+ JMB36X Configure JMB36X RAID Configurer (Not verified) JMicron Technology Corp. c:\windows\system32\jmraidtool.exe
+ Media Codec Update Service Windows Essencials Media Codecs Update Service (Not verified) MediaCodec.Org c:\programmi\essentials codec pack\update.exe
+ NeroFilterCheck NeroCheck (Not verified) Ahead Software Gmbh c:\windows\system32\nerocheck.exe
+ nwiz NVIDIA nView Wizard, Version 111.75 (Not verified) NVIDIA Corporation c:\windows\system32\nwiz.exe
+ QuickTime Task QuickTime Task (Not verified) Apple Inc. c:\programmi\quicktime\qttask.exe
+ SoundMAX Audio Control Panel (Not verified) Analog Devices, Inc. c:\programmi\analog devices\soundmax\smax4.exe
+ SunJavaUpdateSched Java(TM) Platform SE binary (Verified) Sun Microsystems, Inc. c:\programmi\java\jre1.6.0_03\bin\jusched.exe
+ VirtualCloneDrive Virtual CloneDrive Daemon (Not verified) Elaborate Bytes AG c:\programmi\elaborate bytes\virtualclonedrive\vcddaemon.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Documents and Settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica
+ Avvio veloce di Adobe Reader.lnk Adobe Acrobat SpeedLauncher (Not verified) Adobe Systems Incorporated c:\programmi\adobe\acrobat 7.0\reader\reader_sl.exe
+ BlueSoleil.lnk Bluetooth Application (Not verified) IVT Corporation c:\programmi\ivt corporation\bluesoleil\bluesoleil.exe
+ Google Updater.lnk Google Updater (Verified) Google Inc c:\programmi\google\google updater\googleupdater.exe
C:\Documents and Settings\Elisa Capera\Menu Avvio\Programmi\Esecuzione automatica
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ PC Suite Tray Nokia Launch Application c:\programmi\nokia\nokia pc suite 6\pcsuite.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Shutdown
HKLM\SOFTWARE\Classes\Protocols\Filter
HKLM\SOFTWARE\Classes\Protocols\Handler
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
+ 0 File not found: About:Home
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKCU\Software\Classes\*\ShellEx\ContextMenuHandlers
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers
+ EzCddax c:\programmi\easy cd-da extractor 10\ezcddax10.dll
+ NBShellHook Class Nero BackItUp Application (Not verified) Nero AG c:\programmi\nero\nero 7\nero backitup\nbshell.dll
+ Shell Extension for Malware scanning ShlExt.dll (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\shlext.dll
+ WinRAR c:\programmi\winrar\rarext.dll
HKCU\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers
HKCU\Software\Classes\Directory\ShellEx\ContextMenuHandlers
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
+ WinRAR c:\programmi\winrar\rarext.dll
HKCU\Software\Classes\Directory\Shellex\DragDropHandlers
HKLM\Software\Classes\Directory\Shellex\DragDropHandlers
+ WinRAR c:\programmi\winrar\rarext.dll
HKCU\Software\Classes\Directory\Shellex\PropertySheetHandlers
HKLM\Software\Classes\Directory\Shellex\PropertySheetHandlers
HKCU\Software\Classes\Directory\Shellex\CopyHookHandlers
HKLM\Software\Classes\Directory\Shellex\CopyHookHandlers
+ Nokia Phone Browser (Not verified) Nokia c:\programmi\nokia\nokia pc suite 6\phonebrowser.dll
HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
+ NeroDigitalColumnHandler Class Nero Digital Shell Extension (Not verified) Nero AG c:\programmi\file comuni\ahead\lib\nerodigitalext.dll
+ PDF Shell Extension PDF Shell Extension (Not verified) Adobe Systems, Inc. c:\programmi\adobe\acrobat 7.0\activex\pdfshell.dll
+ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} (Not verified) Sun Microsystems, Inc. c:\programmi\openoffice.org 2.3\program\shlxthdl.dll
HKCU\Software\Classes\Folder\ShellEx\ContextMenuHandlers
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers
+ NBShellHook Class Nero BackItUp Application (Not verified) Nero AG c:\programmi\nero\nero 7\nero backitup\nbshell.dll
+ Shell Extension for Malware scanning ShlExt.dll (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\shlext.dll
+ WinRAR c:\programmi\winrar\rarext.dll
HKCU\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
+ 00nView NVIDIA Desktop Explorer, Version 111.75 (Not verified) NVIDIA Corporation c:\windows\system32\nvshell.dll
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
HKCU\Software\Microsoft\Ctf\LangBarAddin
HKLM\Software\Microsoft\Ctf\LangBarAddin
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ AlcoholShellEx AXShlEx.dll (Not verified) Alcohol Soft Development Team c:\programmi\alcohol soft\alcohol 120\axshlex.dll
+ Desktop Explorer NVIDIA Desktop Explorer, Version 111.75 (Not verified) NVIDIA Corporation c:\windows\system32\nvshell.dll
+ Desktop Explorer Menu NVIDIA Desktop Explorer, Version 111.75 (Not verified) NVIDIA Corporation c:\windows\system32\nvshell.dll
+ Estensione panoramica video del Pannello di controllo File not found: deskpan.dll
+ EzCddax extension c:\programmi\easy cd-da extractor 10\ezcddax10.dll
+ NeroDigitalIconHandler Nero Digital Shell Extension (Not verified) Nero AG c:\programmi\file comuni\ahead\lib\nerodigitalext.dll
+ NeroDigitalPropSheetHandler Nero Digital Shell Extension (Not verified) Nero AG c:\programmi\file comuni\ahead\lib\nerodigitalext.dll
+ Nokia Phone Browser Phone Browser (Not verified) Nokia c:\programmi\nokia\nokia pc suite 6\phonebrowser.dll
+ nView Desktop Context Menu NVIDIA Desktop Explorer, Version 111.75 (Not verified) NVIDIA Corporation c:\windows\system32\nvshell.dll
+ OpenOffice.org Column Handler (Not verified) Sun Microsystems, Inc. c:\programmi\openoffice.org 2.3\program\shlxthdl.dll
+ OpenOffice.org Infotip Handler (Not verified) Sun Microsystems, Inc. c:\programmi\openoffice.org 2.3\program\shlxthdl.dll
+ OpenOffice.org Property Sheet Handler (Not verified) Sun Microsystems, Inc. c:\programmi\openoffice.org 2.3\program\shlxthdl.dll
+ OpenOffice.org Thumbnail Viewer (Not verified) Sun Microsystems, Inc. c:\programmi\openoffice.org 2.3\program\shlxthdl.dll
+ Shell Extension for Malware scanning ShlExt.dll (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\shlext.dll
+ VirtualCloneDrive CloseTray (Not verified) Elaborate Bytes AG c:\programmi\elaborate bytes\virtualclonedrive\elbyvcdshell.dll
+ WinRAR shell extension c:\programmi\winrar\rarext.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ AcroIEHlprObj Class Adobe Acrobat IE Helper Version 7.0 for ActiveX (Verified) Adobe Systems, Incorporated c:\programmi\adobe\acrobat 7.0\activex\acroiehelper.dll
+ Google Toolbar Notifier BHO GoogleToolbarNotifier (Verified) Google Inc c:\programmi\google\googletoolbarnotifier\2.1.1119.1736\swg.dll
+ SSVHelper Class Java(TM) Platform SE binary (Verified) Sun Microsystems, Inc. c:\programmi\java\jre1.6.0_03\bin\ssv.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
HKLM\Software\Microsoft\Internet Explorer\Toolbar
+ Easy-WebPrint Easy-WebPrint c:\programmi\canon\easy-webprint\toolband.dll
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Extensions
HKLM\Software\Microsoft\Internet Explorer\Extensions
Task Scheduler
+ AppleSoftwareUpdate.job Apple Software Update (Verified) Apple Computer, Inc. c:\programmi\apple software update\softwareupdate.exe
+ At1.job File not found: C:\WINDOWS\system32\wunauclt.exe
+ At2.job File not found: C:\WINDOWS\system32\wunauclt.exe
+ At3.job File not found: C:\WINDOWS\system32\wunauclt.exe
HKLM\System\CurrentControlSet\Services
+ AntiVirMailService Offers permanent protection against viruses and malware for email clients with the AntiVir search engine. (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\avmailc.exe
+ AntiVirScheduler Service to schedule AntiVir jobs and updates. (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\sched.exe
+ AntiVirService Offers permanent protection against viruses and malware with the AntiVir search engine. (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\avguard.exe
+ AVEService Helper service for the AntiVir MailGuard. (Not verified) Avira GmbH c:\programmi\antivir personaledition premium\avesvc.exe
+ BlueSoleil Hid Service c:\programmi\ivt corporation\bluesoleil\btntservice.exe
+ gusvc gusvc (Verified) Google Inc c:\programmi\google\common\google updater\googleupdaterservice.exe
+ StarWindService Enables network access to local devices via iSCSI protocol. (Not verified) Rocket Division Software c:\programmi\alcohol soft\alcohol 120\starwind\starwindservice.exe
HKLM\System\CurrentControlSet\Services
+ avgio Avira AntiVir Support for Minifilter (Verified) Avira GmbH c:\programmi\antivir personaledition premium\avgio.sys
+ avgntflt Avira AntiVir PersonalEdition Premium mini-filter used for on-access scan to provide real-time antivirus security. (Verified) Avira GmbH c:\programmi\antivir personaledition premium\avgntflt.sys
+ avipbb %avipbbServiceDesc% (Verified) Avira GmbH c:\windows\system32\drivers\avipbb.sys
+ BlueletAudio Bluelet Audio Driver (Not verified) IVT Corporation c:\windows\system32\drivers\blueletaudio.sys
+ BT Bluetooth PAN Network Adapter Driver (Not verified) IVT Corporation c:\windows\system32\drivers\btnetdrv.sys
+ Btcsrusb Bluetooth USB Device Driver (Not verified) IVT Corporation c:\windows\system32\drivers\btcusb.sys
+ BTHidEnum c:\windows\system32\drivers\vbtenum.sys
+ BTHidMgr Bluetooth HID Manager driver (Not verified) IVT Corporation c:\windows\system32\drivers\bthidmgr.sys
+ Changer File not found: C:\WINDOWS\System32\Drivers\Changer.sys
+ ElbyCDIO ElbyCD Windows NT/2000/XP I/O driver (Verified) Elaborate Bytes AG c:\windows\system32\drivers\elbycdio.sys
+ ElbyDelay Elby Delay Lower Filter Driver (Verified) Elaborate Bytes AG c:\windows\system32\drivers\elbydelay.sys
+ i2omgmt File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys
+ InCDPass File not found: system32\drivers\InCDPass.sys
+ InCDRm File not found: system32\drivers\InCDRm.sys
+ lbrtfdc File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys
+ PCIDump File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys
+ PDCOMP File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys
+ PDFRAME File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys
+ PDRELI File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys
+ PDRFRAME File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys
+ ssmdrv Avira Snapshot Driver (Verified) Avira GmbH c:\windows\system32\drivers\ssmdrv.sys
+ Vax347b Plug and Play BIOS Extension (Not verified) c:\windows\system32\drivers\vax347b.sys
+ Vax347s SCSI miniport (Not verified) c:\windows\system32\drivers\vax347s.sys
+ VClone VirtualCloneCD Driver (Not verified) Elaborate Bytes AG c:\windows\system32\drivers\vclone.sys
+ VComm Bluetooth Serial Port Driver (Not verified) IVT Corporation c:\windows\system32\drivers\vcomm.sys
+ VcommMgr Bluetooth VcommMgr driver (Not verified) IVT Corporation c:\windows\system32\drivers\vcommmgr.sys
+ WDICA File not found: C:\WINDOWS\System32\Drivers\WDICA.sys
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute
HKLM\System\CurrentControlSet\Control\Session Manager\Execute
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\Software\Microsoft\Command Processor\Autorun
HKCU\Software\Microsoft\Command Processor\Autorun
HKLM\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
+ WgaLogon Windows Genuine Advantage Notification (Not verified) Microsoft Corporation c:\windows\system32\wgalogon.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman
HKCU\Control Panel\Desktop\Scrnsave.exe
HKLM\System\CurrentControlSet\Control\BootVerificationProgram\ImagePath
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
+ 000000000001 AntiVir layered service provider (Not verified) Avira GmbH c:\windows\system32\avsda.dll
+ 000000000002 AntiVir layered service provider (Not verified) Avira GmbH c:\windows\system32\avsda.dll
+ 000000000008 AntiVir layered service provider (Not verified) Avira GmbH c:\windows\system32\avsda.dll
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
Registrazione
