Si è verificato un errore wuauclt

[Carlodam]

Buogiorno a tutti. é da un po' di giorni che nel PC di mia figlia si presenta, in continuazione, la finestra di errore "Si è verificato un eroore wuauclt. L'applicazione verrà chiusa". Ho letto nel forum problematiche simili. Ho eseguito ciò che veniva suggerito ma senza risultati. Digitando "eventvwr" mi dice che il modulo in errore è "esent.dll"
Vi post il log di hijackthis. C'è qualcuno che può aiutarmi?
Grazie

Logfile of HijackThis v1.99.1
Scan saved at 9.58.09, on 10/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\Symantec AntiVirus\DefWatch.exe
C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Symantec AntiVirus\Rtvscan.exe
C:\Programmi\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Arcade\PCMService.exe
C:\Programmi\Launch Manager\QtZgAcer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\sistray.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Windows Live Toolbar\msn_sl.exe
C:\Programmi\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/av ... x_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LManager] C:\Programmi\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [pdfFactory Dispatcher v3] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Programmi\Picasa2\PicasaMediaDetector.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan ... stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://iganja.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programmi\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programmi\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programmi\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programmi\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programmi\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Programmi\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

[MIKI68]

Sarà stato qualche aggiornamento.....si tratta di XP Home edition? Fai una cosa, da start esegui digita.
regsvr32 esent.dll e dai Ok, poi riavvia il pc e vedi se esce ancora l'errore

[Carlodam]

Sarà stato qualche aggiornamento.....si tratta di XP Home edition? Fai una cosa, da start esegui digita.
regsvr32 esent.dll e dai Ok, poi riavvia il pc e vedi se esce ancora l'errore

Grazie MIKI68 per la risposta. Avevo già provato a fare quanto da te suggerito; ho avuto questo messaggio di risposta " esent.dll è stato caricato, ma il punto di ingresso DIRegisterServer non è stato trovato. Questo file non può essere registrato." Ho in ogni caso riavviato ma è stato inutile.
Hai qualche altro suggerimento?
Ciao e gazie per l'interessamento al mio problema.

[Carlodam]

Dimenticavo: si, si tratta di XP Home Edition.

Ciao

[MIKI68]

Vuoi provare a scaricarla??Vedi prima se la trovi in system e poi scarica http://74.125.43.132/translate_c?hl=it& ... alO9izWvvA

[Carlodam]

Vuoi provare a scaricarla??Vedi prima se la trovi in system e poi scarica http://74.125.43.132/translate_c?hl=it& ... alO9izWvvA

Ho eseguito un "cerca" e ho trovato tre file esent.dll (tutti e tre versione 5.1.2600.5512) esattamente in :C:\windows\system32; C:\windows\ServicePackFiles\i386 e in C:\windows\SoftwareDistribution\Download\fc8......

E' il caso che me la scarichi ugualmente? se si, quale versione?

[MIKI68]

Allora vedi nel registro di sistema è presente questa voce?? HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ Microsoft auto update = Wuauclt.exe Se è presente, scarica malwarebyte da qui http://www.ilsoftware.it/querydl.asp?id=1078 Installa, aggiorna, poi in opzioni cartella metti la spunta a "visualizza file e cartelle nascoste" e avvia malwarebyte Puoi avviarlo anche in modalità provvisoria!!!

[Carlodam]

Allora vedi nel registro di sistema è presente questa voce?? HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ Microsoft auto update = Wuauclt.exe Se è presente, scarica malwarebyte da qui http://www.ilsoftware.it/querydl.asp?id=1078 Installa, aggiorna, poi in opzioni cartella metti la spunta a "visualizza file e cartelle nascoste" e avvia malwarebyte Puoi avviarlo anche in modalità provvisoria!!!

Non credo di essere molto esperto..... comunque ho lanciato da "start" "esegui" il comando "regedit" ed ho inserito nella finestra "trova" la stringa da te suggerita, ma non è stata trovata. Ho comunque seguito il tuo suggerimento, ho installato ed avviato malwarebyte. ha trovato un "dialer" ho riavviato ma il problema sussiste.
Hai qualche altra idea?

[MIKI68]

Posta il report di malwarebyte, e poi scarica e segui queste istruzioni: http://sharethefiles.altervista.org/for ... =118&t=527 scarica combofix ( sempre dal sito) e segui le istruzioni

[Carlodam]

Posta il report di malwarebyte, e poi scarica e segui queste istruzioni: http://sharethefiles.altervista.org/for ... =118&t=527 scarica combofix ( sempre dal sito) e segui le istruzioni

Ho fatto, non senza difficoltà, quanto suggerito. POsto sia il report di malwarebyte che conbofix.txt (non ho scaricato avenger, giusto?). Non so se possa esser utile, ma mia figlia crede di ricordare che il problema sia sorto dopo l'installazione di "pcfriend".

Malwarebytes' Anti-Malware 1.34
Versione del database: 1831
Windows 5.1.2600 Service Pack 3
10/03/2009 19.35.39
mbam-log-2009-03-10 (19-35-39).txt

Tipo di scansione: Scansione rapida
Elementi scansionati: 72425
Tempo trascorso: 4 minute(s), 42 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 1
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 0

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)
Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db893839-10f0-4af9-92fa-b23528f530af} (Dialer) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Nessun elemento malevolo rilevato)
Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)
Cartelle infette:
(Nessun elemento malevolo rilevato)
File infetti:
(Nessun elemento malevolo rilevato)


ComboFix 09-03-10.03 - utente 2009-03-11 17.57.58.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.957.523 [GMT 1:00]
Eseguito da: c:\documents and settings\utente\desktop\combofix.exe
Opzioni usate :: /killall
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
FW: Kerio Personal Firewall *enabled*
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\utente\Menu Avvio\Programmi\Videos.url
c:\documents and settings\utente\Preferiti\Videos.url
c:\windows\autorun.inf

.
((((((((((((((((((((((((( Files Creati Da 2009-02-11 al 2009-03-11 )))))))))))))))))))))))))))))))))))
.

2009-03-10 20:41 . 2009-03-10 20:41 <DIR> d-------- c:\documents and settings\Administrator\Dati applicazioni\Malwarebytes
2009-03-10 19:22 . 2009-03-10 19:22 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2009-03-10 19:22 . 2009-03-10 19:22 <DIR> d-------- c:\documents and settings\utente\Dati applicazioni\Malwarebytes
2009-03-10 19:22 . 2009-03-10 19:22 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-03-10 19:22 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-10 19:22 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-10 12:37 . 2009-03-10 12:37 <DIR> d-------- c:\programmi\iTunes
2009-03-10 12:37 . 2009-03-10 12:37 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-10 12:34 . 2009-03-10 12:34 <DIR> d-------- c:\programmi\Bonjour
2009-03-10 10:41 . 2009-03-08 12:10 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-03-08 12:10 . 2009-03-08 12:10 <DIR> d-------- c:\documents and settings\utente\.housecall6.6
2009-03-08 09:58 . 2009-03-08 09:58 <DIR> d-------- c:\programmi\Apple Software Update
2009-03-07 15:02 . 2009-03-07 15:02 <DIR> d-------- c:\programmi\Panda Security
2009-03-07 15:02 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-03-07 11:27 . 2009-03-07 11:28 <DIR> d-------- c:\documents and settings\Administrator\Dati applicazioni\Lavasoft
2009-03-07 10:11 . 2005-08-06 19:07 <DIR> d--h----- c:\documents and settings\Administrator\Risorse di stampa
2009-03-07 10:11 . 2005-08-06 19:07 <DIR> d--h----- c:\documents and settings\Administrator\Risorse di rete
2009-03-07 10:11 . 2005-08-06 19:23 <DIR> dr------- c:\documents and settings\Administrator\Preferiti
2009-03-07 10:11 . 2005-08-06 19:07 <DIR> d--h----- c:\documents and settings\Administrator\Modelli
2009-03-07 10:11 . 2005-08-06 19:07 <DIR> dr------- c:\documents and settings\Administrator\Menu Avvio
2009-03-07 10:11 . 2005-08-06 19:07 <DIR> d--h----- c:\documents and settings\Administrator\Impostazioni locali
2009-03-07 10:11 . 2005-08-06 19:23 <DIR> dr------- c:\documents and settings\Administrator\Documenti
2009-03-07 10:11 . 2005-08-06 19:07 <DIR> dr-h----- c:\documents and settings\Administrator\Dati applicazioni
2009-03-07 10:11 . 2009-03-07 10:11 <DIR> d-------- c:\documents and settings\Administrator
2009-03-06 20:59 . 2009-03-06 20:59 <DIR> d-------- c:\programmi\Lavasoft
2009-03-02 00:29 . 2009-03-02 00:29 <DIR> d--hs---- C:\FOUND.001
2009-03-01 00:29 . 2009-03-01 00:29 <DIR> d--hs---- C:\FOUND.000
2009-02-14 14:47 . 2009-02-14 14:47 0 --a------ c:\windows\pcfriend.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-10 19:40 1,644 ----a-w c:\windows\system32\drivers\fwdrv.err
2009-01-16 20:15 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-31 16:04 691,560 ----a-w c:\windows\system32\OGACheckControl.dll
2008-12-31 16:04 528,744 ----a-w c:\windows\system32\OGAVerify.exe
2008-12-31 16:04 502,120 ----a-w c:\windows\system32\OGAAddin.dll
2008-12-20 22:30 63,488 ----a-w c:\windows\system32\dllcache\icardie.dll
2008-12-20 22:30 6,066,688 ----a-w c:\windows\system32\dllcache\ieframe.dll
2008-12-20 22:30 44,544 ----a-w c:\windows\system32\dllcache\iernonce.dll
2008-12-20 22:30 384,512 ----a-w c:\windows\system32\dllcache\iedkcs32.dll
2008-12-20 22:30 383,488 ----a-w c:\windows\system32\dllcache\ieapfltr.dll
2008-12-20 22:30 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll
2008-12-20 22:30 267,776 ----a-w c:\windows\system32\dllcache\iertutil.dll
2008-12-20 22:30 230,400 ----a-w c:\windows\system32\dllcache\ieaksie.dll
2008-12-20 22:30 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll
2008-12-20 22:30 153,088 ----a-w c:\windows\system32\dllcache\ieakeng.dll
2008-12-20 22:30 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll
2008-12-20 22:30 124,928 ----a-w c:\windows\system32\dllcache\advpack.dll
2008-12-19 09:12 70,656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ----a-w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ----a-w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2007-09-29 21:55 5,717,248 ----a-w c:\programmi\Foxit Reader.exe
2007-02-10 14:35 604 ---ha-w c:\programmi\STLL Notifier
2006-11-01 18:16 1,094,021 ----a-w c:\programmi\dvdshrink32setup.zip
2008-12-20 13:10 172,136 ----a-w c:\programmi\mozilla firefox\components\xpinstal.dll
2008-12-20 13:10 67,688 ----a-w c:\programmi\mozilla firefox\components\jar50.dll
2008-12-20 13:10 54,368 ----a-w c:\programmi\mozilla firefox\components\jsd3250.dll
2008-12-20 13:10 34,944 ----a-w c:\programmi\mozilla firefox\components\myspell.dll
2008-12-20 13:10 46,712 ----a-w c:\programmi\mozilla firefox\components\spellchk.dll
2007-09-05 19:40 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys
2007-07-18 12:19 88 --sh--r c:\windows\system32\96F6683119.sys
2008-08-31 08:22 32,768 --sha-w c:\windows\system32\config\systemprofile\Impostazioni locali\Cronologia\History.IE5\MSHist012008083120080901\index.dat
.

------- Sigcheck -------

2008-04-14 04:14 14336 bb8363abec09aa2f9b363484e282117c c:\windows\system32\svchost.exe
2008-04-14 04:14 14336 bb8363abec09aa2f9b363484e282117c c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\svchost.exe
2004-08-19 05:00 14336 73955b04f209d8a1c633867841267a96 c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-14 04:14 14336 bb8363abec09aa2f9b363484e282117c c:\windows\ServicePackFiles\i386\svchost.exe

2008-04-14 04:13 579584 fa94696c0727bd59e517c674cd6e7c72 c:\windows\system32\user32.dll
2008-04-14 04:13 579584 fa94696c0727bd59e517c674cd6e7c72 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\user32.dll
2007-03-08 17:37 578560 9daa2190a18739b657b58f794acf2e47 c:\windows\$NtServicePackUninstall$\user32.dll
2008-04-14 04:13 579584 fa94696c0727bd59e517c674cd6e7c72 c:\windows\ServicePackFiles\i386\user32.dll
2005-03-02 20:20 578048 488019bfe2b0f9f8cd8394276d5b664a c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 17:48 579072 bab4f995e526484a235a276e269aaf7f c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
2004-08-19 05:00 578048 08447bdfce5d1b1956f962602381f5c1 c:\windows\$NtUninstallKB890859$\user32.dll
2005-03-02 20:10 578048 14b5d6b20467dba209853d65d1f6a124 c:\windows\$NtUninstallKB925902$\user32.dll

2008-04-14 04:13 82432 d34f635ff28f2aabedc95bfeb891864c c:\windows\system32\ws2_32.dll
2008-04-14 04:13 82432 d34f635ff28f2aabedc95bfeb891864c c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\ws2_32.dll
2004-08-19 05:00 82944 12ead983c875ed9bcc8b90e3f77f2e4a c:\windows\$NtServicePackUninstall$\ws2_32.dll
2008-04-14 04:13 82432 d34f635ff28f2aabedc95bfeb891864c c:\windows\ServicePackFiles\i386\ws2_32.dll

2008-12-20 23:31 826368 ef1520f95dd25f48c18502005f5ee995 c:\windows\system32\wininet.dll
2008-12-20 23:31 826368 ef1520f95dd25f48c18502005f5ee995 c:\windows\system32\dllcache\wininet.dll
2008-04-14 04:13 668672 663e74d98d2e67c1343d367388edd711 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\wininet.dll
2008-04-14 04:13 668672 663e74d98d2e67c1343d367388edd711 c:\windows\ServicePackFiles\i386\wininet.dll
2006-06-23 13:25 667136 e189791bf401b57e3b4f6da28082ec82 c:\windows\$hf_mig$\KB918899\SP2QFE\wininet.dll
2006-09-14 09:36 667136 e7e30349db0e0e2203df5a4dd651db85 c:\windows\$hf_mig$\KB922760\SP2QFE\wininet.dll
2006-10-23 16:34 667136 2cde29a401b990086fc91969d3c6b66a c:\windows\$hf_mig$\KB925454\SP2QFE\wininet.dll
2007-03-23 11:29 823296 bc9ea33fe795c9734b76198fa50ba0ab c:\windows\$hf_mig$\KB931768-IE7\SP2QFE\wininet.dll
2007-04-25 10:27 823808 53e94666caf76fcbc79cfab8c296767a c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
2007-06-27 16:13 824320 0c7d45e58e856198d7c4018976627e01 c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
2007-08-20 11:48 825344 69d5497609b4fb0981f17074671e072b c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 00:21 825344 714d8a2b05b2aaf0c6a39241a1ed914f c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 02:40 825344 39ccda0e9b778792b06c1b9d794a9776 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 93db90be4a10ec784ddc9c8601a28aa6 c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 06:19 827392 fe184a2b736f216ccc22abeebb40787d c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2008-06-23 17:39 827904 bf9d17259082632f03f3ff5759c6ae32 c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2008-08-26 11:08 827904 8e694ec9da095e518d9447b3293208ea c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
2008-10-16 20:32 827904 f303cfed3d8b8348a54f7a53ddc7cca0 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
2008-12-21 00:47 827904 3f7320e0f75f2b5a7a9ad32aea08bf21 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
2006-10-23 16:34 667136 2cde29a401b990086fc91969d3c6b66a c:\windows\ie7\wininet.dll
2006-09-14 09:38 661504 d1eca43c392b30527b16971b385c665f c:\windows\$NtUninstallKB925454_0$\wininet.dll
2006-10-23 16:18 661504 db61007ade457193785e3d886381a994 c:\windows\$NtUninstallKB925454$\wininet.dll
2006-11-07 21:03 818688 92995334f993e6e49c25c6d02ec04401 c:\windows\ie7updates\KB928090-IE7\wininet.dll
2007-01-12 09:27 822784 be43d00d802c92f01c8cc952c6f483f8 c:\windows\ie7updates\KB931768-IE7\wininet.dll
2007-02-27 15:21 822784 8164eded30e6625ac6af12a7d15b0fba c:\windows\ie7updates\KB933566-IE7\wininet.dll
2007-04-25 09:37 822784 d34691a9ca8188c89f5a5fa47dc07f68 c:\windows\ie7updates\KB937143-IE7\wininet.dll
2007-06-27 15:23 823808 2513eaeb6c4172c7d7b5148cc41f7222 c:\windows\ie7updates\KB939653-IE7\wininet.dll
2007-08-20 11:57 824832 21aa12b75ce02358e0ad8c706680869f c:\windows\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 00:49 824832 419a6f3d56e469bcbe71128a78463da4 c:\windows\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 03:04 824832 ed2a73ab0eba3c4cb6794077cd09ec95 c:\windows\ie7updates\KB947864-IE7\wininet.dll
2008-03-01 14:58 826368 61d4f43d26ec9d21beb6f38f22b396ab c:\windows\ie7updates\KB950759-IE7\wininet.dll
2008-04-23 06:16 826368 c1089010bcc3fd01056d26e9a36bbb79 c:\windows\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 18:15 826368 4b54220877703198e55f61cb7b87979e c:\windows\ie7updates\KB956390-IE7\wininet.dll
2008-08-26 09:57 826368 d590241cadec69a1bc157dc0452c92d1 c:\windows\ie7updates\KB958215-IE7\wininet.dll
2008-10-16 21:04 826368 a4c79606c0d9835e8a5a8e5e5804ae60 c:\windows\ie7updates\KB961260-IE7\wininet.dll
2006-06-23 13:10 661504 ec8d1299c1fe0094afb125a9d89fe635 c:\windows\$NtUninstallKB922760$\wininet.dll

2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\system32\drivers\tcpip.sys
2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\system32\dllcache\tcpip.sys
2008-04-13 21:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\tcpip.sys
2007-10-30 18:20 360064 90caff4b094573449a0872a0f919b178 c:\windows\$NtUninstallKB951748_0$\tcpip.sys
2008-06-20 12:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\$NtServicePackUninstall$\tcpip.sys
2008-04-13 21:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\ServicePackFiles\i386\tcpip.sys
2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 17:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2008-04-13 21:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\$NtUninstallKB951748$\tcpip.sys
2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 c:\windows\$NtUninstallKB941644$\tcpip.sys

2008-04-14 04:14 510464 9259170d29b5a256735fcb8b80280857 c:\windows\system32\winlogon.exe
2008-04-14 04:14 510464 9259170d29b5a256735fcb8b80280857 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\winlogon.exe
2004-08-19 05:00 504832 4166454e2bcfcc20d1b8a5ac9feab243 c:\windows\$NtServicePackUninstall$\winlogon.exe
2008-04-14 04:14 510464 9259170d29b5a256735fcb8b80280857 c:\windows\ServicePackFiles\i386\winlogon.exe

2008-04-13 21:20 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys
2008-04-13 21:20 182656 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\ndis.sys
2004-08-19 05:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\$NtServicePackUninstall$\ndis.sys
2008-04-13 21:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys

2008-04-13 20:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\system32\drivers\ip6fw.sys
2008-04-13 20:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\ip6fw.sys
2004-08-19 05:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
2008-04-13 20:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\ServicePackFiles\i386\ip6fw.sys

2008-08-14 15:22 2069760 93fb9d817b37df1191b73db7bc2f4006 c:\windows\system32\ntkrnlpa.exe
2008-08-14 15:22 2069760 93fb9d817b37df1191b73db7bc2f4006 c:\windows\system32\dllcache\ntkrnlpa.exe
2008-04-14 03:54 2069632 5e95f445b70adcf8876d1203852262a1 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\ntkrnlpa.exe
2007-02-28 18:02 2061312 49baea1d9379df8cd897aff9f49bc9de c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
2008-04-14 03:54 2069632 5e95f445b70adcf8876d1203852262a1 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
2005-03-02 20:12 2060672 de16030e8209fd96eeb06d9e3d8c84a8 c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2006-12-19 19:44 2063104 0943f29440085d86a1b9b9c2356b45b4 c:\windows\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
2007-02-28 18:06 2063104 f89d8e24fbe047506d60b850d00bdee3 c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2008-08-14 19:25 2069760 c812d8551fd3b6acdbf7eb6b18b1b992 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
2004-08-19 05:00 2060544 4dc3a3626b02c39aa69aae6f64bfbc2d c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2008-04-14 03:54 2069632 5e95f445b70adcf8876d1203852262a1 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
2005-03-02 20:06 2060544 8f485cf9683f1220ba27d10281052fce c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe
2006-12-19 19:22 2061312 7373bd87175412862cf9e534c6aa5ec9 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe

2008-08-14 15:22 2192896 0f93d9366b222d63f9402f7ed45cf2a4 c:\windows\system32\ntoskrnl.exe
2008-08-14 15:22 2192896 0f93d9366b222d63f9402f7ed45cf2a4 c:\windows\system32\dllcache\ntoskrnl.exe
2008-04-14 03:55 2192768 7d804c28404e94f57967de3394201d55 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\ntoskrnl.exe
2007-02-28 18:02 2184064 5ec517cc0865808df80d2184b0131d27 c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
2008-04-14 03:55 2192768 7d804c28404e94f57967de3394201d55 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
2005-03-02 20:12 2183296 c120a33c71e706545cf26d6276bc0344 c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2006-12-19 19:44 2185728 ecb771f4cc4b5cd2b19b294fbd56f75d c:\windows\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
2007-02-28 18:06 2185856 763ea08993b467a3af048ef185b1f805 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2008-08-14 19:25 2192896 0ee73494680235d59f4e57301d7ad580 c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
2004-08-19 05:00 2184704 4591cf1f202181113de2996e79a2905a c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2008-04-14 03:55 2192768 7d804c28404e94f57967de3394201d55 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
2005-03-02 20:07 2183040 84e6643db22c06128576afbf89dfee70 c:\windows\$NtUninstallKB929338$\ntoskrnl.exe
2006-12-19 19:22 2184064 b33a2a0e76d3a2faa044b197e345458c c:\windows\$NtUninstallKB931784$\ntoskrnl.exe

2008-04-14 04:14 1036288 70d7f99d95615c3c278367756287db71 c:\windows\explorer.exe
2008-04-14 04:14 1036288 70d7f99d95615c3c278367756287db71 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\explorer.exe
2007-06-13 15:22 1035776 7e2817a623e16f830b660f81c0fd63da c:\windows\$NtServicePackUninstall$\explorer.exe
2008-04-14 04:14 1036288 70d7f99d95615c3c278367756287db71 c:\windows\ServicePackFiles\i386\explorer.exe
2007-06-13 15:10 1035776 b4e85805be6d23de697f7b3ba7492d0b c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-19 05:00 1034752 178d42bd8fc34a9837417a6ce1d6bb7b c:\windows\$NtUninstallKB938828$\explorer.exe

2008-04-14 04:14 109056 dac0440c89b1ea4e35684896d5bf856e c:\windows\system32\services.exe
2008-04-14 04:14 109056 dac0440c89b1ea4e35684896d5bf856e c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\services.exe
2004-08-19 05:00 108544 e77f6fa2a15390f1727f4c1c55b69da6 c:\windows\$NtServicePackUninstall$\services.exe
2008-04-14 04:14 109056 dac0440c89b1ea4e35684896d5bf856e c:\windows\ServicePackFiles\i386\services.exe

2008-04-14 04:14 13312 0fba335727905de8e4cb5a2cf438abf5 c:\windows\system32\lsass.exe
2008-04-14 04:14 13312 0fba335727905de8e4cb5a2cf438abf5 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\lsass.exe
2004-08-19 05:00 13312 0815e8da286775fa432c7c9ee5e10ba1 c:\windows\$NtServicePackUninstall$\lsass.exe
2008-04-14 04:14 13312 0fba335727905de8e4cb5a2cf438abf5 c:\windows\ServicePackFiles\i386\lsass.exe

2008-04-14 04:14 15360 f53cddef33a4c41336a782be3d170158 c:\windows\system32\ctfmon.exe
2008-04-14 04:14 15360 f53cddef33a4c41336a782be3d170158 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\ctfmon.exe
2004-08-19 05:00 15360 5b33b4265966ee063c7fbea28958d9c2 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 04:14 15360 f53cddef33a4c41336a782be3d170158 c:\windows\ServicePackFiles\i386\ctfmon.exe

2008-04-14 04:14 57856 60977c9bae8f86f9075829325303d0c9 c:\windows\system32\spoolsv.exe
2008-04-14 04:14 57856 60977c9bae8f86f9075829325303d0c9 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\spoolsv.exe
2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-14 04:14 57856 60977c9bae8f86f9075829325303d0c9 c:\windows\ServicePackFiles\i386\spoolsv.exe
2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe

2008-04-14 04:14 26624 df69726907357c3add243f48902b0331 c:\windows\system32\userinit.exe
2008-04-14 04:14 26624 df69726907357c3add243f48902b0331 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\userinit.exe
2004-08-19 05:00 25088 c1e7fe19f98a877bf8f941bf48148695 c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-14 04:14 26624 df69726907357c3add243f48902b0331 c:\windows\ServicePackFiles\i386\userinit.exe

2008-04-14 04:13 296960 fe5a5329ccfc33d645c33077ff04f052 c:\windows\system32\termsrv.dll
2008-04-14 04:13 296960 fe5a5329ccfc33d645c33077ff04f052 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\termsrv.dll
2004-08-19 05:00 296960 c06cd1890279603e15020757e02de56b c:\windows\$NtServicePackUninstall$\termsrv.dll
2008-04-14 04:13 296960 fe5a5329ccfc33d645c33077ff04f052 c:\windows\ServicePackFiles\i386\termsrv.dll

2008-04-14 04:13 1033728 06157539ebb8b87d47b9b6c5da44b62f c:\windows\system32\kernel32.dll
2008-04-14 04:13 1033728 06157539ebb8b87d47b9b6c5da44b62f c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\kernel32.dll
2007-04-16 17:54 1028608 eb1428078e1d10fdec060857aa526a9f c:\windows\$NtServicePackUninstall$\kernel32.dll
2008-04-14 04:13 1033728 06157539ebb8b87d47b9b6c5da44b62f c:\windows\ServicePackFiles\i386\kernel32.dll
2006-07-05 12:57 1029120 4bbaa51f3ce5852ae38c98f3e1272580 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
2007-04-16 18:09 1030144 6d9421a648f26b8640c63d0f8f2b7d48 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
2006-07-05 12:56 1028096 967c4531ea54a7afc019220206863d1b c:\windows\$NtUninstallKB935839$\kernel32.dll

2008-04-14 04:13 17408 2f331374433e3fe176bee155d9be83e1 c:\windows\system32\powrprof.dll
2008-04-14 04:13 17408 2f331374433e3fe176bee155d9be83e1 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\powrprof.dll
2004-08-19 05:00 17408 41ff9d663219a1dd0397fe2c5b09436c c:\windows\$NtServicePackUninstall$\powrprof.dll
2008-04-14 04:13 17408 2f331374433e3fe176bee155d9be83e1 c:\windows\ServicePackFiles\i386\powrprof.dll

2008-04-14 04:13 110080 3f970150c170a38fce423994341205b4 c:\windows\system32\imm32.dll
2008-04-14 04:13 110080 3f970150c170a38fce423994341205b4 c:\windows\SoftwareDistribution\Download\fc8deab818fa7e7ffabfc43e34347907\imm32.dll
2004-08-19 05:00 110080 ca38a6091ecac2668ec99afd4b6c0615 c:\windows\$NtServicePackUninstall$\imm32.dll
2008-04-14 04:13 110080 3f970150c170a38fce423994341205b4 c:\windows\ServicePackFiles\i386\imm32.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"NBJ"="c:\programmi\Ahead\Nero BackItUp\NBJ.exe" [2004-09-24 1916928]
"MsnMsgr"="c:\programmi\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Picasa Media Detector"="c:\programmi\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"SiS Windows KeyHook"="c:\windows\system32\keyhook.exe" [2005-03-04 32768]
"SynTPLpr"="c:\programmi\Synaptics\SynTP\SynTPLpr.exe" [2004-10-07 98394]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2004-10-07 688218]
"PCMService"="c:\program files\Arcade\PCMService.exe" [2005-03-09 49152]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-19 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-19 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-19 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-19 455168]
"LManager"="c:\programmi\Launch Manager\QtZgAcer.EXE" [2005-03-28 315392]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2005-11-16 393216]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"HP Component Manager"="c:\programmi\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"HP Software Update"="c:\programmi\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"ccApp"="c:\programmi\File comuni\Symantec Shared\ccApp.exe" [2006-03-07 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-04-24 125072]
"pdfFactory Dispatcher v3"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2007-11-07 507904]
"MobileConnect"="c:\programmi\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"AppleSyncNotifier"="c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SiSPower"="SiSPower.dll" [2005-02-25 c:\windows\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 c:\windows\SOUNDMAN.EXE]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2005-01-04 331776]
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Alice ti aiuta.lnk - c:\programmi\Alice ti aiuta\bin\matcli.exe [2006-10-21 212992]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\MsnMsgr.Exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"86:TCP"= 86:TCP:BroadCam Web Server

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-03-07 28544]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2005-12-15 274432]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2005-12-15 81920]
R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys [2005-06-30 7296]
R2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys [2005-01-14 4010]
R2 VMCService;Vodafone Mobile Connect Service;c:\programmi\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programmi\File comuni\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-02 101936]
R3 HSFHWSIS;HSFHWSIS;c:\windows\system32\drivers\HSFHWSIS.sys [2004-12-15 200576]
S3 SavRoam;SAVRoam;c:\programmi\Symantec AntiVirus\SavRoam.exe [2006-04-24 118416]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{541ec5fc-fb4a-11dd-a3ca-0016363a1e80}]
\Shell\AutoRun\command - F:\setup_vmc_lite.exe /checkApplicationPresence

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{541ec5fd-fb4a-11dd-a3ca-0016363a1e80}]
\Shell\AutoRun\command - F:\setup_vmc_lite.exe /checkApplicationPresence

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be8382a2-cdeb-11dd-a38a-0016363a1e80}]
\Shell\AutoRun\command - F:\setup_vmc_lite.exe /checkApplicationPresence

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be8382a3-cdeb-11dd-a38a-0016363a1e80}]
\Shell\AutoRun\command - F:\setup_vmc_lite.exe /checkApplicationPresence

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e820ce06-cf4b-11dd-a38c-0016363a1e80}]
\Shell\AutoRun\command - F:\setup_vmc_lite.exe /checkApplicationPresence

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e820ce07-cf4b-11dd-a38c-0016363a1e80}]
\Shell\AutoRun\command - F:\setup_vmc_lite.exe /checkApplicationPresence
.
Contenuto della cartella 'Scheduled Tasks'

2009-03-11 c:\windows\Tasks\AAFBE37192E492C9.job
- c:\docume~1\utente\datiap~1\elsepl~1\Thunkdeafgreat.exe []

2009-03-11 c:\windows\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job
- c:\programmi\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2009-03-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://securityresponse.symantec.com/av ... x_homepage
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Windows Live Search - c:\programmi\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\ewxgledx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://it.start2.mozilla.com/firefox?cl ... t:official
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt ... =MICI05&q=
FF - component: c:\programmi\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-11 18:05:04
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(2408)
c:\programmi\CyberLink\Shared Files\CLRCEngine.dll
c:\progra~1\WINDOW~2\wmpband.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\FILE COMUNI\SYMANTEC SHARED\CCSETMGR.EXE
c:\programmi\FILE COMUNI\SYMANTEC SHARED\CCEVTMGR.EXE
c:\programmi\FILE COMUNI\SYMANTEC SHARED\SPBBC\SPBBCSVC.EXE
c:\acer\EMANAGER\ANBMSERV.EXE
c:\programmi\FILE COMUNI\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
c:\programmi\BONJOUR\MDNSRESPONDER.EXE
c:\programmi\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
c:\programmi\SUNBELT SOFTWARE\PERSONAL FIREWALL 4\KPF4SS.EXE
c:\programmi\SYMANTEC ANTIVIRUS\RTVSCAN.EXE
c:\programmi\SUNBELT SOFTWARE\PERSONAL FIREWALL 4\KPF4GUI.EXE
c:\programmi\SUNBELT SOFTWARE\PERSONAL FIREWALL 4\KPF4GUI.EXE
c:\windows\SYSTEM32\WGATRAY.EXE
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\windows\SYSTEM32\RUNDLL32.EXE
c:\programmi\SYMANTEC ANTIVIRUS\VPTRAY.EXE
c:\programmi\iPod\bin\iPodService.exe
c:\windows\system32\dwwin.exe
c:\windows\system32\dwwin.exe
.
**************************************************************************
.
Ora fine scansione: 2009-03-11 18:16:59 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-03-11 17:16:48

Pre-Run: 5.326.340.096 byte disponibili
Post-Run: 6,115,688,448 byte disponibili

384 --- E O F --- 2009-03-01 00:37:52

[MIKI68]

OK!!! Scomparso l'errore?? Se l'errore è scomparso lascialo pure "pcfriend"

[Carlodam]

OK!!! Scomparso l'errore?? Se l'errore è scomparso lascialo pure "pcfriend"

Purtroppo NO. Il problema sussiste............ .

[MIKI68]

Pazienza troveremo la soluzione... .....spero!!!

[Carlodam]

Pazienza troveremo la soluzione... .....spero!!!

Confido su di te......... Ciao

[MIKI68]

Allora dai il comando " wuauclt.exe /resetauthorization /detectnow" dal prompt e premi invio, poi riavvia il pc e vedi se scompare!! Se non scompare sempre da prompt digita wuauclt.exe /detectnow

[Carlodam]

Allora dai il comando " wuauclt.exe /resetauthorization /detectnow" dal prompt e premi invio, poi riavvia il pc e vedi se scompare!! Se non scompare sempre da prompt digita wuauclt.exe /detectnow

Ho dato i due comandi suggeriti, ma il problema ancora sussiste (ho dato i comandi da: "start" "esegui" e poi "cmd wuauclt.exe......" è corretto?) Tutte e due le volte ho riavviato ma come dicev o senza successo. purtroppo.

[Carlodam]

Allora dai il comando " wuauclt.exe /resetauthorization /detectnow" dal prompt e premi invio, poi riavvia il pc e vedi se scompare!! Se non scompare sempre da prompt digita wuauclt.exe /detectnow

Ho dato i due comandi suggeriti, ma il problema ancora sussiste (ho dato i comandi da: "start" "esegui" e poi "cmd wuauclt.exe......" è corretto?) Tutte e due le volte ho riavviato ma come dicev o senza successo. purtroppo.

Non so se può esser utile: ho fatto (tentato di fare) un windows uodate manuale ma dopo laver scelto "rapido" è partita la ricerca per l'aggiornamento e mi ha dato errore 0X80248011. Ho fatto ciò che suggeriva ma inutilmente.
Il problema sussiste ancora. Ciao

[MIKI68]

Fai così:
apri il prompt dei comandi e digita net stop wuauserv2e dai invio poi sempre dal prompt digita cd /d c:\Windows\SoftwareDistribution dove c:\Windows è la cartella in cui è installato Windows e dai invio poi sempre dal prompt digita rd /S /Q DataStore e dai invio poi continua con il prompt e digita net start wuauserv e dai invio e poi chiudi la finestra del prompt, così facendo dovremo aver reimpostato l'errore del database Naturalmente rifai windows update dai che quasi ci siamo....lo avevo immaginato che si trattava di aggiornamenti non riusciti l'ho detto dal primo post......

[Carlodam]

Fai così:
apri il prompt dei comandi e digita net stop wuauserv2e dai invio poi sempre dal prompt digita cd /d c:\Windows\SoftwareDistribution dove c:\Windows è la cartella in cui è installato Windows e dai invio poi sempre dal prompt digita rd /S /Q DataStore e dai invio poi continua con il prompt e digita net start wuauserv e dai invio e poi chiudi la finestra del prompt, così facendo dovremo aver reimpostato l'errore del database Naturalmente rifai windows update dai che quasi ci siamo....lo avevo immaginato che si trattava di aggiornamenti non riusciti l'ho detto dal primo post......

Anche io penso/spero che quasi ci siamo.... Ho dato il comando "net stop wuauserv2" ho ricevuto questa risposta: "Errore di sistema 1060. Il servizio specificato non esiste come servizio installato" (ti premetto che ho lanciato il comando - dopo aver dato cmd nella finestra "Start Esegui"esegui"- da C:\Documents and Setting\utente>net stop wuauserv2...... forse non dovevo darlo da li?). Un altra cosa non ho ben capito il secondo suggerimento (anche se ancora non ci sono arrivato) devo dare il comando; cd/d c:\windows\SoftwareDisribution ? Confermo che la cartella dove è installato windows è c:\windows.
Scusa per la domanda ma come ti ho detto non sono cosi esperto....

[MIKI68]

Allora da start esegui digita CMD e premi invio entra nel prompt dei comandi e digita come ti ho detto senza chiudere la finestra digita e dai ok poi digita e ok e così via.....