Analizzare un log di hijackthis da soli

[Houdini87]

Originariamente inviato da juninho85

link

nessuno mi può aiutare??a trovare se ho qualche problema?

[juninho85]

Originariamente inviato da Houdini87

nessuno mi può aiutare??a trovare se ho qualche problema?

li si

[Houdini87]

Originariamente inviato da juninho85

li si

siceramente ho letto ma ho capito poco...dato che non sono molto esperto del campo...quindi volevo una mano da voi sul sapere se ho problemi e come risolverli..dato che non riesco a capire i significati dei log anche se ho letto la guida(non riesco a distinguare se sono beningi o maligni)

[juninho85]

non ci siamo capiti...devi postare li

[ste_95]

per l'analisi tramite sito, ho provatoa d aggiungere alcune cose che non vedeva, ma mica le aggiungeva! è normale?

Originariamente inviato da MrOZ

Questa è una pag web con uno script x analizzare un log di hijackthis

http://hijackthis.de/index.php?langselect=english

basta copiare il contenuto di hijackthis.log nel box in fondo e premere "analyze" dopodichè avrete una analisi del vostro log.

- Attenzione xò che questo sistema è ancora in fase di sviluppo, quindi non riconosce ancora tutti i prog.

Ciao.

il link nn funge più

il mio log è


Logfile of HijackThis v1.99.1
Scan saved at 14.22.06, on 30/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\Programmi\Canon\CAL\CALMAIN.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmi\Eset\nod32kui.exe
C:\Program Files\GlobespanVirata\Adsl\dslstat.exe
C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\ATI Technologies\ATI.ACE\cli.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Last.fm\LastFMHelper.exe
C:\Programmi\Last.fm\LastFM.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\fabio\Documenti\utility\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tim.it/consumer/homepage.do
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programmi\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\GlobespanVirata\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\GlobespanVirata\Adsl\dslagent.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Startup: Last.fm Helper.lnk = C:\Programmi\Last.fm\LastFMHelper.exe
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{935E494C-562D-4F76-ADCB-E54E492BC25E}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programmi\File comuni\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FILECO~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmi\Canon\CAL\CALMAIN.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programmi\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Unknown owner - C:\Programmi\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Programmi\File comuni\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Programmi\File comuni\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Unknown owner - C:\Programmi\File comuni\Roxio Shared\SharedCOM8\RoxWatch.exe (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: UPnPService - Magix AG - C:\Programmi\File comuni\MAGIX Shared\UPnPService\UPnPService.exe






cavolo mi si aprono delle pagine di firefox conn pubblicità!!!
ho usato adware ma nulla...

[lancetta]

Originariamente inviato da fabius00

il link nn funge più

sei nel posto sbagliato
se vuoi farti leggere il log da utenti esperti
http://www.hwupgrade.it/forum/showthread.php?t=937676

per l'analisi automatica
http://www.hijackthis.de/it

[nuovoUtente86]

In continuazione del post http://www.hwupgrade.it/forum/showthread.php?t=1707201 :
non ho il collegamento al desktop ne ho mai utilizzato l' installer in questione ma sempre e solo il .exe contenuto nell' archivio compresso scaricabile da sito.Come dicevo l' unica cosa che mi ritrovo è il programma installato nell' elenco Programmi e funzionalità(Gestione applicazioni in Windows XP).

[xcdegasp]

è normale, anche la 2.0.2 lo fa..

[Stefy_MHR]

Io non so come cancellare i file con il punto di domanda!

non devi cancellare necessariamente i file con il punto di domanda, stanno solo a significare che un dato programma, processo ecc non è conosciuto dall'analisi automatica

[Stefy_MHR]

Originariamente inviato da ShoShen

non devi cancellare necessariamente i file con il punto di domanda, stanno solo a significare che un dato programma, processo ecc non è conosciuto dall'analisi automatica

a ok grassie... non si smette mai di imparare!

Originariamente inviato da Stefy_MHR

a ok grassie... non si smette mai di imparare!

di nulla

[crespo81]

Mi controllate questo?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.24.08, on 08/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Programmi\Eset\nod32krn.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Programmi\ASUS\NB Probe\SPM\spmgr.exe
D:\WINDOWS\system32\svchost.exe
D:\Programmi\Synaptics\SynTP\SynTPEnh.exe
D:\Programmi\Eset\nod32kui.exe
D:\Programmi\ASUS\ASUS Direct Console\LCMP.EXE
D:\WINDOWS\ATK0100\HControl.exe
D:\Programmi\ASUS\Power4 Gear\BatteryLife.exe
D:\Programmi\Wireless Console 2\wcourier.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Programmi\ASUS\ASUS Splendid Video Enhancement Technology\ACMON.exe
D:\Programmi\Java\jre1.6.0_05\bin\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\system32\ACEngSvr.exe
D:\WINDOWS\ATK0100\ATKOSD.exe
D:\WINDOWS\system32\msiexec.exe
D:\Programmi\Mozilla Firefox\firefox.exe
D:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
D:\Programmi\Lavasoft\Ad-Aware\Ad-Aware.exe
D:\Documents and Settings\Salvo\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ircdown.com/it/index.php?...pag&d=79919297
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPEnh] D:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [DirectMessenger] "D:\Programmi\ASUS\ASUS Direct Console\LCMP.EXE"
O4 - HKLM\..\Run: [HControl] D:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Power_Gear] D:\Programmi\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Wireless Console 2] D:\Programmi\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ACMON] D:\Programmi\ASUS\ASUS Splendid Video Enhancement Technology\ACMON.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Programmi\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Cleanup] D:\cleanup.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Programmi\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programmi\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF42416D-086F-43F6-B175-D648C0DDB134}: NameServer = 192.168.1.254
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: spmgr - Unknown owner - D:\Programmi\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 6144 bytes

Grazie a tutti

[Chill-Out]

Ciao per il controllo del log di HJT devi postare qui http://www.hwupgrade.it/forum/showthread.php?t=937676 mi raccomando leggi le istruzioni in prima pagina su come allegare il log, ciao.

[xcdegasp]

tutorial di hijackthis:
http://hometown.aol.co.uk/jrmc137/hj...l/tutorial.htm

[Dom77]

Originariamente inviato da xcdegasp

tutorial di hijackthis:
http://hometown.aol.co.uk/jrmc137/hj...l/tutorial.htm

credo che sto link sia ormai inutile...

[xcdegasp]

Originariamente inviato da MrOZ

Questa è una pag web con uno script x analizzare un log di hijackthis

http://hijackthis.de/index.php?langselect=english

basta copiare il contenuto di hijackthis.log nel box in fondo e premere "analyze" dopodichè avrete una analisi del vostro log.

- Attenzione xò che questo sistema è ancora in fase di sviluppo, quindi non riconosce ancora tutti i prog.


Mentre qui è disponibile un tutorial su HiJackThis:
http://www.bleepingcomputer.com/tuto...utorial42.html

Ciao.

Piccola nota informativa:
http://www.hwupgrade.it/forum/showpo...&postcount=635

[Glhardware]

E ne esiste uno che ti analizza il file di Combofix?

[tigre652]

Buongiorno non essendo più troppo informato, qualcuno più esperto di me avrebbe voglia di dare un occhiata al mio log HJTHIS e dirmi se qualcosa di dannoso o inutile visto che noto rallentamenti nel PC, grazie.

Logfile of HiJackThis Fork (Beta) by Alex Dragokas v.2.10.0.6

Platform: x64 Windows 10 (Pro), 10.0.19042.928 (ReleaseId: 2009), Service Pack: 0
Time: 28.06.2021 - 18:20 (UTC+02:00)
Language: OS: Italian (0x410). Display: Italian (0x410). Non-Unicode: Italian (0x410)
Elevated: Yes
Ran by: 39340 (group: Administrator) on PC, FirstRun: yes

Chrome: 91.0.4472.114
Internet Explorer: 11.789.19041.0
Default: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --single-argument %1 (Google Chrome)

Boot mode: Normal

Running processes:
Number | Path
1 C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
1 C:\Program Files (x86)\Avira\Antivirus\avguard.exe
1 C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
1 C:\Program Files (x86)\Avira\Antivirus\protectedservice.exe
1 C:\Program Files (x86)\Avira\Antivirus\sched.exe
1 C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
1 C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
1 C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
1 C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
1 C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe
1 C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
1 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
2 C:\Program Files (x86)\Google\Chrome Remote Desktop\92.0.4515.41\remoting_host.exe
20 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
1 C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
1 C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler64.exe
1 C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
1 C:\Program Files (x86)\Universal Media Server\jre-x64\bin\javaw.exe
1 C:\Program Files\AMD\CNext\CNext\amdow.exe
1 C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
1 C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
1 C:\Program Files\Bonjour\mDNSResponder.exe
1 C:\Program Files\CCleaner\CCleaner64.exe
1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
1 C:\Program Files\Macrium\Common\MacriumService.exe
1 C:\Program Files\Macrium\Common\ReflectMonitor.exe
1 C:\Program Files\Macrium\Common\ReflectUI.exe
1 C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
1 C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
1 C:\Program Files\Microsoft Mouse and Keyboard Center\MKCHelper.exe
1 C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
1 C:\Program Files\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe
1 C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxAccounts.exe
1 C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxOutlook.exe
1 C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxTsr.exe
1 C:\Program Files\WinRAR\WinRAR.exe
1 C:\ProgramData\Wondershare\Service\InstallAssistService.exe
1 C:\Users\39340\Desktop\hijackthis-devel\binary\HiJackThis.exe
1 C:\Windows\explorer.exe
1 C:\Windows\ImmersiveControlPanel\SystemSettings.exe
1 C:\Windows\System32\amdfendrsr.exe
1 C:\Windows\System32\ApplicationFrameHost.exe
1 C:\Windows\System32\audiodg.exe
1 C:\Windows\System32\AuthHost.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\ctfmon.exe
1 C:\Windows\System32\dasHost.exe
2 C:\Windows\System32\dllhost.exe
1 C:\Windows\System32\DriverStore\FileRepository\u0359160.inf_amd64_2abe2598d9a3141f\B358802\atieclxx.exe
1 C:\Windows\System32\DriverStore\FileRepository\u0359160.inf_amd64_2abe2598d9a3141f\B358802\atiesrxx.exe
1 C:\Windows\System32\dwm.exe
2 C:\Windows\System32\fontdrvhost.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\MoUsoCoreWorker.exe
1 C:\Windows\System32\PickerHost.exe
5 C:\Windows\System32\RuntimeBroker.exe
1 C:\Windows\System32\SearchFilterHost.exe
1 C:\Windows\System32\SearchIndexer.exe
2 C:\Windows\System32\SearchProtocolHost.exe
1 C:\Windows\System32\SecurityHealthService.exe
1 C:\Windows\System32\SecurityHealthSystray.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\SettingSyncHost.exe
1 C:\Windows\System32\SgrmBroker.exe
1 C:\Windows\System32\sihost.exe
1 C:\Windows\System32\smartscreen.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spoolsv.exe
78 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\SystemSettingsBroker.exe
1 C:\Windows\System32\taskhostw.exe
1 C:\Windows\System32\wbem\WmiPrvSE.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\System32\WirelessKB850NotificationService.exe
1 C:\Windows\System32\WUDFHost.exe
1 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
1 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
1 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
1 C:\Windows\SysWOW64\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxyOverride] = *.local
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] = C:\Program Files\CCleaner\CCleaner64.exe /MONITOR
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] = C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
O4 - HKLM\..\Run: [Reflect UI] = C:\Program Files\Macrium\Common\ReflectUI.exe
O4 - Startup Global: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Universal Media Server.lnk -> C:\Program Files (x86)\Universal Media Server\UMS.exe
O4-32 - HKLM\..\Run: [AdobeCS6ServiceManager] = C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe -launchedbylogin
O4-32 - HKLM\..\Run: [Avira SystrayStartTrigger] = C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe
O4-32 - HKLM\..\Run: [SwitchBoard] = C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\E&sporta in Microsoft Excel: (default) = C:\Program Files (x86)\Microsoft Office\Office10\EXCEL.EXE (file missing)
O17 - DHCP DNS 1: 192.168.178.1
O18 - HKLM\Software\Classes\Protocols\Handler\msdaipp\0x00000001: [CLSID] = {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll
O18 - HKLM\Software\Classes\Protocols\Handler\msdaipp\oledb: [CLSID] = {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362A-42D9-9328-24A483E2CCC3} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\00asw: (no name) - {472083B0-C522-11CF-8763-00608CC02F24} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362A-42D9-9328-24A483E2CCC3} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} - (no file)
O22 - BITS Job: (download) {73CCE7D7-759A-4A02-96B4-C5CDBAEA7DF0} - http://emupdate.avcdn.net/files/emupdate/pong.txt -> C:\Windows\TEMP\e242da0a-4640-47cc-8840-9c8884f2d7e4
O22 - BITS Job: Fix all (including legit)
O22 - Task (.job): (disabled) (Not scheduled) CreateExplorerShellUnelevatedTask.job - C:\Windows\explorer.exe
O22 - Task: (damaged) C:\WINDOWS\System32\Tasks\S-1-5-21-484543080-3762093799-3341681034-1001\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E (empty)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93C88D06-6C01-4122-B150-F7D567E8C318} - \SystemMaintanceTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93C88D06-6C01-4122-B150-F7D567E8C318} (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Avira\System Speedup\Delayed Startup (empty)
O22 - Task: (disabled) (update) \Microsoft\Windows\UpdateOrchestrator\Reboot_AC - C:\WINDOWS\system32\MusNotification.exe /RunOnAC ReadyToReboot (Microsoft)
O22 - Task: (disabled) (update) \Microsoft\Windows\UpdateOrchestrator\Reboot_Battery - C:\WINDOWS\system32\MusNotification.exe /RunOnBattery ReadyToReboot (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\Management\Provisioning\Retry - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source ProvRetryTask (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\Management\Provisioning\RunOnReboot - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source ContinueSessionTask (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work - C:\WINDOWS\system32\usoclient.exe StartMaintenanceWork (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work - C:\WINDOWS\system32\usoclient.exe StartWork (Microsoft)
O22 - Task: (telemetry) \Microsoft\Office\OfficeTelemetryAgentFallBack2016 - C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe scan upload mininterval:2880 (Microsoft)
O22 - Task: (telemetry) \Microsoft\Office\OfficeTelemetryAgentLogOn2016 - C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe scan upload (Microsoft)
O22 - Task: (telemetry) \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\PcaSvc.dll,PcaPatchSdbTask (Microsoft)
O22 - Task: (update) \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker - C:\WINDOWS\system32\MusNotification.exe (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\OS Edition Upgrade event listener created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /s "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /OsEditionUpgradeAlert /SID "S-1-5-21-484543080-3762093799-3341681034-1001" (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Passport for Work alert created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /PFW (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Provisioning initiated session - C:\WINDOWS\system32\deviceenroller.exe /c /ProvInitiatedSession /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\PushLaunch - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /z (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\PushRenewal - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /y (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\PushUpgrade - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /PushUpgrade (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule #1 created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule #2 created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule #3 created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /o "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /b (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule created by enrollment client for renewal of certificate warning - C:\WINDOWS\system32\deviceenroller.exe /c /r /d FAD95428-5B4D-4D90-A537-2681F85FC65E (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule to run OMADMClient by client - C:\WINDOWS\system32\omadmclient.exe /serverid "FAD95428-5B4D-4D90-A537-2681F85FC65E" /lookuptype 1 /initiator 0 (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Schedule to run OMADMClient by server - C:\WINDOWS\system32\omadmclient.exe /serverid "FAD95428-5B4D-4D90-A537-2681F85FC65E" /lookuptype 1 /initiator 1 (Microsoft)
O22 - Task: \Microsoft\Windows\EnterpriseMgmt\FAD95428-5B4D-4D90-A537-2681F85FC65E\Win10 S Mode event listener created by enrollment client - C:\WINDOWS\system32\deviceenroller.exe /s "FAD95428-5B4D-4D90-A537-2681F85FC65E" /c /Win10SModeAlert /SID "S-1-5-21-484543080-3762093799-3341681034-1001" (Microsoft)
O22 - Task: Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O22 - Task: AMDInstallLauncher - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe /InstallAUEP
O22 - Task: AMDLinkUpdate - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe -AMDLinkUpdate
O22 - Task: ASC_PerformanceMonitor - C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe /Task (file missing)
O22 - Task: ASC_SkipUac_39340 - C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe /SkipUac (file missing)
O22 - Task: Avira_Antivirus_Systray - C:\Program Files (x86)\Avira\Antivirus\avgnt.exe /min
O22 - Task: Avira_Security_Service_SCM_Watchdog - C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.Worker.exe HandleServiceControlManagerEvent 7000
O22 - Task: Avira_Security_Update - C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Common.Updater.exe /CheckAndInstall
O22 - Task: AviraSystemSpeedupUpdate - C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe /VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART
O22 - Task: CCleaner Update - C:\Program Files\CCleaner\CCUpdate.exe
O22 - Task: CCleanerSkipUAC - C:\Program Files\CCleaner\CCleaner.exe $(Arg0)
O22 - Task: GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
O22 - Task: GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
O22 - Task: HWiNFO - C:\Users\39340\Desktop\HWINFO\HWiNFO64.exe
O22 - Task: Microsoft_Hardware_Launch_ipoint_exe - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
O22 - Task: Microsoft_Hardware_Launch_itype_exe - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
O22 - Task: Microsoft_Hardware_Launch_mousekeyboardcenter_exe - C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe
O22 - Task: Microsoft_MKC_Logon_Task_ceip.exe - C:\Program Files\Microsoft Mouse and Keyboard Center\ceip.exe
O22 - Task: Microsoft_MKC_Logon_Task_ipoint.exe - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
O22 - Task: Microsoft_MKC_Logon_Task_itype.exe - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
O22 - Task: ModifyLinkUpdate - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe -UpdateCurrentUser
O22 - Task: OneDrive Standalone Update Task-S-1-5-21-484543080-3762093799-3341681034-1018 - C:\Users\39340\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe (file missing)
O22 - Task: StartCN - C:\Program Files\AMD\CNext\CNext\cncmd.exe startwithdelay
O22 - Task: StartDVR - C:\Program Files\AMD\CNext\CNext\RSServCmd.exe
O23 - Service R2: Servizio Bonjour - (Bonjour Service) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service R2: Adobe Acrobat Update Service - (AdobeARMservice) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service R2: AMD Crash Defender Service - C:\WINDOWS\system32\amdfendrsr.exe
O23 - Service R2: AMD External Events Utility - C:\WINDOWS\System32\DriverStore\FileRepository\u0359160.inf_amd64_2abe2598d9a3141f\B358802\atiesrxx.exe
O23 - Service R2: Avira Optimizer Host - (AviraOptimizerHost) - C:\Program Files (x86)\Avira\Optimizer Host\Avira.OptimizerHost.exe
O23 - Service R2: Avira Phantom VPN - (AviraPhantomVPN) - C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
O23 - Service R2: Avira Pianificatore - (AntiVirSchedulerService) - C:\Program Files (x86)\Avira\Antivirus\sched.exe
O23 - Service R2: Avira Protezione in tempo reale - (AntiVirService) - C:\Program Files (x86)\Avira\Antivirus\avguard.exe
O23 - Service R2: Avira Security - (AviraSecurity) - C:\Program Files (x86)\Avira\Security\Avira.Spotlight.Service.exe
O23 - Service R2: Avira Service Host - (Avira.ServiceHost) - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
O23 - Service R2: Avira Servizio protetto - (AntivirProtectedService) - C:\Program Files (x86)\Avira\Antivirus\ProtectedService.exe
O23 - Service R2: Avira Updater Service - (AviraUpdaterService) - C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe
O23 - Service R2: Macrium Service - (MacriumService) - C:\Program Files\Macrium\Common\MacriumService.exe
O23 - Service R2: SAMSUNG Mobile Connectivity Service - (ss_conn_service) - C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
O23 - Service R2: SAMSUNG Mobile Connectivity Service V2 - (ss_conn_service2) - C:\Program Files\Samsung\USB Drivers\28_ssconn2\conn\ss_conn_service2.exe
O23 - Service R2: Servizio Chrome Remote Desktop - (chromoting) - C:\Program Files (x86)\Google\Chrome Remote Desktop\92.0.4515.41\remoting_host.exe --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json"
O23 - Service R2: Wireless Keyboard 850 Notification Service - (WirelessKB850NotificationService) - C:\WINDOWS\system32\WirelessKB850NotificationService.exe
O23 - Service R2: Wondershare Install Assist Service - (Wondershare InstallAssist) - C:\ProgramData\Wondershare\Service\InstallAssistService.exe
O23 - Service S2: Avira Protezione email - (AntiVirMailService) - C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
O23 - Service S2: Avira Protezione web - (AntiVirWebService) - C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
O23 - Service S2: Servizio Google Update (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\91.0.4472.114\elevation_service.exe
O23 - Service S3: InstallDriver Table Manager - (IDriverT) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service S3: Rockstar Game Library Service - (Rockstar Service) - G:\GTAV\Launcher\RockstarService.exe (file missing)
O23 - Service S3: Servizio Google Update (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
O23 - Service S3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsService
O23 - Service S3: SwitchBoard - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe



Warning: New Root certificate is detected! Report to developer, please:
Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12ECCCE41034DB56EC978443531DB185327E70F5]\n"Blob"=hex:5c,00,00,00,01,00,00,00,04,00,00,00,00,10,00,00,19,00,00,00,01,00,\\n 00,00,10,00,00,00,5b,43,42,a0,39,a7,b2,38,e4,4e,6a,5a,0b,1d,d1,f7,0f,00,00,\\n 00,01,00,00,00,20,00,00,00,6a,ab,6c,c6,2e,d9,64,38,f2,e4,ce,b9,6a,9d,e4,88,\\n e9,d6,06,1c,0d,11,25,00,18,ce,bc,c5,44,07,e8,23,03,00,00,00,01,00,00,00,14,\\n 00,00,00,12,ec,cc,e4,10,34,db,56,ec,97,84,43,53,1d,b1,85,32,7e,70,f5,14,00,\\n 00,00,01,00,00,00,14,00,00,00,22,cb,8b,27,89,5e,1e,3f,c7,fb,cd,aa,be,de,28,\\n 03,4c,b2,ed,93,04,00,00,00,01,00,00,00,10,00,00,00,cd,30,86,d9,ba,5f,dc,79,\\n 21,e4,a1,1d,00,28,5a,5d,20,00,00,00,01,00,00,00,6d,05,00,00,30,82,05,69,30,\\n 82,03,51,a0,03,02,01,02,02,10,56,eb,08,88,34,c4,70,a7,4b,d0,7e,a1,f2,03,72,\\n 66,30,0d,06,09,2a,86,48,86,f7,0d,01,01,0b,05,00,30,38,31,36,30,34,06,03,55,\\n 04,03,13,2d,4d,69,63,72,6f,73,6f,66,74,20,49,6e,74,75,6e,65,20,52,6f,6f,74,\\n 20,43,65,72,74,69,66,69,63,61,74,69,6f,6e,20,41,75,74,68,6f,72,69,74,79,30,\\n 1e,17,0d,31,37,30,37,31,32,30,30,30,30,30,30,5a,17,0d,32,32,30,37,31,32,30,\\n 30,30,30,30,30,5a,30,38,31,36,30,34,06,03,55,04,03,13,2d,4d,69,63,72,6f,73,\\n 6f,66,74,20,49,6e,74,75,6e,65,20,52,6f,6f,74,20,43,65,72,74,69,66,69,63,61,\\n 74,69,6f,6e,20,41,75,74,68,6f,72,69,74,79,30,82,02,22,30,0d,06,09,2a,86,48,\\n 86,f7,0d,01,01,01,05,00,03,82,02,0f,00,30,82,02,0a,02,82,02,01,00,d1,37,8a,\\n 3e,8f,9d,f9,ea,c8,0b,4b,91,16,ce,cb,3e,ce,42,d4,40,28,4b,19,99,c1,f4,2d,ea,\\n e8,34,e8,f4,bb,9a,e8,60,67,f5,bc,c0,53,ae,95,d0,dc,9c,aa,b4,1c,35,e3,74,98,\\n 87,f4,09,31,17,19,b8,54,d6,db,e3,ed,a4,92,0d,fd,8d,6e,bf,3e,93,05,e7,84,51,\\n 2f,71,66,75,33,d7,db,50,1b,57,51,a8,a3,05,88,7c,cc,0b,db,21,30,9c,39,96,74,\\n 08,03,e5,5c,66,75,e3,8e,89,4a,5a,12,3a,f8,6b,2f,3a,a2,48,48,11,5b,bb,4f,08,\\n 40,de,69,3e,75,1c,92,2e,49,cc,d5,d1,cd,b1,5d,a4,5c,73,6f,99,2a,3e,bc,e7,e0,\\n 91,35,29,56,e9,d3,28,55,e7,ea,cd,54,8d,e3,1e,1d,ec,5c,16,c3,b4,ca,91,47,74,\\n a9,8c,34,b0,53,f2,a6,76,f2,a0,6b,38,c1,88,ca,08,51,f7,48,81,38,61,b0,25,f5,\\n 3d,65,16,a9,53,04,ee,30,f6,66,40,6b,29,d7,bd,30,1b,ec,f9,10,32,65,96,39,c9,\\n 58,ad,b5,f6,fe,8c,8d,c7,20,ad,7c,4d,34,07,6c,6c,ef,f1,0f,b4,fc,de,7c,71,4a,\\n 96,f3,72,f4,55,71,94,35,04,62,c0,f5,63,37,be,cc,d0,d7,90,13,fb,13,33,b1,ee,\\n 19,92,e5,bc,0d,2c,9d,31,85,bb,83,84,cd,99,63,fc,1c,55,e5,e5,71,dc,5e,2e,19,\\n ec,06,5c,1e,ce,2e,e0,6a,82,a7,55,d4,35,7d,30,db,88,5f,d3,db,d7,7e,a0,77,1e,\\n 72,d8,b8,85,36,8e,c2,f6,68,5c,0e,a5,c2,15,c1,13,54,b3,db,14,bc,31,d9,fd,d1,\\n 97,a4,fe,fe,ae,6e,02,94,ba,f6,02,e9,30,e9,70,20,be,d0,b8,6a,32,c4,a8,69,41,\\n bf,66,ab,5e,0b,78,d8,66,7d,5a,87,e2,8e,13,df,4d,7f,8c,e0,80,ef,38,b3,4d,f1,\\n 4f,6a,56,6b,51,c0,e3,09,76,bb,33,bf,f5,1b,75,3e,1a,b6,ac,14,26,97,e5,f8,ff,\\n f0,bb,af,9d,c0,18,11,93,fe,a7,e6,44,b1,a6,41,5c,a5,d4,2c,85,8f,89,f2,b8,ea,\\n b7,86,68,58,33,9c,65,b0,d2,80,af,ef,ed,ea,81,c6,32,ac,42,4b,bf,e8,20,bf,f5,\\n ce,c6,97,98,97,21,17,72,00,c0,e4,77,eb,f5,2a,b5,7a,24,87,59,8f,32,f4,22,19,\\n 60,ff,2a,2d,87,5e,ca,9c,71,02,03,01,00,01,a3,6f,30,6d,30,1d,06,03,55,1d,0e,\\n 04,16,04,14,22,cb,8b,27,89,5e,1e,3f,c7,fb,cd,aa,be,de,28,03,4c,b2,ed,93,30,\\n 0e,06,03,55,1d,0f,01,01,ff,04,04,03,02,01,86,30,12,06,03,55,1d,13,01,01,ff,\\n 04,08,30,06,01,01,ff,02,01,01,30,16,06,03,55,1d,25,01,01,ff,04,0c,30,0a,06,\\n 08,2b,06,01,05,05,07,03,02,30,10,06,09,2b,06,01,04,01,82,37,15,01,04,03,02,\\n 01,00,30,0d,06,09,2a,86,48,86,f7,0d,01,01,0b,05,00,03,82,02,01,00,90,76,8b,\\n 4e,60,a4,78,2e,25,4d,37,80,88,6e,8d,ce,7f,7c,c6,c9,ba,d5,61,0e,2b,07,10,23,\\n 91,b5,73,35,f5,53,29,e8,cb,6d,24,57,ca,1a,e6,d1,fa,df,45,86,1b,b1,c7,75,41,\\n f9,ad,da,98,73,fc,b7,8f,3e,fa,1d,2e,49,66,8b,65,67,08,7c,f5,44,01,6f,a8,4c,\\n f8,df,ad,48,51,4c,08,f8,c6,1e,6a,db,67,08,d7,78,c5,78,56,47,09,57,bb,18,92,\\n f3,91,d5,6d,d6,fb,2c,61,0f,d4,5b,8b,f9,22,3b,dc,a3,54,35,a6,f7,1c,80,1c,76,\\n e0,dc,cc,de,1e,2f,30,55,aa,3e,d1,bb,28,57,f9,c6,41,21,b5,b5,aa,a4,3a,f8,45,\\n ac,72,06,7a,f0,a6,78,37,93,05,cd,06,40,bb,8b,36,89,48,fd,5c,1b,5c,1c,a6,45,\\n 46,e8,68,3f,e5,c6,35,2a,ba,cc,f9,f6,2e,ec,05,08,41,ad,a1,80,ca,9d,97,a9,cf,\\n e4,f0,45,5a,ca,ff,a0,5b,48,24,40,8d,cd,81,68,ed,c7,9b,93,82,d9,b6,43,5a,47,\\n 2f,ee,c5,83,1a,5d,33,f9,da,07,87,fd,06,56,e9,6e,77,ee,2f,65,1c,d2,39,c5,ac,\\n ea,49,8f,b2,1b,f1,c0,0b,5f,55,23,0f,f7,dc,c6,88,e5,8e,38,e8,21,07,67,af,f6,\\n 0b,e5,57,03,d1,0d,af,e9,fe,2e,b9,5b,e1,db,da,6c,9f,44,52,68,25,5b,63,ea,cf,\\n ab,ad,53,e5,24,e4,a1,a8,4f,b5,e7,bb,bc,a9,4c,fa,20,76,20,ac,52,ab,7b,b0,f5,\\n e2,fb,f4,81,de,18,18,68,84,05,81,21,24,7b,0b,0b,1d,7a,41,92,40,68,b8,2b,00,\\n 8a,44,30,68,f7,e0,59,ec,09,b5,be,dc,fd,37,a3,7b,fd,ab,3a,e6,f4,5c,11,a9,ca,\\n 69,43,95,8b,25,47,ed,9a,c2,58,82,d8,56,f4,c1,a1,ac,5b,10,64,58,da,32,d7,a6,\\n 26,00,10,e5,f5,16,31,f1,b3,22,74,b5,eb,ea,04,f4,38,31,59,ca,8e,ed,29,5f,a0,\\n 56,2a,8c,d6,f6,ba,ec,f4,06,76,99,cb,f1,e1,97,7f,d9,81,33,51,c0,de,42,ca,09,\\n e4,c5,d8,d7,03,17,ef,fb,64,66,d9,c2,6c,96,a5,c6,e4,38,c4,bf,18,7b,b6,60,7b,\\n 8f,c9,e7,28,8b,04,42,5c,bb,59,53,18,16,31,4e,31,4b,82,41,4b,b7,62,df,fa,2c,\\n 3c,07,41,c3,f2,e4,99,da,49\n\n\n\n

--
End of file - Time spent: 18,8 sec. - 52186 bytes, CRC32: FFFFFFFF. Sign: 蒿