error 0x0000006b

[giancai]

Hello everyone, I have a problem on win 7 that every time I boot 0x0000006b exits and reboots. not even in safe mode it goes to the network. I tried to delete the file Bootcat.cache, but I have not solved anything. I did the test disk and is ok. I c ambiato the ram and the problem is always there. how can I solve this puzzle? the hard disk when connected via USB to another PC I access it easily.

 

[giancai]

hi, why nobody reply at my question?

 

[writhziden]

Use http://www.sevenforums.com/tutorials/666-advanced-boot-options.html to select Repair Your Computer and get into the http://www.sevenforums.com/tutorials/668-system-recovery-options.html. Then do startup repair three times. Further reading: http://www.sevenforums.com/tutorials/105541-startup-repair-run-3-separate-times.html.

 

[giancai]

I did scan with ComboFix and found the virus but do not know how to remove them. I attach log.



ComboFix 12-02-11.02 - FILIPPO 11/02/2012 16:26:18.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.39.1040.18.3070.2123 [GMT 1:00]
Eseguito da: c:\users\FILIPPO\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\System32\PresentationHost.exe . . . è infetto!!
.
c:\windows\System32\sdclt.exe . . . è infetto!!
.
c:\windows\System32\migwiz\PostMig.exe . . . è infetto!!
.
c:\windows\System32\Speech\SpeechUX\SpeechUXTutorial.exe . . . è infetto!!
.
c:\windows\System32\spool\tools\PrintBrmEngine.exe . . . è infetto!!
.
c:\windows\system32\d3d9.dll . . . è infetto!!
.
.
((((((((((((((((((((((((( Files Creati Da 2012-01-11 al 2012-02-11 )))))))))))))))))))))))))))))))))))
.
.
2012-02-11 15:41 . 2012-02-11 15:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-11 14:32 . 2012-02-11 14:32 -------- d-----w- c:\windows\system32\EventProviders
2012-02-10 16:51 . 2012-02-10 16:51 -------- d-----w- c:\windows\CheckSur
2012-02-10 16:45 . 2011-10-15 08:53 487232 ----a-w- c:\windows\system32\nvhotkey.dll
2012-02-10 16:45 . 2011-10-15 08:53 123712 ----a-w- c:\windows\system32\nvshext.dll
2012-02-10 16:45 . 2011-10-15 08:53 1136448 ----a-w- c:\windows\system32\nvvsvc.exe
2012-02-10 16:45 . 2011-10-15 08:53 6350144 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-10 16:45 . 2011-10-15 08:53 3840320 ----a-w- c:\windows\system32\nvsvc.dll
2012-02-10 16:45 . 2011-10-15 08:53 3074368 ----a-w- c:\windows\system32\nvsvcr.dll
2012-02-10 16:45 . 2011-10-15 08:53 203072 ----a-w- c:\windows\system32\nvmctray.dll
2012-02-10 16:45 . 2011-10-15 08:53 602432 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2012-02-10 11:10 . 2012-02-10 11:30 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\Wise Registry Cleaner
2012-02-10 11:10 . 2012-02-10 11:10 -------- d-----w- c:\program files\Wise Registry Cleaner
2012-02-09 12:08 . 2012-02-09 12:08 -------- d-----w- c:\users\FILIPPO\AppData\Local\VirtualStore
2012-02-06 09:17 . 2012-02-06 09:17 -------- d-----w- c:\windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP
2012-02-06 09:17 . 2012-02-06 09:17 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2012-02-06 09:13 . 2009-11-21 02:34 182888 ----a-w- c:\windows\system32\nvcod178.dll
2012-02-05 11:02 . 2010-11-20 21:29 153984 ----a-w- c:\windows\system32\drivers\pci.sys
2012-02-02 01:38 . 2012-02-02 01:38 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{81FD3E5E-324B-413B-B690-82778599D263}\offreg.dll
2012-02-02 01:37 . 2012-01-06 04:19 6557240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{81FD3E5E-324B-413B-B690-82778599D263}\mpengine.dll
2012-01-27 17:17 . 2012-01-27 17:17 -------- d-----w- c:\windows\Sun
2012-01-25 14:04 . 2012-01-25 14:04 -------- d-----w- c:\program files\1ClickDownload
2012-01-18 20:39 . 2012-01-18 20:39 -------- d-----r- c:\users\FILIPPO\AppData\Roaming\Brother
2012-01-18 20:26 . 2012-01-18 20:26 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\FLEXnet
2012-01-18 20:26 . 2012-01-18 20:27 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\ControlCenter4
2012-01-18 20:19 . 2012-01-18 20:19 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\InstallShield
2012-01-18 20:18 . 2012-01-18 20:18 -------- d-----w- c:\programdata\zeon
2012-01-18 20:17 . 2012-01-18 20:17 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\Nuance
2012-01-18 20:17 . 2012-01-18 20:17 -------- d-----w- c:\programdata\ScanSoft
2012-01-18 20:17 . 2012-01-18 20:19 -------- d-----w- c:\program files\Nuance
2012-01-18 20:17 . 2012-01-18 20:17 -------- d-----w- c:\program files\Common Files\ScanSoft Shared
2012-01-18 20:17 . 2012-01-18 20:17 -------- d-----w- c:\programdata\FLEXnet
2012-01-18 20:17 . 2012-01-18 20:29 -------- d-----w- c:\programdata\Nuance
2012-01-18 20:14 . 2012-01-18 20:22 -------- d-----w- c:\programdata\Brother
2012-01-18 10:42 . 2012-01-18 10:42 53248 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\msihook.dll
2012-01-18 10:42 . 2012-01-18 10:42 126976 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\knlwrap.exe
2012-01-18 10:42 . 2012-01-18 10:42 114688 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\scpthdlr.dll
2012-01-18 10:41 . 1999-05-26 08:46 212480 ----a-w- c:\windows\pcdlib32.dll
2012-01-18 10:41 . 1996-06-30 23:00 77312 ----a-w- c:\windows\system32\TWAIN_32.DLL
2012-01-18 10:41 . 1995-07-31 12:44 212480 ----a-w- c:\windows\system32\PCDLIB32.DLL
2012-01-18 10:41 . 2012-01-18 10:41 -------- d-----w- c:\program files\ArcSoft
2012-01-18 10:41 . 2001-09-05 04:18 77824 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2012-01-18 10:41 . 2001-09-05 04:18 225280 ------w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2012-01-18 10:41 . 2001-09-05 04:14 176128 ------w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2012-01-18 10:41 . 2001-09-05 04:13 32768 ------w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2012-01-18 10:40 . 2012-02-09 12:14 -------- d-----w- C:\CanoScan
2012-01-18 10:40 . 2002-05-24 02:04 389180 ----a-w- c:\windows\system32\UCS32P.DLL
2012-01-15 14:01 . 2012-01-15 14:01 -------- d-----w- c:\program files\Google
2012-01-14 23:32 . 2012-01-14 23:32 -------- d-----w- c:\programdata\DivX
2012-01-14 20:21 . 2012-01-14 20:21 -------- d-----w- c:\program files\Veetle
2012-01-14 17:53 . 2012-01-14 17:53 -------- d--h--w- c:\programdata\CanonBJ
2012-01-14 17:53 . 2009-07-14 01:15 70144 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNBPP3.DLL
2012-01-14 17:09 . 2012-01-14 17:09 -------- d-----w- c:\program files\uTorrent
2012-01-14 17:08 . 2012-02-06 08:42 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\uTorrent
2012-01-14 12:50 . 2012-01-14 18:38 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\Windows Live Writer
2012-01-14 12:50 . 2012-01-14 12:50 -------- d-----w- c:\users\FILIPPO\AppData\Local\Windows Live Writer
2012-01-14 12:48 . 2012-01-14 12:48 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\c7f2e7911ccd2ba04\MeshBetaRemover.exe
2012-01-14 12:44 . 2012-01-16 08:03 -------- d-----w- c:\users\FILIPPO\AppData\Local\Adobe
2012-01-14 12:43 . 2012-01-15 14:02 -------- d-----w- c:\users\FILIPPO\AppData\Local\Google
2012-01-14 12:43 . 2012-01-14 12:43 -------- d-----w- c:\users\FILIPPO\AppData\Local\Deployment
2012-01-14 12:43 . 2012-01-14 12:43 -------- d-----w- c:\users\FILIPPO\AppData\Local\Apps
2012-01-13 20:47 . 2012-01-13 20:47 -------- d-----w- c:\program files\CCleaner
2012-01-13 14:12 . 2012-01-13 14:28 -------- d-----w- c:\windows\Acronis
2012-01-13 14:09 . 2012-01-13 14:09 -------- d-----w- c:\users\FILIPPO\AppData\Local\LogMeIn
2012-01-13 14:09 . 2012-01-31 20:30 52096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll
2012-01-13 14:09 . 2012-01-31 20:30 30592 ----a-w- c:\windows\system32\LMIport.dll
2012-01-13 14:09 . 2012-01-31 20:30 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2012-01-13 14:09 . 2011-09-16 14:10 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
2012-01-13 14:09 . 2012-01-31 20:30 87424 ----a-w- c:\windows\system32\LMIinit.dll
2012-01-13 14:09 . 2012-02-11 08:50 -------- d-----w- c:\programdata\LogMeIn
2012-01-13 14:09 . 2012-02-10 10:49 -------- d-----w- c:\program files\LogMeIn
2012-01-13 12:17 . 2012-02-10 16:44 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-01-13 12:16 . 2011-10-15 08:53 61248 ----a-w- c:\windows\system32\OpenCL.dll
2012-01-13 12:16 . 2011-10-15 08:53 877376 ----a-w- c:\windows\system32\nvgenco32.dll
2012-01-13 12:16 . 2011-10-15 08:53 919872 ----a-w- c:\windows\system32\nvdispco32.dll
2012-01-13 12:16 . 2011-10-15 08:53 17248576 ----a-w- c:\windows\system32\nvcompiler.dll
2012-01-13 12:11 . 2012-02-10 16:45 -------- d-----w- c:\program files\NVIDIA Corporation
2012-01-13 12:09 . 2012-02-06 09:17 -------- d-----w- C:\NVIDIA
2012-01-13 11:34 . 2012-01-13 11:34 -------- d-----w- c:\users\FILIPPO\AppData\Local\ESET
2012-01-13 10:38 . 2012-01-14 17:24 -------- d-----w- c:\users\FILIPPO\AppData\Local\Ahead
2012-01-13 10:26 . 2012-01-14 17:25 -------- d-----w- c:\users\FILIPPO\AppData\Roaming\Ahead
2012-01-13 10:26 . 2012-01-13 10:26 -------- d-----w- c:\programdata\Ahead
2012-01-13 10:25 . 2012-01-13 10:26 -------- d-----w- c:\program files\Common Files\Ahead
2012-01-13 10:25 . 2012-01-13 10:25 -------- d-----w- c:\programdata\Nero
2012-01-13 10:25 . 2012-01-13 10:25 -------- d-----w- c:\program files\Nero
2012-01-13 09:54 . 2012-02-05 11:48 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-13 09:54 . 2011-11-17 05:41 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-13 09:54 . 2011-11-17 05:41 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-13 09:54 . 2011-11-17 05:39 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-13 09:54 . 2011-11-17 05:35 314880 ----a-w- c:\windows\system32\webio.dll
2012-01-13 09:54 . 2011-11-17 05:34 15872 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-13 09:54 . 2011-11-17 05:34 100352 ----a-w- c:\windows\system32\sspicli.dll
2012-01-13 09:54 . 2011-11-17 05:34 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-13 09:54 . 2011-11-17 05:34 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-13 09:54 . 2011-11-17 05:29 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-13 09:16 . 2012-01-18 20:15 -------- d-----w- c:\program files\MSXML 4.0
2012-01-13 09:12 . 2011-11-17 05:38 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-01-13 09:12 . 2011-10-26 04:32 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-01-13 09:12 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\system32\quartz.dll
2012-01-13 09:12 . 2011-11-19 14:01 67072 ----a-w- c:\windows\system32\packager.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-11 09:27 . 2011-06-14 17:42 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-05 11:52 . 2009-07-13 23:32 50688 ----a-w- c:\windows\system32\psbase.dll
2012-02-05 11:51 . 2009-07-13 23:54 90624 ----a-w- c:\windows\system32\rasauto.dll
2012-02-05 11:50 . 2009-07-13 23:21 526848 ----a-w- c:\windows\system32\ntvdm.exe
2012-02-05 11:45 . 2009-07-13 23:27 531968 ----a-w- c:\windows\system32\ddraw.dll
2012-02-05 11:45 . 2010-11-20 21:29 551424 ----a-w- c:\windows\system32\samsrv.dll
2012-02-05 11:45 . 2009-07-13 23:12 191488 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-02-05 11:44 . 2011-06-14 17:12 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-02-05 11:44 . 2010-11-20 21:29 1414144 ----a-w- c:\windows\system32\ole32.dll
2012-01-12 11:47 . 2011-03-28 17:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-01-12 11:21 . 2011-06-14 17:39 544656 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\system32\GPhotos.scr
2011-12-07 09:08 . 2011-06-14 16:52 236576 ------w- c:\windows\system32\MpSigStub.exe
2011-11-24 04:25 . 2011-12-31 17:23 2342912 ----a-w- c:\windows\system32\win32k.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-07-13 . ADD2ADE1C2B285AB8378D2DAAF991481 . 17920 . . [6.1.7600.16385] . . c:\windows\System32\drivers\asyncmac.sys
[-] 2009-07-13 . ADD2ADE1C2B285AB8378D2DAAF991481 . 17920 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_6.1.7600.16385_none_242e2506962cd3e0\asyncmac.sys
.
[-] 2009-07-13 . 505506526A9D467307B3C393DEDAF858 . 6144 . . [6.1.7600.16385] . . c:\windows\System32\drivers\beep.sys
[-] 2009-07-13 . 505506526A9D467307B3C393DEDAF858 . 6144 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-beepsys_31bf3856ad364e35_6.1.7600.16385_none_c3f6f77668f0ddcc\beep.sys
.
[-] 2009-07-13 . F9756A98D69098DCA8945D62858A812C . 4608 . . [6.1.7600.16385] . . c:\windows\System32\drivers\null.sys
[-] 2009-07-13 . F9756A98D69098DCA8945D62858A812C . 4608 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-null_31bf3856ad364e35_6.1.7600.16385_none_a93c43a07c50a038\null.sys
.
[-] 2009-07-14 . 7CCCFCA7510684768DA22092D1FA4DB2 . 280576 . . [6.1.7600.16385] . . c:\windows\System32\netman.dll
[-] 2009-07-14 . 7CCCFCA7510684768DA22092D1FA4DB2 . 280576 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-netman_31bf3856ad364e35_6.1.7600.16385_none_0f9371b9b32368a4\netman.dll
.
[-] 2009-07-14 . 808D8A8B2A3074002852BC856D419576 . 1297408 . . [2001.12.8530.16385] . . c:\windows\System32\comres.dll
[-] 2009-07-14 . 808D8A8B2A3074002852BC856D419576 . 1297408 . . [2001.12.8530.16385] . . c:\windows\winsxs\x86_microsoft-windows-com-complus.res_31bf3856ad364e35_6.1.7600.16385_none_2c8730fb47856e94\comres.dll
.
[-] 2010-11-20 . 0AFBE7743E05C20E0D012EE6FE60F0CC . 585728 . . [7.5.7600.16385] . . c:\windows\System32\qmgr.dll
[-] 2010-11-20 . 0AFBE7743E05C20E0D012EE6FE60F0CC . 585728 . . [7.5.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.1.7601.17514_none_25982ed857b42497\qmgr.dll
.
[-] 2009-07-14 . F6916EFC29D9953D5D0DF06882AE8E16 . 271360 . . [2001.12.8530.16385] . . c:\windows\System32\es.dll
[-] 2009-07-14 . F6916EFC29D9953D5D0DF06882AE8E16 . 271360 . . [2001.12.8530.16385] . . c:\windows\winsxs\x86_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.1.7600.16385_none_0cc3f540b311359a\es.dll
.
[-] 2009-07-14 . 50BA656134F78AF64E4DD3C8B6FEFD7E . 12288 . . [6.1.7600.16385] . . c:\windows\System32\cngaudit.dll
[-] 2009-07-14 . 50BA656134F78AF64E4DD3C8B6FEFD7E . 12288 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
.
[-] 2009-07-14 . CB9A8683F4EF2BF99E123D79950D7935 . 112640 . . [6.1.7600.16385] . . c:\windows\System32\regsvc.dll
[-] 2009-07-14 . CB9A8683F4EF2BF99E123D79950D7935 . 112640 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-remoteregistry-service_31bf3856ad364e35_6.1.7600.16385_none_893c5bdce4cae672\regsvc.dll
.
[-] 2009-07-14 . D887C9FD02AC9FA880F6E5027A43E118 . 162816 . . [6.1.7600.16385] . . c:\windows\System32\ssdpsrv.dll
[-] 2009-07-14 . D887C9FD02AC9FA880F6E5027A43E118 . 162816 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-upnpssdp_31bf3856ad364e35_6.1.7600.16385_none_7f9fc90f328bdf26\ssdpsrv.dll
.
[-] 2009-07-14 . 6383C60EC0133B14F5705F96369421B2 . 288256 . . [6.1.7600.16385] . . c:\windows\System32\hnetcfg.dll
[-] 2009-07-14 . 6383C60EC0133B14F5705F96369421B2 . 288256 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-i..ectionsharingconfig_31bf3856ad364e35_6.1.7600.16385_none_b00c9bd7f5ed1c02\hnetcfg.dll
.
[-] 2009-07-14 . 833FBB672460EFCE8011D262175FAD33 . 266752 . . [6.1.7600.16385] . . c:\windows\System32\upnphost.dll
[-] 2009-07-14 . 833FBB672460EFCE8011D262175FAD33 . 266752 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_c1be8a9895d79340\upnphost.dll
.
[-] 2009-07-14 . 0E85C11F8850D524B02181C6E02BA9AE . 453632 . . [6.1.7600.16385] . . c:\windows\System32\dsound.dll
[-] 2009-07-14 . 0E85C11F8850D524B02181C6E02BA9AE . 453632 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-audio-dsound_31bf3856ad364e35_6.1.7600.16385_none_5872147ba3367471\dsound.dll
.
[-] 2010-11-20 . C9D89535F7959A7F6988BBAFB464D236 . 1828352 . . [6.1.7601.17514] . . c:\windows\System32\d3d9.dll
[-] 2010-11-20 . C9D89535F7959A7F6988BBAFB464D236 . 1828352 . . [6.1.7601.17514] . . c:\windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_c454d690bf084f04\d3d9.dll
.
[-] 2012-02-05 . 198552AEFECA69D646867EC8D792DE95 . 531968 . . [6.1.7600.16385] . . c:\windows\System32\ddraw.dll
[-] 2012-02-05 . 198552AEFECA69D646867EC8D792DE95 . 531968 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e\ddraw.dll
.
[-] 2009-07-14 . EDD2AD141DEBD425D74A52A4D7BE6AC4 . 39424 . . [6.1.7600.16385] . . c:\windows\System32\perfctrs.dll
[-] 2009-07-14 . EDD2AD141DEBD425D74A52A4D7BE6AC4 . 39424 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.1.7600.16385_none_314993e6be6d6809\perfctrs.dll
.
[-] 2009-07-14 . 55187FD710E27D5095D10A472C8BAF1C . 288768 . . [6.1.7600.16385] . . c:\windows\System32\w32time.dll
[-] 2009-07-14 . 55187FD710E27D5095D10A472C8BAF1C . 288768 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-time-service_31bf3856ad364e35_6.1.7600.16385_none_887db9d2ce9e3aa0\w32time.dll
.
[-] 2009-07-14 . 5A12C364AD1D4FCC0AD0E56DBBC34462 . 16896 . . [6.1.7600.16385] . . c:\windows\System32\midimap.dll
[-] 2009-07-14 . 5A12C364AD1D4FCC0AD0E56DBBC34462 . 16896 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-audio-mmecore-other_31bf3856ad364e35_6.1.7600.16385_none_8cd41e2771e37717\midimap.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA801577-E6AD-4BD5-8F71-4BE0154331A4}]
2011-03-31 20:45 286208 ----a-w- c:\program files\Classic Shell\ClassicIE9DLL_32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2011-03-31 20:45 501760 ----a-w- c:\program files\Classic Shell\ClassicExplorer32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2011-12-20 2696512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Classic Start Menu"="c:\program files\Classic Shell\ClassicStartMenu.exe" [2011-03-31 91648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]
"ControlCenter4"="c:\program files\ControlCenter4\BrCcBoot.exe" [2010-10-26 139264]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 09:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-01-03 21:51 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-11-01 22:25 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-05-16 08:27 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2010-03-08 23:37 46368 ----a-w- c:\program files\Nuance\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2009-05-05 15:06 222496 ----a-w- c:\programdata\FLEXnet\Connect\11\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 14:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2010-03-08 23:42 29984 ----a-w- c:\program files\Nuance\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF5 Registry Controller]
2010-03-05 18:11 62752 ----a-w- c:\program files\Nuance\PDF Viewer Plus\RegistryController.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFHook]
2010-03-05 19:11 636192 ----a-w- c:\program files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPort12reminder]
2010-02-09 12:42 328992 ----a-w- c:\program files\Nuance\PaperPort\Ereg\Ereg.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 wxpSvc;webcamXP Service;c:\program files\wLite\wService.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2012-01-31 374152]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2011-09-16 12856]
S2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe [2010-03-08 144672]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
S3 netw5v32;Driver scheda Intel(R) Wireless WiFi Link serie 5000 per Windows Vista a 32 bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 RTL8167;Driver Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2012-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-710450500-849374731-4109036366-1000Core.job
- c:\users\FILIPPO\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-14 12:43]
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-710450500-849374731-4109036366-1000UA.job
- c:\users\FILIPPO\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-14 12:43]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{56753E59-AF1D-4FBA-9E15-31557124ADA2} - c:\program files\Classic Shell\ClassicIE9_32.exe
TCP: DhcpNameServer = 192.168.10.1
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\wxpSvc]
"ImagePath"="c:\program files\wLite\wService.exe /startedbyscm:5053B757-40E35B3B-webcamSRV"
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
"AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
"DataDir"="ESET\\ESET NOD32 Antivirus\\"
"EditionName"=" "
"InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
"LanguageId"=dword:00000410
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000000
"ProductCode"="{BCB0D944-D27E-451C-A1A5-F31C7589F14E}"
"ProductName"="ESET NOD32 Antivirus"
"ProductType"="eav"
"ProductVersion"="4.2.67.10"
"UniqueId"="0055E8AA4F1015EE"
"ScannerBuild"=dword:00001fb5
"ScannerVersionId"=dword:000015d7
"ScannerVersion"="Open window for status."
"ei2"=hex(b):56,2d,f4,ba,a4,6c,a7,2d
"ei1"=hex(b):00,1e,68,7f,3c,5b,00,00
"ei3"=hex(b):20,16,10,4f,00,00,00,00
"ei4"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------
.
- - - - - - - > 'lsass.exe'(496)
c:\windows\system32\pku2u.DLL
.
Ora fine scansione: 2012-02-11 16:57:46
ComboFix-quarantined-files.txt 2012-02-11 15:57
.
Pre-Run: 44.725.489.664 byte disponibili
Post-Run: 53.036.052.480 byte disponibili
.
- - End Of File - - 51137A445C493B5FE83DA9180042ABAD

 

[writhziden]

Use either the BitDefender Rescue CD or the Microsoft Standalone System Sweeper Beta | Microsoft Connect to scan for and remove the viruses without booting into Windows.

 

[giancai]

ok I will. I also wanted to say I've done sfc / cannow and found problems. As can be repaired? but if I reinstall windows 7 i get error 0xc0000005, and I stopped the installation.

 

[writhziden]

Did you try a full format of the drive before installing? You can open a command prompt when the installation disc loads to format the drive. Make sure you format the correct drive if you have any secondary hard drives or external hard drives connected. You may also want to do a Clean All with Diskpart if you want to remove any viruses. http://www.sevenforums.com/tutorials/52129-disk-clean-clean-all-diskpart-command.html

Backup any important data before doing the above.

 

[giancai]

I tried to reinstall win 7 from system crashes and I started giving 42% error 0xc0000005. I can not format hard disk. but if I do sfc / scannow tells me: unable to restore damaged files found. how can I fix this?

 

[writhziden]

Why are you unable to format the drive? In the command prompt, use Diskpart to find your drive. List volume will list all partitions on your system. Select the volume that corresponds to the partition you want to put Windows on. The following commands assume the volume you want to format is volume 2; your volume number may be and probably is different.

Diskpart
list volume
select volume 2
format fs=ntfs​

 

[giancai]

I do not want to format, but to solve the problem ..... if I format hard drive, I lose the configuration of my pc.

 

[writhziden]

http://www.sevenforums.com/installation-setup/25058-installation-error-0xc0000005.html may be worth reading.

 

[giancai]

the disk it's perfect. don't have error. I tried to format and install OS and works well. But I made a clone of the hard disk and what is wrong. during installation of the system initiated by an error 0xc0000005. If I do sfc / scannow tells me that there are errors that can not be repaired.

 

[writhziden]

More than likely, you have a corrupted file system on the hard disk. When you cloned the disk, that corruption was cloned with it, hence why you have that problem trying to run the cloned data. Run chkdsk /f through the command prompt for drives c:, d:, e:, etc. Do the following:

chkdsk /f c:
chkdsk /f d:
chkdsk /f e:
chkdsk /f f:​

.etc until you get the message that the volume could not be opened for direct access. For any drives that do not give the message:
"Windows has checked the file system and found no problems"
run chkdsk again as above. In other words, if it says:
"Windows has made corrections to the file system"
after running the disk check, run the disk check again.

I realize you may only have one disk show up in Windows explorer, but you may have more than one disk through recovery options/the install disc. This is because the system creates a hidden boot partition (which will be C: in recovery), you may have a recovery partition for your PC that is hidden (which will be D: in recovery), and you will have your primary Windows partition (which may be E: in recovery). A custom PC will likely have at least C: and D: to scan.

 

[giancai]

but I do it in safe mode as administrator?

 

[writhziden]

I was thinking you would do it through the install disc or through your recovery options. http://www.sevenforums.com/tutorials/666-advanced-boot-options.html -> Repair Your Computer -> http://www.sevenforums.com/tutorials/668-system-recovery-options.html -> Command Prompt -> chkdsk commands

 

[giancai]

I have already tried to do this. the problem that I can not fix system errors. If I do sfc / scannow, it gives me errors that were found system errors repaired. how do I?

 

[writhziden]

You should not need to repair system errors to install Windows again. Maybe I am not understanding what you are trying to do.

 

[giancai]

I did scan with ComboFix and found infected files. I deleted it. the problem was TrustedInstaller. I booted the system is ready and when I did install windows, but it stops at 6% ...... I hope you understand ......

 

[writhziden]

So to recap: You can install Windows if you format the drive? The chkdsk commands do not fix the install problem? SFC /SCANNOW also does not fix the problem?

 

[giancai]

So: if I use another hard disk and install windows everything is fine. if I use the command chkdsk / r and I start the car, there is always the problem. but if I do sfc / scannow tells me that there are some system files can not be repaired. If I start to install windows from system initiated stops at 42%. other info that I give?