[log hijackthis] schede internet che si aprono a caso

[jiro90]

Ciao a tutti, come da titolo mi si aprono schede contenenti pubblicità mentre navigo su internet.
Non è una cosa molto invasiva, nel senso che non succede continuamente, e succede tramite parole chiave (per esempio il titolo di una discussione del forum contiene la parola "infostrada", allora si apre una pubblicità di infostrada)
Ma nonostante ciò è ovviamente molto fastidioso...

Ho già seguito tutti i passi di questa guida e pertanto vi allego il log di hijackthis, spero proprio che possiate aiutarmi!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:14:01, on 19/08/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\Users\Public\Documents\PowerOffer\POService.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCON/6
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCON/6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCON/6
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PowerOffer - {3543619C-D563-43f7-95EA-4DA7E1CC396A} - C:\Users\Public\Documents\PowerOffer\PowerOfferBHO .dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stw rt64.inf_amd64_neutral_1c0e2d1db9f5b08e\AESTSr64.e xe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stw rt64.inf_amd64_neutral_1c0e2d1db9f5b08e\STacSV64.e xe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\SysWOW64\ZoneLabs\vsmon.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8408 bytes

EDIT: dimenticavo, la scansione con Avira mi dice che è tutto a posto, mentre Malaware-bytes ha trovato due files infetti, ma (come sospettavo) la loro rimozione non ha risolto il problema...

Spero di avervi dato tutte le informazioni necessarie

[menatwork]

il log sembra a posto prova a lanciare KillSgrunt e lascia che scansioni il pc

disattiva l'antivirus prima di scaricarlo

[jiro90]

Grazie mille per la risposta
Ma come mai devo disattivare l'antivirus prima di scaricarlo?

EDIT: leggendo sul forum mi è sembrato di capire che l'antivirus lo consideri erroneamente come file infetto...

[menatwork]

Ma come mai devo disattivare l'antivirus prima di scaricarlo? EDIT: leggendo sul forum mi è sembrato di capire che l'antivirus lo consideri erroneamente come file infetto...

per questo ti ho consigliato di disattivare l'antivirus

[jiro90]

Nonostante abbia disattivato l'antivirus (anche eliminando il processo da msconfig e riavviando) non riesco ad aprire il file... Qua passo da un problema all'altro!

[menatwork]

prova ad aprirlo col tasto destro e come amministratore del sistema

[jiro90]

Avevo già provato ma nisba...

[jiro90]

Non so cosa succeda stasera, probabilmente sono solo un po' rincoglionito, comunque per sicurezza ho riprovato a eseguire come amministratore ed è partito!

Però non ha rilevato niente infetto dal malaware sgrunt, qualche altra idea?
Grazie per l'aiuto menatwork!

[menatwork]

se non dai ''IGNORA'' avira non te lo fa passare

prova a fare questa scansione con l'antivirus disattivato scarica combofix e mettilo sul desktop

devi rinominare il file prima di salvarlo sul desktop in abc.exe
(per rinominare il file, quando lo scarichi ti chiede dove salvarlo e ti compare la casella "nome file" ,basta che cambi il nome che ti appare in abc.exe)
Fatto questo, clicca su start>esegui, nel box bianco copia e incolla questo comando, virgolette comprese:

"%userprofile%\desktop\abc.exe" /killall

Premi OK, se tutto va bene parte il programma che potrebbe impiegare molto (non fare altre manovre durante la scansione),una volta terminata, se tutto è andato bene, in C:\ dovresti trovare il file combofix.txt , riavvia in modalità normale e posta il contenuto del file o allegalo.


N.B.- POTRESTI RICEVERE DEGLI AVVISI DA AVIRA, IGNORALI E PROSEGUI TRANQUILLAMENTE

[jiro90]

Fatto, non ci ha messo moltissimo, ecco il log:

ComboFix 11-08-19.02 - Emanuele 19/08/2011 23:58:59.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.39.1040.18.3894.2516 [GMT 2:00]
Eseguito da: c:\users\Emanuele\Desktop\abc.exe
Opzioni usate :: /killall
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Creati Da 2011-07-19 al 2011-08-19 )))))))))))))))))))))))))))))))))))
.
.
2011-08-19 22:03 . 2011-08-19 22:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-19 20:06 . 2011-08-19 20:06 -------- d-----w- c:\program files (x86)\Trend Micro
2011-08-19 19:48 . 2011-07-16 04:24 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2011-08-19 18:55 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-19 18:55 . 2011-08-19 18:55 -------- d-----w- c:\programdata\Malwarebytes
2011-08-19 18:55 . 2011-08-19 18:55 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-19 18:55 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-19 18:31 . 2011-08-19 18:31 -------- d-----w- c:\programdata\F-Secure
2011-08-18 16:10 . 2011-08-18 16:10 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-18 11:32 . 2011-08-18 11:32 1409 ----a-w- c:\windows\QTFont.for
2011-08-10 11:45 . 2011-08-16 21:53 -------- d-----w- c:\program files (x86)\BatteryCare
2011-08-10 10:13 . 2011-08-16 21:53 -------- d-----w- C:\Dev-Cpp
2011-08-10 07:27 . 2011-08-16 21:53 -------- d-----w- c:\program files\CCleaner
2011-08-08 11:08 . 2011-08-16 21:53 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-08-08 11:08 . 2011-08-16 21:48 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-07-28 20:50 . 2011-08-16 21:48 -------- d-----w- c:\program files (x86)\iPod
2011-07-28 20:50 . 2011-08-16 21:48 -------- d-----w- c:\program files (x86)\iTunes
2011-07-28 20:50 . 2011-07-28 20:50 -------- d-----w- c:\program files (x86)\Bonjour
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin7.dll
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin6.dll
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin5.dll
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin4.dll
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin3.dll
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin2.dll
2011-07-28 20:50 . 2011-07-28 20:50 143360 ----a-w- c:\program files (x86)\Internet Explorer\Plugin\npqtplugin.dll
2011-07-28 20:50 . 2011-08-16 21:48 -------- d-----w- c:\programdata\Apple Computer
2011-07-28 20:50 . 2011-07-28 20:50 -------- d-----w- c:\program files (x86)\QuickTime
2011-07-28 20:49 . 2011-07-28 20:49 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-07-28 20:49 . 2011-07-28 20:49 -------- d-----w- c:\programdata\Apple
2011-07-28 10:22 . 2011-07-28 10:22 -------- d-----w- c:\windows\Sun
2011-07-27 14:26 . 2011-07-27 14:26 -------- d-----w- c:\windows\system32\SPReview
2011-07-27 14:26 . 2011-07-27 14:26 -------- d-----w- c:\windows\system32\EventProviders
2011-07-27 13:51 . 2010-11-20 13:27 1465344 ----a-w- c:\windows\system32\XpsPrint.dll
2011-07-27 13:50 . 2010-11-20 13:33 103808 ----a-w- c:\windows\system32\drivers\sbp2port.sys
2011-07-27 13:49 . 2010-11-20 13:16 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2011-07-27 13:48 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
2011-07-27 12:50 . 2011-07-27 13:19 -------- d-----w- C:\maxpayne
2011-07-27 11:51 . 2001-09-05 02:18 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2011-07-27 11:51 . 2001-09-05 02:18 225280 ----a-w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-07-27 11:51 . 2001-09-05 02:14 176128 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2011-07-27 11:51 . 2001-09-05 02:13 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2011-07-27 11:29 . 2011-07-27 11:29 -------- d-----w- c:\program files (x86)\Alcohol Soft
2011-07-27 11:28 . 2011-07-27 11:28 871408 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-07-27 11:17 . 2011-07-27 11:17 -------- d-----w- c:\programdata\Martau
2011-07-27 11:16 . 2011-07-27 11:16 -------- d-----w- c:\program files (x86)\Total Uninstall 5
2011-07-27 00:25 . 2011-07-27 00:25 -------- d-----w- c:\programdata\Recovery
2011-07-26 17:22 . 2011-07-26 17:22 -------- d-----w- c:\program files (x86)\uTorrent
2011-07-26 16:50 . 2011-07-26 16:50 -------- d-----w- c:\windows\SysWow64\Wat
2011-07-26 16:50 . 2011-07-26 16:50 -------- d-----w- c:\windows\system32\Wat
2011-07-26 16:27 . 2011-07-26 16:27 -------- d-----w- c:\program files (x86)\MSXML 4.0
2011-07-26 16:26 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2011-07-26 16:15 . 2011-07-26 16:15 -------- d-----w- c:\program files (x86)\VideoLAN
2011-07-26 16:15 . 2011-07-26 16:15 715806 ----a-w- c:\windows\unins000.exe
2011-07-26 15:57 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe
2011-07-26 15:57 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe
2011-07-26 15:57 . 2010-12-17 11:40 715776 ----a-w- c:\windows\system32\kerberos.dll
2011-07-26 15:57 . 2010-12-17 07:07 542208 ----a-w- c:\windows\SysWow64\kerberos.dll
2011-07-26 15:55 . 2011-03-03 06:24 183296 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-07-26 15:55 . 2011-03-03 06:21 30208 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-07-26 15:55 . 2011-03-03 05:36 28672 ----a-w- c:\windows\SysWow64\dnscacheugc.exe
2011-07-26 15:55 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2011-07-26 15:55 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-07-26 15:55 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-07-26 15:55 . 2011-06-11 03:07 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-07-26 15:33 . 2011-07-20 07:44 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{282677CC-C13F-4764-A334-ADE84A94176F}\mpengine.dll
2011-07-26 15:33 . 2011-05-24 17:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-07-26 15:00 . 2011-07-26 15:00 -------- d-----w- c:\users\Public\CyberLink
2011-07-26 14:53 . 2011-07-26 14:53 -------- d-----w- c:\programdata\CheckPoint
2011-07-26 14:53 . 2011-08-19 22:04 -------- d-----w- c:\windows\Internet Logs
2011-07-26 14:48 . 2011-07-26 14:48 -------- d-----w- c:\programdata\Avira
2011-07-26 14:48 . 2011-07-26 14:48 -------- d-----w- c:\program files (x86)\Avira
2011-07-26 14:48 . 2011-07-20 09:34 83120 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-26 14:48 . 2011-07-20 09:34 116568 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-07-26 14:39 . 2011-07-26 14:39 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-07-26 14:39 . 2011-05-04 02:52 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-07-26 14:31 . 2011-07-26 14:31 -------- d-----w- c:\users\Public\Symantec
.
.
.