Ir ao conteúdo
  • Cadastre-se
Entre para seguir isso  
samuklopes

Como tiro o ckvo de meu pc???

Recommended Posts

Olá,

Por favor siga as instruções contidas nesse tópico, e depois gere e cole um novo log do HijackThis aqui neste mesmo tópico.

Abraço

-------------------------

Bom dia colega.

Segue o log do HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 10:29:37, on 17/9/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\ARQUIV~1\LAUNCH~1\LManager.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\ARQUIV~1\HDTUNE~1\HDTune.exe

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Arquivos de programas\LClock\lclock.exe

C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE

C:\WINDOWS\system32\igfxext.exe

C:\Arquivos de programas\Thoosje Vista Sidebar\Thoosje Sidebar.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

C:\DOCUME~1\Samuk\CONFIG~1\Temp\RtkBtMnt.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mercadolivre.com.br/jm/myML?fl=Y

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [LManager] C:\ARQUIV~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AzMixerSel] C:\Arquivos de programas\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [HD Tune] C:\ARQUIV~1\HDTUNE~1\HDTune.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [LClock] C:\Arquivos de programas\LClock\lclock.exe

O4 - HKCU\..\Run: [VisualTaskTips] C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

O4 - Startup: Microsoft Office Outlook (2).lnk = C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE

O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: Thoosje Viste Sidebar (2).lnk = C:\Arquivos de programas\Thoosje Vista Sidebar\Thoosje Sidebar.exe

O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221624070687

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?AuthParam=1221453747_76ca9f74d44c7181d9a36d42477e56d2&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab&File=jinstall-6u7-windows-i586-jc.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

Abraços

Compartilhar este post


Link para o post
Compartilhar em outros sites

Olá,

Siga as instruções contidas no link abaixo e instale e execute o Combofix:

http://www.bleepingcomputer.com/combofix/pt/como-usar-o-combofix

  • É importante que instale a console de recuperação também.
  • Quando a ferramenta terminar de rodar, gerará um log (o arquivo C:\ComboFix.txt).
  • Cole o conteúdo desse arquivo e faça também um novo log do HijackThis para colocar na sua resposta.

Atenção: Não utilize o mouse nem o teclado enquanto a ferramenta estiver rodando, isso pode fazer com que o pc pare.

Nota: Por favor, NÃO utilize o ComboFix sozinho. É uma ferramenta poderosa criada pra lidar com infeções sofisticadas e caso não a utilize correctamente poderá danificar o seu computador. A ferramenta apenas deve ser utilizada sob supervisão de Assistentes de remoção de malware.

Compartilhar este post


Link para o post
Compartilhar em outros sites
Olá,

Siga as instruções contidas no link abaixo e instale e execute o Combofix:

http://www.bleepingcomputer.com/combofix/pt/como-usar-o-combofix

  • É importante que instale a console de recuperação também.
  • Quando a ferramenta terminar de rodar, gerará um log (o arquivo C:\ComboFix.txt).
  • Cole o conteúdo desse arquivo e faça também um novo log do HijackThis para colocar na sua resposta.

Atenção: Não utilize o mouse nem o teclado enquanto a ferramenta estiver rodando, isso pode fazer com que o pc pare.

Nota: Por favor, NÃO utilize o ComboFix sozinho. É uma ferramenta poderosa criada pra lidar com infeções sofisticadas e caso não a utilize correctamente poderá danificar o seu computador. A ferramenta apenas deve ser utilizada sob supervisão de Assistentes de remoção de malware.

---------------------------------

Boa noite amigo.

Desculpe a demora mas eu não estava em casa em esses ultimos dias.

Andei dando um fuçada aqui nos tópicos e achei alguns interessantes que eu até acredito ter conseguido tirar o virus do meu pc. Em modo de segurança sempre, passei o avast, depois malwarebyts e por ultimo penclean. fiz isso em todas as minhas partições e discos removíveis. sumiu alguns virus inclusive o ckvo0.dll e o autorum.exe.

Mas o log do combofix esta logo abaixo para sua análise. Acredito não ter mais nada de ruim poraqui mas espero uma resposta sua.

um abraço.

ComboFix 08-09-16.05 - Samuk 2008-09-21 19:53:35.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.993 [GMT -3:00]

Executando de: C:\Documents and Settings\Samuk\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\1u0o8bnq.cmd

C:\Documents and Settings\Samuk\Dados de aplicativos\inst.exe

D:\1u0o8bnq.cmd

.

((((((((((((((((((((((( Ficheiros criados de 2008-08-21 to 2008-09-21 ))))))))))))))))))))))))))))))))

.

2008-09-21 16:49 . 2008-09-21 16:49 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\InterVideo

2008-09-21 12:03 . 2008-09-21 12:03 38 --a------ C:\WINDOWS\AviSplitter.INI

2008-09-17 10:33 . 2008-09-17 10:34 <DIR> d-------- C:\Nova pasta

2008-09-16 00:09 . 2008-04-13 15:45 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

2008-09-15 23:49 . 2008-09-16 00:10 <DIR> d-------- C:\PenClean

2008-09-15 23:24 . 2008-09-15 23:24 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Malwarebytes

2008-09-15 23:24 . 2008-09-15 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes

2008-09-15 23:24 . 2008-09-15 23:27 <DIR> d-------- C:\Arquivos de programas\Malwarebytes' Anti-Malware

2008-09-15 23:24 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-09-15 23:24 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-09-15 23:22 . 2008-09-15 23:22 <DIR> d-------- C:\Arquivos de programas\Real

2008-09-15 23:22 . 2008-09-15 23:22 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\xing shared

2008-09-15 23:22 . 2008-09-15 23:22 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Real

2008-09-15 23:09 . 2008-09-15 23:09 <DIR> d-------- C:\Arquivos de programas\Essentials Codec Pack

2008-09-15 23:08 . 2008-09-15 23:08 <DIR> d-------- C:\Arquivos de programas\XP Codec Pack

2008-09-15 20:51 . 2008-09-15 21:00 <DIR> d-------- C:\Arquivos de programas\Thoosje Vista Sidebar

2008-09-15 19:35 . 2008-09-15 19:35 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Windows Sidebar Styler

2008-09-15 18:57 . 2008-09-15 18:57 <DIR> d-------- C:\Arquivos de programas\VisualTaskTips

2008-09-15 18:36 . 2008-09-15 18:36 <DIR> d-------- C:\Program Files

2008-09-15 18:36 . 2007-02-05 13:11 139,264 --a------ C:\WINDOWS\NeoUninstall.exe

2008-09-15 18:36 . 2008-09-15 18:36 26 --a------ C:\WINDOWS\neosetup.INI

2008-09-15 17:48 . 2008-09-15 17:48 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Auslogics

2008-09-15 17:22 . 2008-09-15 17:22 <DIR> d-------- C:\Arquivos de programas\LClock

2008-09-15 17:07 . 2008-09-15 17:07 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\RadLight Company

2008-09-15 17:07 . 2008-09-15 17:07 <DIR> d-------- C:\Arquivos de programas\RadLight Company

2008-09-15 17:05 . 2008-09-21 19:50 69 --a------ C:\WINDOWS\NeroDigital.ini

2008-09-15 16:43 . 2001-09-05 23:20 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys

2008-09-15 16:43 . 2001-09-05 23:20 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys

2008-09-15 16:43 . 2008-04-13 15:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys

2008-09-15 16:43 . 2008-04-13 15:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

2008-09-15 15:28 . 2008-09-15 15:28 3,072,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp

2008-09-15 15:28 . 2008-09-15 15:28 65,433 --a------ C:\WINDOWS\BricoPackUninst.cmd

2008-09-15 15:22 . 2008-09-15 15:22 <DIR> d-------- C:\WINDOWS\BricoPacks

2008-09-15 15:22 . 2008-09-15 15:28 6,114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd

2008-09-15 15:21 . 2008-09-15 15:21 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\DivX

2008-09-15 11:39 . 2008-09-15 11:39 <DIR> d-------- C:\Arquivos de programas\Alwil Software

2008-09-15 11:00 . 2008-05-09 07:55 512,000 -----c--- C:\WINDOWS\system32\dllcache\jscript.dll

2008-09-15 11:00 . 2008-05-09 07:55 430,080 -----c--- C:\WINDOWS\system32\dllcache\vbscript.dll

2008-09-15 11:00 . 2008-05-09 07:55 180,224 -----c--- C:\WINDOWS\system32\dllcache\scrobj.dll

2008-09-15 11:00 . 2008-05-09 07:55 172,032 -----c--- C:\WINDOWS\system32\dllcache\scrrun.dll

2008-09-15 11:00 . 2008-05-08 08:24 155,648 -----c--- C:\WINDOWS\system32\dllcache\wscript.exe

2008-09-15 11:00 . 2008-05-09 05:45 135,168 -----c--- C:\WINDOWS\system32\dllcache\cscript.exe

2008-09-15 11:00 . 2008-05-09 07:55 90,112 -----c--- C:\WINDOWS\system32\dllcache\wshext.dll

2008-09-15 10:49 . 2008-09-15 10:49 <DIR> d-------- C:\WINDOWS\system32\bits

2008-09-15 10:49 . 2008-09-15 10:49 <DIR> d-------- C:\WINDOWS\l2schemas

2008-09-15 10:47 . 2008-09-15 10:47 <DIR> d-------- C:\WINDOWS\ServicePackFiles

2008-09-15 10:14 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys

2008-09-15 10:14 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys

2008-09-15 10:14 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys

2008-09-15 10:14 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty

2008-09-15 09:57 . 2008-09-15 09:57 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\SoundSpectrum

2008-09-15 09:53 . 2008-09-15 09:53 <DIR> d-------- C:\Arquivos de programas\SoundSpectrum

2008-09-15 09:48 . 2008-09-15 09:48 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Adobe

2008-09-15 02:49 . 2008-09-15 02:49 <DIR> d-------- C:\Arquivos de programas\Microsoft Silverlight

2008-09-15 02:47 . 2004-08-04 00:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2008-09-15 02:34 . 2008-09-15 02:34 <DIR> d-------- C:\Arquivos de programas\MSXML 6.0

2008-09-15 01:48 . 2008-09-15 01:48 <DIR> d-------- C:\WINDOWS\Sun

2008-09-15 01:48 . 2008-09-15 01:48 <DIR> d-------- C:\Documents and Settings\Samuk\Incomplete

2008-09-15 01:48 . 2008-09-20 00:23 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\LimeWire

2008-09-15 01:48 . 2008-09-15 01:48 <DIR> d-------- C:\Arquivos de programas\LimeWire

2008-09-15 01:47 . 2008-09-15 01:47 <DIR> d-------- C:\Arquivos de programas\Java

2008-09-15 01:47 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-09-15 01:42 . 2008-09-15 01:42 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Java

2008-09-15 01:36 . 2008-09-15 01:36 <DIR> d-------- C:\Arquivos de programas\InterVideo

2008-09-15 01:19 . 2008-09-15 01:19 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

2008-09-15 00:47 . 2008-07-23 13:50 129,784 --------- C:\WINDOWS\system32\pxafs.dll

2008-09-15 00:47 . 2008-07-23 13:50 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys

2008-09-15 00:47 . 2008-07-23 13:50 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys

2008-09-15 00:36 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll

2008-09-15 00:36 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui

2008-09-15 00:19 . 2008-09-15 00:19 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus!

2008-09-14 18:47 . 2008-09-14 18:47 <DIR> d-------- C:\Arquivos de programas\MSXML 4.0

2008-09-14 18:36 . 2008-09-15 01:45 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\AdobeUM

2008-09-14 18:20 . 2008-09-14 18:20 <DIR> d-------- C:\Documents and Settings\Samuk\Contacts

2008-09-14 18:18 . 2008-09-14 23:56 <DIR> d-------- C:\Arquivos de programas\Messenger Plus! Live

2008-09-14 18:18 . 2008-09-14 18:18 268 --ah----- C:\sqmdata00.sqm

2008-09-14 18:18 . 2008-09-14 18:18 244 --ah----- C:\sqmnoopt00.sqm

2008-09-14 15:37 . 2008-09-14 15:37 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2

2008-09-14 15:36 . 2008-09-14 15:36 <DIR> d-------- C:\WINDOWS\system32\LogFiles

2008-09-14 15:36 . 2008-09-14 15:36 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2008-09-14 15:26 . 2008-09-15 02:38 <DIR> d-------- C:\WINDOWS\system32\XPSViewer

2008-09-14 15:25 . 2008-09-14 15:25 <DIR> d-------- C:\Arquivos de programas\Reference Assemblies

2008-09-14 15:25 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

2008-09-14 15:21 . 2008-09-15 10:49 <DIR> d-------- C:\WINDOWS\system32\pt-br

2008-09-14 15:06 . 2008-09-14 15:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2008-09-14 14:05 . 2008-09-14 14:05 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-09-14 14:05 . 2008-09-14 15:06 <DIR> d-------- C:\Arquivos de programas\Windows Live

2008-09-14 14:05 . 2008-09-14 15:05 <DIR> d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-09-14 13:30 . 2008-09-14 13:30 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Ahead

2008-09-14 13:30 . 2008-09-14 13:30 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Ahead

2008-09-14 13:29 . 2008-09-14 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2008-09-14 13:29 . 2008-09-14 13:29 <DIR> d-------- C:\Arquivos de programas\Nero

2008-09-14 13:29 . 2008-09-14 13:30 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Ahead

2008-09-14 13:22 . 2008-09-14 13:22 <DIR> d-------- C:\Arquivos de programas\Marcos Velasco Security

2008-09-14 13:22 . 2008-09-14 13:22 <DIR> d-------- C:\Arquivos de programas\CCleaner

2008-09-14 13:21 . 2008-09-14 13:21 <DIR> d-------- C:\Arquivos de programas\IObit

2008-09-14 13:20 . 2008-09-14 13:20 <DIR> d-------- C:\Arquivos de programas\IrfanView

2008-09-14 13:19 . 2008-09-14 13:19 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\iMesh

2008-09-14 13:19 . 2008-09-14 13:19 <DIR> d-------- C:\Arquivos de programas\iMesh Applications

2008-09-14 13:19 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx

2008-09-14 13:18 . 2008-09-14 13:18 <DIR> d-------- C:\Arquivos de programas\HD Tune

2008-09-14 13:17 . 2008-09-14 13:17 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Vso

2008-09-14 13:17 . 2008-09-14 13:17 <DIR> d-------- C:\Arquivos de programas\DVDFab Platinum 3

2008-09-14 13:17 . 2008-09-14 13:17 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys

2008-09-14 13:17 . 2008-09-14 13:17 47,360 --a------ C:\Documents and Settings\Samuk\Dados de aplicativos\pcouffin.sys

2008-09-14 13:16 . 2008-09-15 00:47 <DIR> d-------- C:\Arquivos de programas\DivX

2008-09-14 13:16 . 2008-09-14 13:16 <DIR> d-------- C:\Arquivos de programas\Auslogics

2008-09-14 13:15 . 2008-09-14 13:15 <DIR> d-------- C:\Arquivos de programas\Webteh

2008-09-14 13:14 . 2008-09-14 13:14 <DIR> d-------- C:\Arquivos de programas\Ares

2008-09-14 13:02 . 2008-06-14 14:34 272,384 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-09-14 13:02 . 2008-06-14 14:34 272,384 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-09-14 12:58 . 2008-04-11 16:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

2008-09-14 12:58 . 2008-05-08 11:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys

2008-09-14 12:56 . 2008-09-15 11:01 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2008-09-14 12:56 . 2008-09-14 12:56 <DIR> d--hs---- C:\Documents and Settings\Samuk\UserData

2008-09-14 12:54 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll

2008-09-14 12:53 . 2008-09-14 15:29 <DIR> d-------- C:\Arquivos de programas\MSBuild

2008-09-14 12:53 . 2008-09-14 12:53 <DIR> d-------- C:\Arquivos de programas\Microsoft Works

2008-09-14 12:52 . 2008-09-14 12:52 <DIR> d-------- C:\Arquivos de programas\Acer Inc

2008-09-14 12:52 . 2008-09-14 12:52 100 --a------ C:\WINDOWS\GridV.UNI

2008-09-14 12:51 . 2008-09-14 12:51 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Office Genuine Advantage

2008-09-14 12:49 . 2008-09-14 12:52 <DIR> d-------- C:\WINDOWS\SHELLNEW

2008-09-14 12:46 . 2008-09-15 02:50 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2008-09-14 12:45 . 2008-09-14 12:45 <DIR> dr-h----- C:\MSOCache

2008-09-14 12:45 . 2008-09-14 12:45 <DIR> d-------- C:\Documents and Settings\NetworkService\Menu Iniciar

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-15 18:28 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll

2008-09-14 04:18 --------- d-----w C:\Arquivos de programas\microsoft frontpage

2008-09-14 04:17 --------- d-----w C:\Arquivos de programas\Serviços on-line

2008-09-14 04:16 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Serviços

2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe

2008-07-23 16:50 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys

2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

2008-07-23 16:50 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

2008-07-23 16:50 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll

2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll

2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll

2008-07-19 01:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll

2008-07-19 01:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe

2008-07-19 01:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll

2008-07-19 01:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll

2008-07-19 01:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll

2008-07-19 01:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll

2008-07-19 01:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll

2008-07-19 01:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll

2008-07-19 01:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll

2008-07-17 04:02 634,368 ------w C:\WINDOWS\system32\gpprefcl.dll

2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-06-24 21:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll

2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll

2008-06-23 16:29 817,152 ----a-w C:\WINDOWS\system32\wininet.dll

2008-04-14 02:21 60,416 --sha-w C:\WINDOWS\BricoPacks\SysFiles\80_msimn.exe

.

------- Sigcheck -------

2008-06-23 12:11 668160 4e6461ec1c5296ee5f4a9f0581569563 C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll

2008-06-23 11:56 668672 e1640d81ca8d86691e3d3c5319628aae C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll

2008-06-23 12:40 827904 8cfd66cc90f966333cfa8d8161e185df C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 C:\WINDOWS\ie7\wininet.dll

2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll

2008-06-23 13:29 817152 3222b60bf562cda0fe49091331a1817a C:\WINDOWS\ServicePackFiles\i386\wininet.dll

2008-06-23 13:29 826368 fb820c977c8249358d54fa9324b5e92b C:\WINDOWS\SoftwareDistribution\Download\85f81787425a5bd063d064ce03eeb06f\SP2GDR\wininet.dll

2008-06-23 12:40 827904 8cfd66cc90f966333cfa8d8161e185df C:\WINDOWS\SoftwareDistribution\Download\85f81787425a5bd063d064ce03eeb06f\SP2QFE\wininet.dll

2008-04-13 23:20 668160 df6d0f37a71883be3505dd517eb8ad83 C:\WINDOWS\SoftwareDistribution\Download\ab328c51d3f122e9b4346fc25ad3082e\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 C:\WINDOWS\SoftwareDistribution\Download\db4af1ac6589f72c1b526a2c3dd4eb21\backup\wininet.dll

2008-06-23 12:40 661504 2532fe667e74219ce5b61ed67e23f435 C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp2gdr\wininet.dll

2008-06-23 13:15 669184 c4fc92ee25942192a8bf7fe8d17c284e C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp2qfe\wininet.dll

2008-06-23 12:11 668160 4e6461ec1c5296ee5f4a9f0581569563 C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp3gdr\wininet.dll

2008-06-23 11:56 668672 e1640d81ca8d86691e3d3c5319628aae C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp3qfe\wininet.dll

2008-06-23 13:29 817152 3222b60bf562cda0fe49091331a1817a C:\WINDOWS\system32\wininet.dll

2008-06-23 13:29 826368 fb820c977c8249358d54fa9324b5e92b C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-13 23:20 977920 732946eeaa1d8ee2a4fc24370827617b C:\WINDOWS\explorer.exe

2007-06-13 10:10 1035264 45d521506825a10b80833b4e9621ccf6 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe

2007-06-13 10:21 1035264 dccbf18e94d651393a3ffa060f88e0a0 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

2004-08-04 00:45 1034240 fa61a19050ae14bec1a26de82390dd65 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

2008-04-13 23:20 977920 732946eeaa1d8ee2a4fc24370827617b C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2008-04-13 23:20 1035776 064ec7ff5f58b928c3e119402977fa6d C:\WINDOWS\SoftwareDistribution\Download\ab328c51d3f122e9b4346fc25ad3082e\explorer.exe

2004-08-04 00:45 1034240 fa61a19050ae14bec1a26de82390dd65 C:\WINDOWS\SoftwareDistribution\Download\db4af1ac6589f72c1b526a2c3dd4eb21\backup\explorer.exe

2007-06-13 10:21 1035264 dccbf18e94d651393a3ffa060f88e0a0 C:\WINDOWS\SoftwareDistribution\Download\ded860808e92d18393ff7e54f31e0110\sp2gdr\explorer.exe

2007-06-13 10:10 1035264 45d521506825a10b80833b4e9621ccf6 C:\WINDOWS\SoftwareDistribution\Download\ded860808e92d18393ff7e54f31e0110\sp2qfe\explorer.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias & legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]

"LClock"="C:\Arquivos de programas\LClock\lclock.exe" [2004-09-19 65536]

"VisualTaskTips"="C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe" [2006-07-31 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LManager"="C:\ARQUIV~1\LAUNCH~1\LManager.exe" [2006-07-20 593920]

"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 77824]

"AzMixerSel"="C:\Arquivos de programas\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]

"GrooveMonitor"="C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"HD Tune"="C:\ARQUIV~1\HDTUNE~1\HDTune.exe" [2007-09-03 401408]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

"Media Codec Update Service"="C:\Arquivos de programas\Essentials Codec Pack\update.exe" [2007-04-08 303104]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2008-09-15 185896]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

C:\Documents and Settings\Samuk\Menu Iniciar\Programas\Inicializar\

Microsoft Office Outlook (2).lnk - C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE [2008-05-21 12844576]

RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]

Thoosje Viste Sidebar (2).lnk - C:\Arquivos de programas\Thoosje Vista Sidebar\Thoosje Sidebar.exe [2008-08-18 605696]

TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]

UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]

Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.ffds"= ffdshow.ax

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^InterVideo WinCinema Manager.lnk]

backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^WinZip Quick Pick.lnk]

backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kamsoft

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-06-12 02:38 34672 C:\Arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

--a------ 2008-02-20 11:33 963072 C:\Arquivos de programas\Ares\Ares.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

--a------ 2007-05-16 09:27 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]

-ra------ 2006-03-23 01:17 118784 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]

-ra------ 2006-03-23 01:17 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2007-03-01 15:57 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

--a------ 2008-09-15 23:22 185896 C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

-r------- 2006-05-16 07:04 2879488 C:\WINDOWS\SkyTel.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Arquivos de programas\\Ares\\Ares.exe"=

"C:\\Arquivos de programas\\iMesh Applications\\iMesh\\iMesh.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Neoact\\Carom3D\\carom.exe"=

"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

\Shell\AutoRun\command - C:\1u0o8bnq.cmd

\Shell\explore\Command - C:\1u0o8bnq.cmd

\Shell\open\Command - C:\1u0o8bnq.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

\Shell\AutoRun\command - D:\1u0o8bnq.cmd

\Shell\explore\Command - D:\1u0o8bnq.cmd

\Shell\open\Command - D:\1u0o8bnq.cmd

*Newly Created Service* - PROCEXP90

.

- - - - ORFAOS REMOVIDOS - - - -

Notify-WgaLogon - (no file)

.

------- Ccan Suplementar -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.mercadolivre.com.br/jm/myML?fl=Y

O8 -: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-21 19:55:16

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2008-09-21 19:56:05

ComboFix-quarantined-files.txt 2008-09-21 22:56:03

Pre-Run: 8 pasta(s) 16,847,855,616 bytes disponíveis

Post-Run: 11 pasta(s) 16,869,203,968 bytes disponíveis

302 --- E O F --- 2008-09-15 13:58:20

Compartilhar este post


Link para o post
Compartilhar em outros sites

Olá,

( 1 ) Nota muito importante: Temporariamente e durante a execução destas instruções, é muito importante que mantenha desabilitados os seus programas de proteção (Antivirus, Antispyware e Firewall). Reactive as proteções após a execução do(s) procedimento(s) abaixo mencionado(s).

( 2 ) Abra o seu Bloco de Notas, copie (control + c) e cole (control + v) todo o texto que está dentro do "Quote":

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

  • Salve este arquivo como: CFScript.txt
    CFScriptB-4.gif
  • Tal com exemplificado na foto acima, arraste o arquivo CFScript.txt para o ComboFix.exe
  • Quando a ferramenta terminar de rodar, gerará um log. Anexe esse arquivo C:\ComboFix.txt de acordo com estas instruções.
  • Faça também um novo log do HijackThis para colocar na sua resposta.

Compartilhar este post


Link para o post
Compartilhar em outros sites
Olá,

( 1 ) Nota muito importante: Temporariamente e durante a execução destas instruções, é muito importante que mantenha desabilitados os seus programas de proteção (Antivirus, Antispyware e Firewall). Reactive as proteções após a execução do(s) procedimento(s) abaixo mencionado(s).

( 2 ) Abra o seu Bloco de Notas, copie (control + c) e cole (control + v) todo o texto que está dentro do "Quote":

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

  • Salve este arquivo como: CFScript.txt
    CFScriptB-4.gif
  • Tal com exemplificado na foto acima, arraste o arquivo CFScript.txt para o ComboFix.exe
  • Quando a ferramenta terminar de rodar, gerará um log. Anexe esse arquivo C:\ComboFix.txt de acordo com estas instruções.
  • Faça também um novo log do HijackThis para colocar na sua resposta.

---------------------------------------------

Boa noite colega.

O link para eu poder ver como se coloca o arquivo combofix.txt aqui na página ta quebrado, por isso copiei e colei logo abaixo ok.

Logfile of HijackThis v1.99.1

Scan saved at 19:19:58, on 22/9/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\ARQUIV~1\LAUNCH~1\LManager.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Arquivos de programas\LClock\lclock.exe

C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE

C:\Arquivos de programas\Thoosje Vista Sidebar\Thoosje Sidebar.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

C:\WINDOWS\system32\igfxext.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Nova pasta\HijackThis.exe

C:\WINDOWS\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mercadolivre.com.br/jm/myML?fl=Y

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [LManager] C:\ARQUIV~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [AzMixerSel] C:\Arquivos de programas\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [HD Tune] C:\ARQUIV~1\HDTUNE~1\HDTune.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Media Codec Update Service] C:\Arquivos de programas\Essentials Codec Pack\update.exe -silent

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [LClock] C:\Arquivos de programas\LClock\lclock.exe

O4 - HKCU\..\Run: [VisualTaskTips] C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

O4 - Startup: Microsoft Office Outlook (2).lnk = C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE

O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: Thoosje Viste Sidebar (2).lnk = C:\Arquivos de programas\Thoosje Vista Sidebar\Thoosje Sidebar.exe

O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe

O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221624070687

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?AuthParam=1221453747_76ca9f74d44c7181d9a36d42477e56d2&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab&File=jinstall-6u7-windows-i586-jc.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

------------------------------

ComboFix 08-09-20.05 - Samuk 2008-09-22 19:13:08.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1047 [GMT -3:00]

Executando de: C:\Documents and Settings\Samuk\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Samuk\Desktop\CFScript.txt

* Criado um novo ponto de restauro

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((( Ficheiros criados de 2008-08-22 to 2008-09-22 ))))))))))))))))))))))))))))))))

.

2008-09-21 16:49 . 2008-09-21 16:49 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\InterVideo

2008-09-21 12:03 . 2008-09-21 12:03 38 --a------ C:\WINDOWS\AviSplitter.INI

2008-09-17 10:33 . 2008-09-17 10:34 <DIR> d-------- C:\Nova pasta

2008-09-16 00:09 . 2008-04-13 15:45 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

2008-09-15 23:49 . 2008-09-16 00:10 <DIR> d-------- C:\PenClean

2008-09-15 23:24 . 2008-09-15 23:24 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Malwarebytes

2008-09-15 23:24 . 2008-09-15 23:24 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes

2008-09-15 23:24 . 2008-09-15 23:27 <DIR> d-------- C:\Arquivos de programas\Malwarebytes' Anti-Malware

2008-09-15 23:24 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-09-15 23:24 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-09-15 23:22 . 2008-09-15 23:22 <DIR> d-------- C:\Arquivos de programas\Real

2008-09-15 23:22 . 2008-09-15 23:22 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\xing shared

2008-09-15 23:22 . 2008-09-15 23:22 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Real

2008-09-15 23:09 . 2008-09-15 23:09 <DIR> d-------- C:\Arquivos de programas\Essentials Codec Pack

2008-09-15 23:08 . 2008-09-15 23:08 <DIR> d-------- C:\Arquivos de programas\XP Codec Pack

2008-09-15 20:51 . 2008-09-15 21:00 <DIR> d-------- C:\Arquivos de programas\Thoosje Vista Sidebar

2008-09-15 19:35 . 2008-09-15 19:35 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Windows Sidebar Styler

2008-09-15 18:57 . 2008-09-15 18:57 <DIR> d-------- C:\Arquivos de programas\VisualTaskTips

2008-09-15 18:36 . 2008-09-15 18:36 <DIR> d-------- C:\Program Files

2008-09-15 18:36 . 2007-02-05 13:11 139,264 --a------ C:\WINDOWS\NeoUninstall.exe

2008-09-15 18:36 . 2008-09-15 18:36 26 --a------ C:\WINDOWS\neosetup.INI

2008-09-15 17:48 . 2008-09-15 17:48 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Auslogics

2008-09-15 17:22 . 2008-09-15 17:22 <DIR> d-------- C:\Arquivos de programas\LClock

2008-09-15 17:07 . 2008-09-15 17:07 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\RadLight Company

2008-09-15 17:07 . 2008-09-15 17:07 <DIR> d-------- C:\Arquivos de programas\RadLight Company

2008-09-15 17:05 . 2008-09-21 23:10 69 --a------ C:\WINDOWS\NeroDigital.ini

2008-09-15 16:43 . 2001-09-05 23:20 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys

2008-09-15 16:43 . 2001-09-05 23:20 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys

2008-09-15 16:43 . 2008-04-13 15:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys

2008-09-15 16:43 . 2008-04-13 15:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

2008-09-15 15:28 . 2008-09-15 15:28 3,072,054 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp

2008-09-15 15:28 . 2008-09-15 15:28 65,433 --a------ C:\WINDOWS\BricoPackUninst.cmd

2008-09-15 15:22 . 2008-09-15 15:22 <DIR> d-------- C:\WINDOWS\BricoPacks

2008-09-15 15:22 . 2008-09-15 15:28 6,114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd

2008-09-15 15:21 . 2008-09-15 15:21 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\DivX

2008-09-15 11:39 . 2008-09-15 11:39 <DIR> d-------- C:\Arquivos de programas\Alwil Software

2008-09-15 11:00 . 2008-05-09 07:55 512,000 -----c--- C:\WINDOWS\system32\dllcache\jscript.dll

2008-09-15 11:00 . 2008-05-09 07:55 430,080 -----c--- C:\WINDOWS\system32\dllcache\vbscript.dll

2008-09-15 11:00 . 2008-05-09 07:55 180,224 -----c--- C:\WINDOWS\system32\dllcache\scrobj.dll

2008-09-15 11:00 . 2008-05-09 07:55 172,032 -----c--- C:\WINDOWS\system32\dllcache\scrrun.dll

2008-09-15 11:00 . 2008-05-08 08:24 155,648 -----c--- C:\WINDOWS\system32\dllcache\wscript.exe

2008-09-15 11:00 . 2008-05-09 05:45 135,168 -----c--- C:\WINDOWS\system32\dllcache\cscript.exe

2008-09-15 11:00 . 2008-05-09 07:55 90,112 -----c--- C:\WINDOWS\system32\dllcache\wshext.dll

2008-09-15 10:49 . 2008-09-15 10:49 <DIR> d-------- C:\WINDOWS\system32\bits

2008-09-15 10:49 . 2008-09-15 10:49 <DIR> d-------- C:\WINDOWS\l2schemas

2008-09-15 10:47 . 2008-09-15 10:47 <DIR> d-------- C:\WINDOWS\ServicePackFiles

2008-09-15 10:14 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys

2008-09-15 10:14 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys

2008-09-15 10:14 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys

2008-09-15 10:14 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty

2008-09-15 09:57 . 2008-09-15 09:57 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\SoundSpectrum

2008-09-15 09:53 . 2008-09-15 09:53 <DIR> d-------- C:\Arquivos de programas\SoundSpectrum

2008-09-15 09:48 . 2008-09-15 09:48 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Adobe

2008-09-15 02:49 . 2008-09-15 02:49 <DIR> d-------- C:\Arquivos de programas\Microsoft Silverlight

2008-09-15 02:47 . 2004-08-04 00:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

2008-09-15 02:34 . 2008-09-15 02:34 <DIR> d-------- C:\Arquivos de programas\MSXML 6.0

2008-09-15 01:48 . 2008-09-15 01:48 <DIR> d-------- C:\WINDOWS\Sun

2008-09-15 01:48 . 2008-09-15 01:48 <DIR> d-------- C:\Documents and Settings\Samuk\Incomplete

2008-09-15 01:48 . 2008-09-20 00:23 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\LimeWire

2008-09-15 01:48 . 2008-09-15 01:48 <DIR> d-------- C:\Arquivos de programas\LimeWire

2008-09-15 01:47 . 2008-09-15 01:47 <DIR> d-------- C:\Arquivos de programas\Java

2008-09-15 01:47 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-09-15 01:42 . 2008-09-15 01:42 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Java

2008-09-15 01:36 . 2008-09-15 01:36 <DIR> d-------- C:\Arquivos de programas\InterVideo

2008-09-15 01:19 . 2008-09-15 01:19 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

2008-09-15 00:47 . 2008-07-23 13:50 129,784 --------- C:\WINDOWS\system32\pxafs.dll

2008-09-15 00:47 . 2008-07-23 13:50 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys

2008-09-15 00:47 . 2008-07-23 13:50 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys

2008-09-15 00:36 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll

2008-09-15 00:36 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui

2008-09-15 00:19 . 2008-09-15 00:19 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus!

2008-09-14 18:47 . 2008-09-14 18:47 <DIR> d-------- C:\Arquivos de programas\MSXML 4.0

2008-09-14 18:36 . 2008-09-15 01:45 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\AdobeUM

2008-09-14 18:20 . 2008-09-14 18:20 <DIR> d-------- C:\Documents and Settings\Samuk\Contacts

2008-09-14 18:18 . 2008-09-14 23:56 <DIR> d-------- C:\Arquivos de programas\Messenger Plus! Live

2008-09-14 18:18 . 2008-09-14 18:18 268 --ah----- C:\sqmdata00.sqm

2008-09-14 18:18 . 2008-09-14 18:18 244 --ah----- C:\sqmnoopt00.sqm

2008-09-14 15:37 . 2008-09-14 15:37 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2

2008-09-14 15:36 . 2008-09-14 15:36 <DIR> d-------- C:\WINDOWS\system32\LogFiles

2008-09-14 15:36 . 2008-09-14 15:36 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2008-09-14 15:26 . 2008-09-15 02:38 <DIR> d-------- C:\WINDOWS\system32\XPSViewer

2008-09-14 15:25 . 2008-09-14 15:25 <DIR> d-------- C:\Arquivos de programas\Reference Assemblies

2008-09-14 15:25 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

2008-09-14 15:21 . 2008-09-15 10:49 <DIR> d-------- C:\WINDOWS\system32\pt-br

2008-09-14 15:06 . 2008-09-14 15:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2008-09-14 14:05 . 2008-09-14 14:05 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-09-14 14:05 . 2008-09-14 15:06 <DIR> d-------- C:\Arquivos de programas\Windows Live

2008-09-14 14:05 . 2008-09-14 15:05 <DIR> d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-09-14 13:30 . 2008-09-14 13:30 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Ahead

2008-09-14 13:30 . 2008-09-14 13:30 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Ahead

2008-09-14 13:29 . 2008-09-14 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2008-09-14 13:29 . 2008-09-14 13:29 <DIR> d-------- C:\Arquivos de programas\Nero

2008-09-14 13:29 . 2008-09-14 13:30 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Ahead

2008-09-14 13:22 . 2008-09-14 13:22 <DIR> d-------- C:\Arquivos de programas\Marcos Velasco Security

2008-09-14 13:22 . 2008-09-14 13:22 <DIR> d-------- C:\Arquivos de programas\CCleaner

2008-09-14 13:21 . 2008-09-14 13:21 <DIR> d-------- C:\Arquivos de programas\IObit

2008-09-14 13:20 . 2008-09-14 13:20 <DIR> d-------- C:\Arquivos de programas\IrfanView

2008-09-14 13:19 . 2008-09-14 13:19 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\iMesh

2008-09-14 13:19 . 2008-09-14 13:19 <DIR> d-------- C:\Arquivos de programas\iMesh Applications

2008-09-14 13:19 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx

2008-09-14 13:18 . 2008-09-14 13:18 <DIR> d-------- C:\Arquivos de programas\HD Tune

2008-09-14 13:17 . 2008-09-14 13:17 <DIR> d-------- C:\Documents and Settings\Samuk\Dados de aplicativos\Vso

2008-09-14 13:17 . 2008-09-14 13:17 <DIR> d-------- C:\Arquivos de programas\DVDFab Platinum 3

2008-09-14 13:17 . 2008-09-14 13:17 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys

2008-09-14 13:17 . 2008-09-14 13:17 47,360 --a------ C:\Documents and Settings\Samuk\Dados de aplicativos\pcouffin.sys

2008-09-14 13:16 . 2008-09-15 00:47 <DIR> d-------- C:\Arquivos de programas\DivX

2008-09-14 13:16 . 2008-09-14 13:16 <DIR> d-------- C:\Arquivos de programas\Auslogics

2008-09-14 13:15 . 2008-09-14 13:15 <DIR> d-------- C:\Arquivos de programas\Webteh

2008-09-14 13:14 . 2008-09-14 13:14 <DIR> d-------- C:\Arquivos de programas\Ares

2008-09-14 13:02 . 2008-06-14 14:34 272,384 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-09-14 13:02 . 2008-06-14 14:34 272,384 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-09-14 12:58 . 2008-04-11 16:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

2008-09-14 12:58 . 2008-05-08 11:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys

2008-09-14 12:56 . 2008-09-15 11:01 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2008-09-14 12:56 . 2008-09-14 12:56 <DIR> d--hs---- C:\Documents and Settings\Samuk\UserData

2008-09-14 12:54 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll

2008-09-14 12:53 . 2008-09-14 15:29 <DIR> d-------- C:\Arquivos de programas\MSBuild

2008-09-14 12:53 . 2008-09-14 12:53 <DIR> d-------- C:\Arquivos de programas\Microsoft Works

2008-09-14 12:52 . 2008-09-14 12:52 <DIR> d-------- C:\Arquivos de programas\Acer Inc

2008-09-14 12:52 . 2008-09-14 12:52 100 --a------ C:\WINDOWS\GridV.UNI

2008-09-14 12:51 . 2008-09-14 12:51 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Office Genuine Advantage

2008-09-14 12:49 . 2008-09-14 12:52 <DIR> d-------- C:\WINDOWS\SHELLNEW

2008-09-14 12:46 . 2008-09-15 02:50 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2008-09-14 12:45 . 2008-09-14 12:45 <DIR> dr-h----- C:\MSOCache

2008-09-14 12:45 . 2008-09-14 12:45 <DIR> d-------- C:\Documents and Settings\NetworkService\Menu Iniciar

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-15 18:28 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll

2008-09-14 04:18 --------- d-----w C:\Arquivos de programas\microsoft frontpage

2008-09-14 04:17 --------- d-----w C:\Arquivos de programas\Serviços on-line

2008-09-14 04:16 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Serviços

2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe

2008-07-23 16:50 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys

2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

2008-07-23 16:50 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

2008-07-23 16:50 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll

2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll

2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll

2008-07-19 01:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll

2008-07-19 01:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe

2008-07-19 01:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll

2008-07-19 01:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll

2008-07-19 01:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll

2008-07-19 01:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll

2008-07-19 01:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll

2008-07-19 01:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll

2008-07-19 01:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll

2008-07-17 04:02 634,368 ------w C:\WINDOWS\system32\gpprefcl.dll

2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-06-24 21:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll

2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll

2008-06-23 16:29 817,152 ----a-w C:\WINDOWS\system32\wininet.dll

2008-04-14 02:21 60,416 --sha-w C:\WINDOWS\BricoPacks\SysFiles\80_msimn.exe

.

------- Sigcheck -------

2008-06-23 12:11 668160 4e6461ec1c5296ee5f4a9f0581569563 C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll

2008-06-23 11:56 668672 e1640d81ca8d86691e3d3c5319628aae C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll

2008-06-23 12:40 827904 8cfd66cc90f966333cfa8d8161e185df C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 C:\WINDOWS\ie7\wininet.dll

2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll

2008-06-23 13:29 817152 3222b60bf562cda0fe49091331a1817a C:\WINDOWS\ServicePackFiles\i386\wininet.dll

2008-06-23 13:29 826368 fb820c977c8249358d54fa9324b5e92b C:\WINDOWS\SoftwareDistribution\Download\85f81787425a5bd063d064ce03eeb06f\SP2GDR\wininet.dll

2008-06-23 12:40 827904 8cfd66cc90f966333cfa8d8161e185df C:\WINDOWS\SoftwareDistribution\Download\85f81787425a5bd063d064ce03eeb06f\SP2QFE\wininet.dll

2008-04-13 23:20 668160 df6d0f37a71883be3505dd517eb8ad83 C:\WINDOWS\SoftwareDistribution\Download\ab328c51d3f122e9b4346fc25ad3082e\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 C:\WINDOWS\SoftwareDistribution\Download\db4af1ac6589f72c1b526a2c3dd4eb21\backup\wininet.dll

2008-06-23 12:40 661504 2532fe667e74219ce5b61ed67e23f435 C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp2gdr\wininet.dll

2008-06-23 13:15 669184 c4fc92ee25942192a8bf7fe8d17c284e C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp2qfe\wininet.dll

2008-06-23 12:11 668160 4e6461ec1c5296ee5f4a9f0581569563 C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp3gdr\wininet.dll

2008-06-23 11:56 668672 e1640d81ca8d86691e3d3c5319628aae C:\WINDOWS\SoftwareDistribution\Download\f6bbdd1b2646cfa9588690335bf72228\sp3qfe\wininet.dll

2008-06-23 13:29 817152 3222b60bf562cda0fe49091331a1817a C:\WINDOWS\system32\wininet.dll

2008-06-23 13:29 826368 fb820c977c8249358d54fa9324b5e92b C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-13 23:20 977920 732946eeaa1d8ee2a4fc24370827617b C:\WINDOWS\explorer.exe

2007-06-13 10:10 1035264 45d521506825a10b80833b4e9621ccf6 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe

2007-06-13 10:21 1035264 dccbf18e94d651393a3ffa060f88e0a0 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

2004-08-04 00:45 1034240 fa61a19050ae14bec1a26de82390dd65 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

2008-04-13 23:20 977920 732946eeaa1d8ee2a4fc24370827617b C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2008-04-13 23:20 1035776 064ec7ff5f58b928c3e119402977fa6d C:\WINDOWS\SoftwareDistribution\Download\ab328c51d3f122e9b4346fc25ad3082e\explorer.exe

2004-08-04 00:45 1034240 fa61a19050ae14bec1a26de82390dd65 C:\WINDOWS\SoftwareDistribution\Download\db4af1ac6589f72c1b526a2c3dd4eb21\backup\explorer.exe

2007-06-13 10:21 1035264 dccbf18e94d651393a3ffa060f88e0a0 C:\WINDOWS\SoftwareDistribution\Download\ded860808e92d18393ff7e54f31e0110\sp2gdr\explorer.exe

2007-06-13 10:10 1035264 45d521506825a10b80833b4e9621ccf6 C:\WINDOWS\SoftwareDistribution\Download\ded860808e92d18393ff7e54f31e0110\sp2qfe\explorer.exe

.

((((((((((((((((((((((((((((( snapshot@2008-09-21_19.55.48.14 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-09-21 19:47:43 68,738 ----a-w C:\WINDOWS\system32\perfc009.dat

+ 2008-09-22 22:00:17 68,738 ----a-w C:\WINDOWS\system32\perfc009.dat

- 2008-09-21 19:47:43 77,570 ----a-w C:\WINDOWS\system32\perfc016.dat

+ 2008-09-22 22:00:17 77,570 ----a-w C:\WINDOWS\system32\perfc016.dat

- 2008-09-21 19:47:43 436,094 ----a-w C:\WINDOWS\system32\perfh009.dat

+ 2008-09-22 22:00:17 436,094 ----a-w C:\WINDOWS\system32\perfh009.dat

- 2008-09-21 19:47:43 469,138 ----a-w C:\WINDOWS\system32\perfh016.dat

+ 2008-09-22 22:00:17 469,138 ----a-w C:\WINDOWS\system32\perfh016.dat

+ 2008-09-22 21:55:51 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_584.dat

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias & legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]

"LClock"="C:\Arquivos de programas\LClock\lclock.exe" [2004-09-19 65536]

"VisualTaskTips"="C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe" [2006-07-31 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LManager"="C:\ARQUIV~1\LAUNCH~1\LManager.exe" [2006-07-20 593920]

"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 77824]

"AzMixerSel"="C:\Arquivos de programas\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]

"GrooveMonitor"="C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"HD Tune"="C:\ARQUIV~1\HDTUNE~1\HDTune.exe" [2007-09-03 401408]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

"Media Codec Update Service"="C:\Arquivos de programas\Essentials Codec Pack\update.exe" [2007-04-08 303104]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2008-09-15 185896]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

C:\Documents and Settings\Samuk\Menu Iniciar\Programas\Inicializar\

Microsoft Office Outlook (2).lnk - C:\Arquivos de programas\Microsoft Office\Office12\OUTLOOK.EXE [2008-05-21 12844576]

RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]

Thoosje Viste Sidebar (2).lnk - C:\Arquivos de programas\Thoosje Vista Sidebar\Thoosje Sidebar.exe [2008-08-18 605696]

TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]

UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]

Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.ffds"= ffdshow.ax

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^InterVideo WinCinema Manager.lnk]

backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^WinZip Quick Pick.lnk]

backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kamsoft

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-06-12 02:38 34672 C:\Arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

--a------ 2008-02-20 11:33 963072 C:\Arquivos de programas\Ares\Ares.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

--a------ 2007-05-16 09:27 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]

-ra------ 2006-03-23 01:17 118784 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]

-ra------ 2006-03-23 01:17 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2007-03-01 15:57 153136 C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

--a------ 2008-09-15 23:22 185896 C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

-r------- 2006-05-16 07:04 2879488 C:\WINDOWS\SkyTel.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Arquivos de programas\\Ares\\Ares.exe"=

"C:\\Arquivos de programas\\iMesh Applications\\iMesh\\iMesh.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Neoact\\Carom3D\\carom.exe"=

"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-22 19:14:36

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2008-09-22 19:15:29

ComboFix-quarantined-files.txt 2008-09-22 22:15:23

ComboFix2.txt 2008-09-21 22:56:06

Pre-Run: 8 pasta(s) 16.856.006.656 bytes disponíveis

Post-Run: 11 pasta(s) 16,841,682,944 bytes disponíveis

293 --- E O F --- 2008-09-15 13:58:20

Caro colega, só uma pergunta, o meu pc ainda tem algum vírus??????

Desde ja agradeço sua ajuda

Aguardo sua resposta.

um abraço

Compartilhar este post


Link para o post
Compartilhar em outros sites

O seu log está limpo

  • Clique em Iniciar depois em Executar
  • Digite agora Combofix /u e clique OK, tal como exemplificado na imagem abaixo.

CF_Cleanup.png

Faça o download de OTMoveIt2 by OldTimer

  • Salve no seu desktop (área/ambiente de trabalho).
  • Duplo-clique em OTMoveIt.exe
  • Clique no botão 8gehxg0.gif
  • o OTMoveIt irá agora fazer o download duma lista, caso a sua firewall ou outro programa defensivo o alerte disso, permita o acesso.
  • Receberá a pergunta para o processo de limpeza ser iniciado, clique Yes
  • Quando terminar, saia do OTMoveIt
  • Agora elimine o OTMoveIt.exe
  • Elmine também a pasta C:\_OTMoveIt

Agora que seu pc está limpo, siga estes passos para manter seu computador limpo e protegido:

  • Elimine a Pasta (caso exista): Backups do HijackThis
  • Utilize um navegador alternativo e mais seguro:
    firefox-spread-btn-1b.png ou Opera_logo1.gif
  • Utilize uma Firewall - É extremamente importante na proteção ao seu computador.
    Boas opções grátis são:
    Comodo Firewall Pro
    Online Armor Free edition
  • Instale o SpywareBlaster - SpywareBlaster adiciona uma lista de programas e sites maliciosos ao Internet Explorer e FireFox que o irão proteger desses sites e programas.
  • Visite o Secunia Software Inspector e veja o estado dos seus programas no que diz respeito às actualizações.
  • Mantenha seus programas devidamente actualizados.
    Estar actualizado é estar seguro. Clique aqui

Algumas utilidades extras que podem aumentar a proteção ao seu computador:

  • IE/Spyad <=
    IE/Spyad adiciona para cima de 4000 websites e dominios à lista de restrições do IE.
  • MVPS Hosts <= O MVPS Hosts cria um novo arquivo HOSTS contendo sites conhecidos, IP's, etc. Basicamente, irá prevenir que o seu pc se conecte a esses sites maliciosos
  • Google Toolbar <= A toolbar do Google previne os pop up's.

Foi um prazer ajudar thumbsup.gif

Compartilhar este post


Link para o post
Compartilhar em outros sites
O seu log está limpo
  • Clique em Iniciar depois em Executar
  • Digite agora Combofix /u e clique OK, tal como exemplificado na imagem abaixo.

CF_Cleanup.png

Faça o download de OTMoveIt2 by OldTimer

  • Salve no seu desktop (área/ambiente de trabalho).
  • Duplo-clique em OTMoveIt.exe
  • Clique no botão 8gehxg0.gif
  • o OTMoveIt irá agora fazer o download duma lista, caso a sua firewall ou outro programa defensivo o alerte disso, permita o acesso.
  • Receberá a pergunta para o processo de limpeza ser iniciado, clique Yes
  • Quando terminar, saia do OTMoveIt
  • Agora elimine o OTMoveIt.exe
  • Elmine também a pasta C:\_OTMoveIt

Agora que seu pc está limpo, siga estes passos para manter seu computador limpo e protegido:

  • Elimine a Pasta (caso exista): Backups do HijackThis
  • Utilize um navegador alternativo e mais seguro:
    firefox-spread-btn-1b.png ou Opera_logo1.gif
  • Utilize uma Firewall - É extremamente importante na proteção ao seu computador.
    Boas opções grátis são:
    Comodo Firewall Pro
    Online Armor Free edition
  • Instale o SpywareBlaster - SpywareBlaster adiciona uma lista de programas e sites maliciosos ao Internet Explorer e FireFox que o irão proteger desses sites e programas.
  • Visite o Secunia Software Inspector e veja o estado dos seus programas no que diz respeito às actualizações.
  • Mantenha seus programas devidamente actualizados.
    Estar actualizado é estar seguro. Clique aqui

Algumas utilidades extras que podem aumentar a proteção ao seu computador:

  • IE/Spyad <=
    IE/Spyad adiciona para cima de 4000 websites e dominios à lista de restrições do IE.
  • MVPS Hosts <= O MVPS Hosts cria um novo arquivo HOSTS contendo sites conhecidos, IP's, etc. Basicamente, irá prevenir que o seu pc se conecte a esses sites maliciosos
  • Google Toolbar <= A toolbar do Google previne os pop up's.

Foi um prazer ajudar thumbsup.gif

Boa noite colega,

Só passando pra agradece sua ajuda, muito obrigado, um abraço

Compartilhar este post


Link para o post
Compartilhar em outros sites
Visitante
Este tópico está impedido de receber novos posts.
Entre para seguir isso  





Sobre o Clube do Hardware

No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

Direitos autorais

Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

×