Home
>
Fórum
>
Windows, Softwa...
>
Análise de log,...
>
Mensagem de erro ao inici...

Mensagem de erro ao iniciar o windows

#1 Por kuki-chan 24/11/2012 - 21:10

Gente, preciso de uma ajuda. Sempre que ligo o pc, quando entra na minha tela normal, vem duas mensagens de erro diferentes sobre 5 "locais". Seguinte:

"O Windows não consegue encontrar 'C:\Documents'. Certifique-se de que o nome foi digitado corretamente e tente de novo. Para procurar um arquivo, clique no botão 'Iniciar' e em 'Pesquisar'"
E
"Não foi possível carregar ou executar 'C:\Documents' especificado no Registro. Certifique-se de que o arquivo existe no computador ou remova a referência a ele no Registro"
Essas duas mensagens com esses 5 nomes: "C:\Documents", "and", "Settings\user\configurações", "locais\Dados", "de" e "aplicativos\ghhllsys.exe"

Como posso corrigir esse problema? =/ Alguém me ajuda?

windows pc mensagem erro ligo entra iniciar documents certifiquese

Responder

kuki-chan Novo Membro Registrado

13 Mensagens 0 Curtidas

#16 Por kuki-chan

25/11/2012 - 00:51

OTL logfile created on: 25/11/2012 00:33:48 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\user\Meus documentos\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy

1,99 Gb Total Physical Memory | 1,03 Gb Available Physical Memory | 51,50% Memory free
2,21 Gb Paging File | 1,41 Gb Available in Paging File | 64,02% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas
Drive C: | 74,52 Gb Total Space | 15,37 Gb Free Space | 20,62% Space Free | Partition Type: NTFS

Computer Name: RENATA | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/11/24 21:39:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\user\Meus documentos\Downloads\OTL.exe
PRC - [2012/10/31 20:15:08 | 001,242,136 | ---- | M] (Google Inc.) -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe
PRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2011/04/08 13:59:52 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
PRC - [2010/09/07 13:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Arquivos de programas\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 13:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/07/13 19:26:12 | 004,302,704 | ---- | M] (Wacom Technology, Corp.) -- C:\Arquivos de programas\Tablet\Pen\Pen_TouchUser.exe
PRC - [2010/07/13 19:26:10 | 006,076,272 | ---- | M] (Wacom Technology, Corp.) -- C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe
PRC - [2010/07/13 19:26:10 | 002,533,232 | ---- | M] (Wacom Technology, Corp.) -- C:\Arquivos de programas\Tablet\Pen\Pen_TabletUser.exe
PRC - [2010/07/13 19:26:10 | 000,616,816 | ---- | M] (Wacom Technology, Corp.) -- C:\Arquivos de programas\Tablet\Pen\Pen_TouchService.exe
PRC - [2008/04/14 00:20:58 | 001,035,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/19 18:08:58 | 000,607,576 | ---- | M] (Lavasoft) -- C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe
PRC - [2007/05/15 15:55:46 | 001,550,896 | ---- | M] (Nero AG) -- C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
PRC - [2004/06/09 16:37:02 | 000,040,960 | ---- | M] (BIGDOG) -- C:\WINDOWS\Vm_sti.exe

========== Modules (No Company Name) ==========

MOD - [2012/11/24 17:57:51 | 002,033,152 | ---- | M] () -- C:\Arquivos de programas\Alwil Software\Avast5\defs\12112401\algo.dll
MOD - [2012/10/31 20:15:05 | 000,460,312 | ---- | M] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\ppgooglenaclpluginchrome.dll
MOD - [2012/10/31 20:15:04 | 012,455,448 | ---- | M] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\PepperFlash\pepflashplayer.dll
MOD - [2012/10/31 20:15:02 | 004,007,448 | ---- | M] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\pdf.dll
MOD - [2012/10/31 20:13:35 | 000,156,712 | ---- | M] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\avutil-51.dll
MOD - [2012/10/31 20:13:34 | 000,274,984 | ---- | M] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\avformat-54.dll
MOD - [2012/10/31 20:13:32 | 002,168,360 | ---- | M] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\avcodec-54.dll
MOD - [2008/04/14 00:20:33 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2007/11/22 04:24:25 | 000,370,688 | ---- | M] () -- C:\Arquivos de programas\Messenger Plus! Live\libsndfile.dll
MOD - [2007/11/22 01:50:07 | 000,390,656 | ---- | M] () -- C:\Arquivos de programas\Messenger Plus! Live\lame_enc.dll
MOD - [2007/02/14 03:31:52 | 000,196,608 | ---- | M] () -- C:\WINDOWS\system32\nvapi.dll
MOD - [2006/08/24 14:17:52 | 000,004,096 | ---- | M] () -- C:\Arquivos de programas\Messenger Plus! Live\Detoured.dll
MOD - [2001/10/28 18:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/07/13 14:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Arquivos de programas\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/16 18:21:25 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012/01/04 14:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011/07/20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010/09/07 13:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Stopped] -- C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 13:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Stopped] -- C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 13:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/07/13 19:26:10 | 006,076,272 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2010/07/13 19:26:10 | 000,616,816 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Arquivos de programas\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2010/01/09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2008/03/19 18:08:58 | 000,607,576 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe -- (aawservice)
SRV - [2007/05/31 11:38:48 | 000,053,248 | ---- | M] (Tablet Driver) [Auto | Stopped] -- C:\WINDOWS\system32\drivers\WTSrv.exe -- (WinTabService)
SRV - [2007/05/15 15:55:46 | 001,550,896 | ---- | M] (Nero AG) [Auto | Running] -- C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2007/05/08 19:47:22 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbmodem.sys -- (USBModem)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbdiag.sys -- (UsbDiag)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\lgusbbus.sys -- (usbbus)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\user\Meus documentos\Gravity\RO\npkcrypt.sys -- (npkcrypt)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\user\CONFIG~1\Temp\catchme.sys -- (catchme)
DRV - [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/09/07 12:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 12:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 12:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 12:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/07 12:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/07 12:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/03/03 14:12:09 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2009/09/21 21:29:22 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/05/25 03:45:28 | 000,031,104 | R--- | M] (usb camera) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbcamcl.sys -- (usbcamcl)
DRV - [2009/05/08 11:56:12 | 000,042,752 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motodrv.sys -- (MotDev)
DRV - [2009/01/29 17:15:54 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2008/12/10 16:56:26 | 000,017,792 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/02/26 15:07:54 | 000,073,728 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Arquivos de programas\UltraISO\drivers\ISODrive.sys -- (ISODrive)
DRV - [2007/06/07 15:16:28 | 000,018,944 | ---- | M] (PenTablet Driver) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PTSimBus.sys -- (PTSimBus)
DRV - [2007/05/31 15:33:44 | 000,012,800 | ---- | M] (Tablet Driver) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\UCTblHid.sys -- (UCTblHid)
DRV - [2007/05/15 15:55:36 | 000,118,576 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2007/05/15 15:55:36 | 000,038,576 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007/05/15 15:55:36 | 000,037,040 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2007/05/15 15:55:36 | 000,016,304 | ---- | M] (Nero AG) [Recognizer | System | Unknown] -- C:\WINDOWS\System32\drivers\InCDrec.sys -- (InCDrec)
DRV - [2007/04/23 13:28:56 | 000,018,432 | ---- | M] (Tablet Driver) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TClass2k.sys -- (TClass2k)
DRV - [2007/04/23 13:28:56 | 000,017,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tablet2k.sys -- (Tablet2k)
DRV - [2007/04/23 13:28:56 | 000,010,752 | ---- | M] (PenTablet Driver) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PTSimHid.sys -- (PTSimHid)
DRV - [2007/04/12 10:14:40 | 000,007,598 | ---- | M] (PROTEQ) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\Proteq.sys -- (Proteq)
DRV - [2007/02/16 17:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2006/11/02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)
DRV - [2006/08/01 09:07:02 | 004,356,608 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006/07/12 08:56:00 | 000,248,192 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2004/08/17 12:44:22 | 000,091,263 | ---- | M] (VM) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbVM31b.sys -- (ZSMC302)
DRV - [2004/08/13 00:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q={searchTerms}&crm=1

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=109867&tt=090212_noffx&babsrc=HP_ss&mntrId=147ac34b0000000000000018f30d3e94
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\URLSearchHook: {b5d39f9d-9d08-4466-8f80-9873ed5124dd} - C:\Arquivos de programas\Softonic.com.br_FF\prxtbSof2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\${searchCLSID}: "URL" = http://search.yahoo.com/search?ei=ISO-8859-1&fr=megaupi7s&q={searchTerms}
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=109867&tt=090212_noffx&babsrc=SP_ss&mntrId=147ac34b0000000000000018f30d3e94
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7RNWN_pt-BR
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2277128
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}: "URL" = http://toolbar.ask.com/toolbarv/askRedirect?o=10168&gct=&gc=1&q={searchTerms}&crm=1
IE - HKU\S-1-5-21-1482476501-839522115-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.orkut.com.br/Main#Home.aspx"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Arquivos de programas\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Arquivos de programas\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Arquivos de programas\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@photodex.com/PhotodexPresenter: C:\Arquivos de programas\Photodex Presenter\npPxPlay.dll ( )
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Arquivos de programas\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Arquivos de programas\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Arquivos de programas\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Arquivos de programas\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.4: C:\Arquivos de programas\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

[2008/10/21 13:45:47 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\user\Dados de aplicativos\Mozilla\Extensions
[2012/02/19 01:57:25 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\user\Dados de aplicativos\Mozilla\Firefox\Profiles\4ca09us2.default\extensions
[2010/07/18 04:31:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\user\Dados de aplicativos\Mozilla\Firefox\Profiles\4ca09us2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2012/02/19 01:57:26 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\user\Dados de aplicativos\Mozilla\Firefox\Profiles\4ca09us2.default\extensions\ffxtlbr@babylon.com

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage:
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Arquivos de programas\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Arquivos de programas\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Arquivos de programas\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Arquivos de programas\Windows Media Player\npdsplay.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Google\Chrome\Application\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Google\Chrome\Application\plugins\nprpjplug.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\ARQUIV~1\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\ARQUIV~1\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Google Earth Plugin (Enabled) = C:\Arquivos de programas\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Arquivos de programas\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Photodex Presenter Plugin (Enabled) = C:\Arquivos de programas\Photodex Presenter\npPxPlay.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Arquivos de programas\TabletPlugins\npwacom.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\user\Configura\u00E7\u00F5es locais\Dados de aplicativos\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Arquivos de programas\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Angry Birds = C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: Mahjong Words 2 = C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\akoaibgodkfmengiiainfdbjmmamfall\1.0.0.1_0\
CHR - Extension: Plants vs Zombies - HD Official Game = C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\dnkohoajhlbfnappfbdlfnoicgdpbefi\1.0_1\
CHR - Extension: AT_Tibi = C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\kkejacdnegffabffbjebeloagdhmjoln\2_0\

O1 HOSTS File: ([2012/11/24 23:42:34 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll (Google Inc.)
O2 - BHO: (ST br FF Toolbar) - {b5d39f9d-9d08-4466-8f80-9873ed5124dd} - C:\Arquivos de programas\Softonic.com.br_FF\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ST br FF Toolbar) - {b5d39f9d-9d08-4466-8f80-9873ed5124dd} - C:\Arquivos de programas\Softonic.com.br_FF\prxtbSof2.dll (Conduit Ltd.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {F14B0CCD-AA41-4406-AB68-C5DE9D85B4A3} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {F14B0CCD-AA41-4406-AB68-C5DE9D85B4A3} - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\Toolbar\ShellBrowser: (no name) - {ECDEE021-0D17-467F-A1FF-C7A115230949} - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
O3 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\..\Toolbar\WebBrowser: (ST br FF Toolbar) - {B5D39F9D-9D08-4466-8F80-9873ED5124DD} - C:\Arquivos de programas\Softonic.com.br_FF\prxtbSof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast5] C:\Arquivos de programas\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE (BIGDOG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-1482476501-839522115-725345543-1003..\Run: [Facebook Update] C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-1482476501-839522115-725345543-1003..\Run: [Gadwin PrintScreen] C:\Arquivos de programas\Gadwin Systems\PrintScreen\PrintScreen.exe (Gadwin Systems, Inc)
O4 - Startup: C:\Documents and Settings\user\Menu Iniciar\Programas\Inicializar\SolidWorks Task Scheduler Engine.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1482476501-839522115-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Enviar para o OneNote - res://C:\ARQUIV~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Arquivos de programas\MP3 Player Utilities 4.00\AMVConverter\grab.html File not found
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 4.00\MediaManager\grab.html File not found
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} http://img2.orkut.com/activex/10035/photouploader.cab (UploadListView Class)
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/mjss/MJSS.cab109791.cab ()
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} http://messenger.zone.msn.com/binary/Chess.cab57176.cab (ZoneChess Object)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab (SysInfo Class)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab (GoPetsWeb Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7F13CE6B-0688-4088-AA79-099483BE7387}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - c:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Arquivos de programas\Arquivos comuns\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Minha página inicial atual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/25 00:32:20 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/11/24 23:32:20 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/11/24 23:30:21 | 000,000,000 | R--D | C] -- C:\Documents and Settings\user\Menu Iniciar\Programas\Ferramentas administrativas
[2012/11/24 23:30:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012/11/24 21:19:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Dados de aplicativos\Malwarebytes
[2012/11/24 21:19:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes
[2012/11/24 21:19:05 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/11/24 21:19:05 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Malwarebytes' Anti-Malware
[2012/11/18 14:33:49 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Microsoft Visual Studio 8
[2012/11/15 01:36:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Meus documentos\kaique
[2012/11/14 17:33:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\AutoKMS
[2010/01/25 21:22:10 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\user\Dados de aplicativos\pcouffin.sys
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/11/25 00:03:35 | 000,081,191 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012/11/25 00:03:29 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2012/11/25 00:03:20 | 000,002,262 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/11/25 00:02:55 | 000,001,064 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/25 00:02:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/11/24 23:42:34 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/11/24 23:32:27 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/11/24 23:18:00 | 000,001,068 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/24 21:19:07 | 000,000,840 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/11/24 16:30:19 | 001,509,966 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\print.bmp
[2012/11/22 00:39:18 | 016,933,297 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\flag.psd
[2012/11/22 00:37:22 | 000,726,260 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\flag 2cópia.png
[2012/11/22 00:36:43 | 000,884,166 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\flag cópia.png
[2012/11/22 00:00:43 | 000,393,294 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\111.bmp
[2012/11/18 22:20:13 | 000,393,568 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/11/16 00:43:35 | 000,528,636 | ---- | M] () -- C:\WINDOWS\System32\perfh016.dat
[2012/11/16 00:43:35 | 000,494,148 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/11/16 00:43:35 | 000,094,998 | ---- | M] () -- C:\WINDOWS\System32\perfc016.dat
[2012/11/16 00:43:35 | 000,084,692 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/11/16 00:20:10 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/11/14 14:50:39 | 000,027,574 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\hotmail.png
[2012/11/14 14:27:12 | 000,414,625 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\instagram.png
[2012/11/11 22:04:29 | 000,211,126 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia4.png
[2012/11/11 22:03:53 | 000,210,800 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia3.png
[2012/11/11 22:02:55 | 000,210,106 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia2.png
[2012/11/11 22:01:49 | 000,209,555 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia.png
[2012/11/11 22:01:39 | 001,430,315 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\cluster.psd
[2012/11/09 20:45:14 | 000,018,471 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\SO.odt
[2012/11/08 16:54:47 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012/11/07 13:16:02 | 001,369,805 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\ruiva linguinha.png
[2012/11/07 12:23:07 | 000,002,315 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012/10/27 22:00:54 | 007,524,292 | ---- | M] () -- C:\Documents and Settings\user\Meus documentos\Débora-RenataCalhado-Tairine-CarroEsportivo.odp
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/11/24 23:32:27 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012/11/24 23:32:23 | 000,261,856 | RHS- | C] () -- C:\cmldr
[2012/11/24 21:19:07 | 000,000,840 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/11/24 16:30:18 | 001,509,966 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\print.bmp
[2012/11/22 00:37:18 | 000,726,260 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\flag 2cópia.png
[2012/11/22 00:36:30 | 000,884,166 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\flag cópia.png
[2012/11/22 00:36:03 | 016,933,297 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\flag.psd
[2012/11/22 00:00:43 | 000,393,294 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\111.bmp
[2012/11/14 14:50:38 | 000,027,574 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\hotmail.png
[2012/11/14 14:27:09 | 000,414,625 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\instagram.png
[2012/11/11 22:04:27 | 000,211,126 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia4.png
[2012/11/11 22:03:51 | 000,210,800 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia3.png
[2012/11/11 22:02:49 | 000,210,106 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia2.png
[2012/11/11 21:56:38 | 000,209,555 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\cluster cópia.png
[2012/11/11 21:56:27 | 001,430,315 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\cluster.psd
[2012/11/07 13:11:39 | 001,369,805 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\ruiva linguinha.png
[2012/11/07 12:01:55 | 000,018,471 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\SO.odt
[2012/10/27 20:00:16 | 007,524,292 | ---- | C] () -- C:\Documents and Settings\user\Meus documentos\Débora-RenataCalhado-Tairine-CarroEsportivo.odp
[2012/10/21 09:49:15 | 000,000,400 | ---- | C] () -- C:\WINDOWS\g_mgpmro337.ini
[2012/10/21 09:49:15 | 000,000,400 | ---- | C] () -- C:\WINDOWS\System32\drivers\bgsqtfk792.dat
[2012/05/23 19:49:32 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2012/05/23 19:49:32 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2012/05/23 19:49:32 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2012/05/23 19:49:32 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2012/02/16 18:22:06 | 000,000,155 | ---- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft.SqlServer.Compact.351.32.bc
[2012/02/15 10:09:43 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/11/11 03:23:30 | 004,565,045 | ---- | C] () -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\WPFFontCache_v0400-S-1-5-21-1482476501-839522115-725345543-1003-0.dat
[2011/11/11 03:23:30 | 000,335,174 | ---- | C] () -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\WPFFontCache_v0400-System.dat
[2011/06/16 00:22:01 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011/06/02 07:42:57 | 000,017,424 | RHS- | C] () -- C:\Documents and Settings\user\hfveog.exe
[2011/05/31 21:36:46 | 000,017,424 | RHS- | C] () -- C:\Documents and Settings\user\luemuu.exe
[2010/12/24 17:54:16 | 000,013,825 | ---- | C] () -- C:\WINDOWS\W3DemoUnin.dat
[2010/08/26 01:03:27 | 000,044,965 | -HS- | C] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\systemBuster.exe
[2010/07/05 21:48:30 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\winload.inf
[2010/07/05 21:46:18 | 000,000,121 | -HS- | C] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\loaderIni.ini
[2010/01/25 21:22:33 | 000,001,057 | ---- | C] () -- C:\Documents and Settings\user\Dados de aplicativos\vso_ts_preview.xml
[2010/01/25 21:22:10 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\user\Dados de aplicativos\inst.exe
[2010/01/25 21:22:10 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\user\Dados de aplicativos\pcouffin.cat
[2010/01/25 21:22:10 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\user\Dados de aplicativos\pcouffin.inf
[2010/01/08 10:02:17 | 000,000,078 | ---- | C] () -- C:\Documents and Settings\user\bro2.avt
[2009/10/01 19:27:29 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\user\novo_filme.avi
[2009/09/19 00:11:22 | 000,000,085 | -HS- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\.zreglib
[2009/08/15 17:11:39 | 000,002,854 | ---- | C] () -- C:\Documents and Settings\user\.powerupdate.user.properties
[2008/04/01 19:41:57 | 000,000,882 | ---- | C] () -- C:\Documents and Settings\user\.recently-used.xbel
[2007/12/11 23:25:59 | 000,219,648 | ---- | C] () -- C:\Documents and Settings\user\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2008/07/04 20:23:27 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 00:20:40 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:53:26 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 00:20:41 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2010/09/19 01:36:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Alwil Software
[2012/02/23 17:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Autodesk
[2012/02/19 01:57:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Babylon
[2009/09/19 00:13:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Canneverbe Limited
[2010/01/05 16:44:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\CELSYS
[2010/03/03 14:11:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\DAEMON Tools Lite
[2011/01/25 14:38:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\DassaultSystemes
[2012/02/24 01:59:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\EA Core
[2012/02/24 01:59:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Electronic Arts
[2008/03/22 12:40:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\ESET
[2012/05/20 20:01:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Installations
[2012/10/21 09:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\McNeel
[2010/02/17 13:03:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus!
[2008/07/21 13:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\part dead amok eggs
[2012/05/20 20:03:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\PC Suite
[2009/06/27 00:10:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\pdf995
[2012/01/16 15:41:46 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Permission
[2010/07/07 20:09:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Photodex
[2012/01/17 22:26:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Procad
[2012/11/24 13:25:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Samsung
[2011/01/17 19:46:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\TechSmith
[2010/01/26 00:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\vsosdk
[2012/04/02 02:09:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\{00BAB1C5-D99B-4EF4-B1D6-1DEB5DA070DA}
[2011/12/29 14:01:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2012/01/01 23:26:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\.minecraft
[2009/05/06 23:32:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Aegisub
[2012/08/13 00:11:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Audacity
[2012/02/23 17:18:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Autodesk
[2012/02/19 01:57:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Babylon
[2012/11/15 01:53:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\BitTorrent
[2012/06/12 02:15:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\BSplayer Pro
[2009/09/19 00:13:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Canneverbe_Limited
[2009/08/15 18:21:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\CmapTools
[2008/09/10 00:14:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\DAEMON Tools
[2010/03/03 14:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\DAEMON Tools Lite
[2011/01/25 14:38:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\DassaultSystemes
[2009/10/29 13:49:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\e frontier
[2011/01/12 15:35:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\GetRightToGo
[2008/08/14 18:06:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\GlarySoft
[2012/07/02 23:02:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\IM
[2011/04/04 17:54:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\LibreOffice
[2008/07/30 23:43:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Lite Thunk Test
[2008/01/23 01:08:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Netscape
[2012/05/20 20:07:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Nokia
[2009/10/18 17:10:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\ooVoo Details
[2008/03/09 23:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Opera
[2012/05/20 20:03:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\PC Suite
[2009/06/26 23:44:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\pdf995
[2008/01/23 01:08:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Photodex
[2010/02/18 15:02:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Publish Providers
[2012/11/24 13:26:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Samsung
[2009/12/23 20:56:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\SecondLife
[2009/12/02 18:25:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Smith Micro
[2010/02/18 15:00:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Sony
[2011/08/20 13:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Thinstall
[2009/12/02 19:08:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\tvpaint animation
[2009/04/14 14:22:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\uTorrent
[2011/06/19 13:05:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dados de aplicativos\Vso

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\user\Meus documentos\GuSTop.zip:SummaryInformation

< End of report >

Wings Cyber Highlander Registrado

20.3K Mensagens 1.2K Curtidas

#17 Por Wings

25/11/2012 - 01:19

Execute o OTL. Usuários do Windows Vista ou do Windows 7 devem clicar com o botão direito do mouse no arquivo e selecionar Executar como administrador

*Cole as linhas em azul no espaço abaixo de Exames Personalizados/Correções

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\user\Meus documentos\Gravity\RO\npkcrypt.sys -- (npkcrypt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)
DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\user\CONFIG~1\Temp\catchme.sys -- (catchme)
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

:Files
netsh firewall reset /c

:Commands
[emptytemp]

*Clique [Consertar]

*Clique [OK] para reiniciar o PC

*Cole o relatório apresentado

Baixe o Junkware Removal Tool (...de Thisisu) e salve-o no Desktop (Área de Trabalho)

*Feche o seu navegador

*Execute o JRT. Usuários do Windows Vista ou do Windows 7 devem clicar com o botão direito do mouse no arquivo e selecionar Executar como administrador

*Tecle [ENTER]

*Será feito um backup do registro e, em seguida, o programa será executado automaticamente

*Aguarde...pode demorar.

*Cole o relatório apresentado

Cartilha de Segurança

Moderador - Fórum PC Brasil

kuki-chan Novo Membro Registrado

13 Mensagens 0 Curtidas

#18 Por kuki-chan

25/11/2012 - 10:37

Não consigo fazer esse ultimo passo do otl, deixei a noite toda ele aberto e parece que ele trava, não sei. Tentei 3 vezes.

Wings Cyber Highlander Registrado

20.3K Mensagens 1.2K Curtidas

#19 Por Wings

25/11/2012 - 10:39

kuki-chan disse:
Não consigo fazer esse ultimo passo do otl, deixei a noite toda ele aberto e parece que ele trava, não sei. Tentei 3 vezes.

OK...

Faça o segundo procedimento.

Cartilha de Segurança

Moderador - Fórum PC Brasil

kuki-chan Novo Membro Registrado

13 Mensagens 0 Curtidas

#20 Por kuki-chan

25/11/2012 - 10:52

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 3.5.0 (11.25.2012)
OS: Microsoft Windows XP x86
Ran by user on dom 25/11/2012 at 10:41:32,71
Blog: http://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-1482476501-839522115-725345543-1003\software\microsoft\internet explorer\main\\Start Page

~~~ Registry Keys

Successfully deleted: [Registry Key] "hkey_current_user\software\conduit"
Successfully deleted: [Registry Key] "hkey_current_user\software\softonic"
Successfully deleted: [Registry Key] "hkey_local_machine\software\babylon"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\appid\escort.dll"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\conduit.engine"
Successfully deleted: [Registry Key] "hkey_local_machine\software\conduit"
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{2eecd738-5844-4a99-b4b6-146bf802613b}
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{e46c8196-b634-44a1-af6e-957c64278ab1}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\user\Dados de aplicativos\babylon"
Successfully deleted: [Folder] "C:\Arquivos de programas\Arquivos comuns\dvdvideosoft"
Successfully deleted: [Folder] "C:\Arquivos de programas\oapps"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on dom 25/11/2012 at 10:52:16,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Wings Cyber Highlander Registrado

20.3K Mensagens 1.2K Curtidas

#21 Por Wings

25/11/2012 - 10:54

Delete o JRT, seu relatório e a pasta C:\JRT

Desinstale Java(TM) 6 Update 26

Instale a última versão do Java

Desinstale o Avast e instale a última versão. Caso deseje trocar de antivírus, sugiro o Panda Cloud

Execute o OTL.

*Clique [Limpeza] > [OK]

*O PC será reiniciado

O PC está limpo.

Um abraço.

Cartilha de Segurança

Moderador - Fórum PC Brasil

kuki-chan Novo Membro Registrado

13 Mensagens 0 Curtidas

#22 Por kuki-chan

25/11/2012 - 11:31

Muito obrigada!! Ajudou muito! Até a memória do meu computador aumentou! rsrsAgradecida! =)

Responder Tópico

Ferramentas

Mover Tópico