[Resolvido!]mensagem sockt error 1004

lidi · Dezembro 19, 2006

Oi andei olhando alguns topicos e vi que tem que baixar o hijack...baixei ai vai meu log...

Logfile of Browser Hijack Recover(BHR) v2.3

http://www.browser-hijack.com/

Log created on 18/12/2006 21:38:46

Microsoft Windows XP Professional Service Pack 2 (Build 2600)

Internet Explorer v6.0.2900.2180 Update Versions: ;SP2;

[Process Manager] - [Process]

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\Java\jre1.5.0_07\bin\jusched.exe

C:\WINDOWS\system32\keyhook.exe

C:\WINDOWS\htpatch.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Ahead\InCD\InCD.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\Arquivos de programas\Creative\Shared Files\CAMTRAY.EXE

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\Ares\Ares.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Windows32.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\WindowsXp2.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\WindowsSp2.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Alwil Software\Avast4\setup\setup.ovr

C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Browser Hijack Recover\bhr.exe

[iE Options] - [Normal]

R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/windows/ie_intl/en/start/

R0 - HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main,Window Title =

[iE Options] - [iE Menu]

[iE Options] - [internet Options]

[iE Options] - [iE Search Hooks]

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll

[iE Add-Ons] - [Toolbars]

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar1.02.5000.1021\pt-br\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar3.dll

[iE Add-Ons] - [Explorer Bars]

O9 - Extra "View" Explorer Bars: (No Name) - {32683183-48a0-441b-a342-7c2a440a9478} - (No File)

O9 - Extra "View" Explorer Bars: Pesquisa de arquivo na faixa do Explorer - {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} - C:\WINDOWS\system32\SHELL32.dll

[iE Add-Ons] - [Context Menu]

O8 - Extra context menu item: Compare Prices with &Dealio - C:\Arquivos de programas\Dealio\kb100\res\DealioSearch.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

[iE Add-Ons] - [bHOs]

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar3.dll

[iE Add-Ons] - [Tools Menu]

O9 - Extra "Tool" Menu Item: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_07\bin\ssv.dll

[iE Add-Ons] - [Tools Button]

O9 - Extra "Tool" Menu Item: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra Button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra Button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Arquivos de programas\Dealio\kb101\Dealio.dll

[system Options]

[startUp]

04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Skype = C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run msnmsgr = C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run AnyDVD = C:\Arquivos de programas\SlySoft\AnyDVD\AnyDVD.exe

04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NBJ = C:\ARQUIV~1\Ahead\NEROBA~1\NBJ.exe

04 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ares = C:\Arquivos de programas\Ares\Ares.exe" -h

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run SunJavaUpdateSched = C:\Arquivos de programas\Java\jre1.5.0_07\bin\jusched.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run SiS Windows KeyHook = C:\WINDOWS\system32\keyhook.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HTpatch = C:\WINDOWS\htpatch.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ASUS Probe = C:\Program Files\ASUS\Probe\AsusProb.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HP Software Update = C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HP Component Manager = C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run RemoteControl = C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run InCD = C:\Arquivos de programas\Ahead\InCD\InCD.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Ink Monitor = C:\Arquivos de programas\EPSON\Ink Monitor\InkMonitor.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run avast! = C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run WinampAgent = C:\Arquivos de programas\Winamp\winampa.exe

04 - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Creative WebCam Tray = C:\Arquivos de programas\Creative\Shared Files\CAMTRAY.EXE

O4 - C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O4 - C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk = C:\ARQUIV~1\HP\DIGITA~1\bin\hpqtra08.exe

O4 - C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Inicialização rápida do HP Image Zone.lnk = C:\ARQUIV~1\HP\DIGITA~1\bin\hpqthb08.exe

O4 - C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Reader Speed Launch.lnk = C:\ARQUIV~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE

Me ajudem como posso resolver meu problema aparece a mensagem sockt error..e tambem meu pc não se desliga e minha barra de ferramentas não funciona...obrigada ficarei aguardando...

jgarcia · Dezembro 19, 2006

Opa lidi,

Faça o seguinte:

Baixe o HijackThis versão 1.99.1.

Depois > Iniciar > Meu Computador > 02 cliques no C > Coloca o HijackThis no C (extraindo do zip --> para uma pasta própria tipo c:/Hijack).

Execute o Hijack a partir do C, fechando os demais programas (deixando somente a área de trabalho).

Clique em Do a system scan and save a logfile, mas não marque nada, apenas poste o log gerado aqui neste mesmo tópico.

Abraços.

lidi · Dezembro 20, 2006

Logfile of HijackThis v1.99.1

Scan saved at 22:54:53, on 18/12/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\Java\jre1.5.0_07\bin\jusched.exe

C:\WINDOWS\system32\keyhook.exe

C:\WINDOWS\htpatch.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Ahead\InCD\InCD.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\Arquivos de programas\Creative\Shared Files\CAMTRAY.EXE

C:\Arquivos de programas\Ares\Ares.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Windows32.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\WindowsXp2.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\WindowsSp2.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST1.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar3.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar1.02.5000.1021\pt-br\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar3.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_07\bin\jusched.exe

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe

O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ink Monitor] C:\Arquivos de programas\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Arquivos de programas\Winamp\winampa.exe

O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Arquivos de programas\Creative\Shared Files\CAMTRAY.EXE

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [AnyDVD] "C:\Arquivos de programas\SlySoft\AnyDVD\AnyDVD.exe"

O4 - HKCU\..\Run: [NBJ] "C:\ARQUIV~1\Ahead\NEROBA~1\NBJ.exe"

O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Inicialização rápida do HP Image Zone.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Windows32.exe

O4 - Global Startup: WindowsXp2.exe

O4 - Global Startup: WindowsSp2.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Compare Prices with &Dealio - C:\Arquivos de programas\Dealio\kb100\res\DealioSearch.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Arquivos de programas\Dealio\kb101\Dealio.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O14 - IERESET.INF: START_PAGE_URL=http://www.compartilhando.org/

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C866814C-11A8-4C17-96BE-DF4A275DE31A}: NameServer = 201.10.1.2 201.10.120.3

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

ja fiz....não sei se resolveu....vou tentar reiniciar o pc...abraço/

Me comente sobre o novo log...valeu!!

lidi · Dezembro 20, 2006

reiniciei o computador mais a mensagem segue aparecendo...a minha barra de tarefas não funciona...e meu pc não desliga...oque você acha que eu devo fazer...aguardo resposta

jgarcia · Dezembro 20, 2006

Opa lidi,

1. Baixe o BankerFix.

2. Desative o seu antivírus temporariamente.

3. Dê um duplo-clique sobre o bankerfix.exe, aperte Enter e aguarde o término do scan.

4. Terminado o scan, leia a mensagem na tela e aperte Enter novamente.

5. Habilite o seu antivírus.

6. Retorne com um novo log do HijackThis, juntamente com o relatorio.txt do BankerFix (ele estará em C:\LinhaDefensiva\).

7. Depois de postar a sua resposta você poderá deletar a pasta LinhaDefensiva contida no C.

Abraços.

lidi · Dezembro 20, 2006

INICIANDO BANKER FIX

=======================================================

INICIANDO FOX FIX

=======================================================

Iniciando Log do PV

-----------------------------------

Killing '*'

Arquivos a remover

-----------------------------------

Arquivos ruins restantes

-----------------------------------

Reg Importado

-----------------------------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Logfile of HijackThis v1.99.1

Scan saved at 11:49:07, on 19/12/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Java\jre1.5.0_07\bin\jusched.exe

C:\WINDOWS\system32\keyhook.exe

C:\WINDOWS\htpatch.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Ahead\InCD\InCD.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\Arquivos de programas\Creative\Shared Files\CAMTRAY.EXE

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\Ares\Ares.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\WindowsXp2.exe

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\WindowsSp2.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Arquivos de programas\Winamp\Winamp.exe