[Arquivado] Problemas no MSN 8.5- Erro 800401f3/ Restauração do S

ronaldogpi · Janeiro 25, 2009

Eu busquei de todas as formas resolver esse problema. Já tentei fazer de tudo que vários fóruns da Internet indicam para esse erro do MSN Messenger e do Sistema do Windows XP, como por exemplo, a Restauração do Sistema e nada entretanto deu certo. Eu registrei as Dlls, reinstalei especialmente a msxml3.dll e o javscript.dll e nenhum dos dois funcionam no sistema operacional. Inclusive utilizei softwares específicos para solucionar esse problema, entretanto não consegui resolver o mesmo.

Ao conectar, o Windows Live Messenger apresenta o código de erro, há 1 lag grande no momento de digitar o e-mail no meu perfil ocorre esse problema. Antes o mesmo apresentava a mensagem "Um componente crítico foi reparado; é preciso reiniciar o Messenger".

E como se não bastasse o problema no Messenger, a Restauração do Sistema e as Contas de Usuário estão com falhas, pois apresentam telas brancas e não é possível acessar ou modificar o conteúdo desejado. A imagem a seguir mostra sobre o problema que ocorre com o Windows XP.

Conforme orientação no fórum desse site, segue o log do Hijackthis. Aguardo respostas conclusivas para respostas sobre os problemas mencionados. Desde já, agradeço pela atenção.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:35:32, on 25/1/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Winamp\winampa.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\WINDOWS\system32\VTTimer.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Java\jre1.6.0_04\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\ltmoh\Ltmoh.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\vsnpstd3.exe

C:\Arquivos de programas\Net Studio\USB FireWall\USB FireWall.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

C:\Arquivos de programas\Microsoft Office\Office12\GROOVE.EXE

C:\Documents and Settings\Ronaldo\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\Ronaldo\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Ronaldo\Meus documentos\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60337'>http://www.crawler.com/search/ie.aspx?tb_id=60337"]http://www.crawler.com/search/ie.aspx?tb_id=60337

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60337'>http://dnl.crawler.com/support/sa_customize.aspx?TbId=60337"]http://dnl.crawler.com/support/sa_customize.aspx?TbId=60337

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.speedapps.com/search.htm'>http://www.speedapps.com/search.htm"]http://www.speedapps.com/search.htm

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Arquivos de programas\FlashGet\jccatch.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Arquivos de programas\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_04\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Arquivos de programas\FlashGet\getflash.dll

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_04\bin\jusched.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LtMoh] C:\Arquivos de programas\ltmoh\Ltmoh.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [googletalk] C:\Arquivos de programas\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe

O4 - HKLM\..\Run: [uSBFW] C:\Arquivos de programas\Net Studio\USB FireWall\USB FireWall.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: Microsoft Office Groove.lnk = C:\Arquivos de programas\Microsoft Office\Office12\GROOVE.EXE

O4 - Global Startup: Windows Desktop Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Descarregar tudo com o FlashGet - C:\Arquivos de programas\FlashGet\jc_all.htm

O8 - Extra context menu item: &Descarregar utilizando o FlashGet - C:\Arquivos de programas\FlashGet\jc_link.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx'>http://favorites.live.com/quickadd.aspx"]http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Crawler Search - tbr:iemenu

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Arquivos de programas\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Arquivos de programas\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: @C:\Arquivos de programas\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @C:\Arquivos de programas\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab'>http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab"]http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab'>http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab"]http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1228498680593'>http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228498680593"]http://update.microsoft.com/microsoftupdat...b?1228498680593

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1228411392625'>http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228411392625"]http://update.microsoft.com/microsoftupdat...b?1228411392625

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab'>http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab"]http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab'>http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab"]http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728Ax....RichUpload.cab'>https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab"]https://secure.shared.live.com/Pa6vGqB728Ax....RichUpload.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab'>http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab"]http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100'>https://secure.logmein.com/activex/ractrl.cab?lmi=100"]https://secure.logmein.com/activex/ractrl.cab?lmi=100

O17 - HKLM\System\CCS\Services\Tcpip\..\{BE959707-E59A-4D10-A643-49268770758D}: NameServer = 201.10.120.3,201.10.128.3

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Arquivos de programas\Ares\chatServer.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 12243 bytes

DigRam · Janeiro 26, 2009

Bom Dia! ronaldogpi

<@> Baixe: < ComboFix.exe > ( ...by sUBs )

<@> Salve-o no Desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança. <-- Link!

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!Siga,àcima,todas as recomendações propostas.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

--------------------------------------

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

ronaldogpi · Janeiro 28, 2009

Este tópico encontra-se duplicado. Favor desconsiderar essa mensagem.

Mário Monteiro · Janeiro 28, 2009

nao ronaldogpi

o outro topico que era duplicado ja foi removido

siga as instrucoes do digram contidas neste topico

ronaldogpi · Janeiro 28, 2009

Certo. Obrigado pelas dicas, segue os logs dos dois aplicativos, conforme solicitado.

LOG DO COMBOFIX.

ComboFix 09-01-21.04 - Ronaldo 2009-01-27 22:39:51.2 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.479.261 [GMT -3:00]

Executando de: c:\documents and settings\Ronaldo\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

FW: Norton AntiVirus *enabled*

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrador 2\Configura‡äes locais\Temporary Internet Files\

c:\documents and settings\Daniel\Configura‡äes locais\Temporary Internet Files\

c:\documents and settings\Joana\Configura‡äes locais\Temporary Internet Files\

c:\documents and settings\LocalService\Configura‡äes locais\Temporary Internet Files\

c:\documents and settings\NetworkService\Configura‡äes locais\Temporary Internet Files\

c:\documents and settings\Ronaldo\Configura‡äes locais\Temporary Internet Files\

.

(((((((((((((((( Arquivos/Ficheiros criados de 2008-12-28 to 2009-01-28 ))))))))))))))))))))))))))))

.

2009-01-27 22:32 . 2009-01-20 22:17 <DIR> d-------- C:\32788R22FWJFW

2009-01-27 17:55 . 2009-01-27 17:55 <DIR> d-------- c:\documents and settings\Daniel\Dados de aplicativos\AdobeUM

2009-01-25 20:31 . 2009-01-25 20:31 <DIR> d--hs---- C:\FOUND.064

2009-01-25 18:51 . 2009-01-25 18:51 <DIR> d-------- C:\!KillBox

2009-01-25 17:26 . 2009-01-25 17:26 <DIR> d-------- c:\arquivos de programas\Marcos Velasco Security

2009-01-25 17:07 . 2009-01-25 17:07 <DIR> d-------- C:\LinhaDefensiva

2009-01-25 13:22 . 2009-01-25 13:22 <DIR> d--hs---- C:\FOUND.063

2009-01-25 10:25 . 2009-01-25 10:25 <DIR> d-------- C:\MSXML3msms

2009-01-25 10:00 . 2009-01-25 10:00 <DIR> d-------- c:\arquivos de programas\MSXML 4.0

2009-01-24 13:43 . 2009-01-24 13:43 <DIR> d-------- c:\documents and settings\Ronaldo\Dados de aplicativos\GrabPro

2009-01-24 12:41 . 2009-01-24 12:41 <DIR> d-------- c:\documents and settings\Ronaldo\Dados de aplicativos\Orbit

2009-01-24 03:10 . 2009-01-24 03:10 <DIR> d-------- c:\documents and settings\Daniel\Dados de aplicativos\Orbit

2009-01-23 23:26 . 2009-01-23 23:26 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\BlazeVideo

2009-01-23 23:26 . 2009-01-23 23:26 <DIR> d-------- c:\arquivos de programas\Blaze Video Magic

2009-01-22 21:04 . 2009-01-22 21:04 <DIR> d-------- C:\DriveKey

2009-01-21 18:49 . 2009-01-21 18:49 86,528 --a------ c:\windows\system32\Dvdvideo.ax

2009-01-21 18:49 . 2009-01-21 18:49 65,536 --a------ c:\windows\system32\Dvdaudio.ax

2009-01-21 18:43 . 2009-01-21 18:43 <DIR> d-------- C:\divx

2009-01-21 18:38 . 2009-01-21 18:38 <DIR> d-------- c:\arquivos de programas\DivX

2009-01-21 16:45 . 2009-01-21 16:45 <DIR> d-------- c:\arquivos de programas\VSO

2009-01-21 16:45 . 2004-05-04 11:53 1,645,320 --a------ c:\windows\gdiplus.dll

2009-01-21 16:45 . 2006-05-20 16:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll

2009-01-21 16:45 . 2006-05-11 19:21 626,688 --a------ c:\windows\system32\vp7vfw.dll

2009-01-21 16:45 . 2006-09-29 12:24 217,127 --a------ c:\windows\system32\drv43260.dll

2009-01-21 16:45 . 2006-09-29 12:25 208,935 --a------ c:\windows\system32\drv33260.dll

2009-01-21 16:45 . 2006-09-29 12:26 176,165 --a------ c:\windows\system32\drv23260.dll

2009-01-21 16:45 . 2007-03-18 20:37 65,602 --a------ c:\windows\system32\cook3260.dll

2009-01-21 10:06 . 2009-01-21 15:57 67 --a------ c:\windows\Easy Video to DVD.INI

2009-01-21 10:05 . 2009-01-21 10:05 <DIR> d-------- c:\arquivos de programas\Easy MPEG AVI DIVX WMV RM to DVD

2009-01-20 22:13 . 2009-01-20 22:13 <DIR> d--hs---- C:\FOUND.062

2009-01-20 19:26 . 2009-01-20 19:26 <DIR> d-------- c:\arquivos de programas\Any Audio Converter

2009-01-20 16:20 . 2009-01-20 16:20 <DIR> d--h----- C:\csrunbuffer

2009-01-19 22:53 . 2009-01-19 22:53 <DIR> d-------- c:\documents and settings\Ronaldo\Dados de aplicativos\AdobeUM

2009-01-17 13:41 . 2009-01-17 13:41 <DIR> d-------- C:\CFLog

2009-01-17 13:39 . 2003-07-17 06:17 5,174 --a------ c:\windows\system32\nppt9x.vxd

2009-01-17 13:39 . 2004-12-31 21:43 4,682 --a------ c:\windows\system32\npptNT2.sys

2009-01-17 13:34 . 2009-01-17 13:34 <DIR> d-------- c:\arquivos de programas\G4box

2009-01-16 22:24 . 2009-01-16 22:24 <DIR> d-------- c:\arquivos de programas\Net Studio

2009-01-16 16:57 . 2009-01-16 16:57 <DIR> d-------- c:\windows\Cache

2009-01-16 16:51 . 2009-01-16 16:52 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Adobe

2009-01-16 14:54 . 2009-01-16 14:54 <DIR> d--hs---- C:\FOUND.061

2009-01-15 01:55 . 2009-01-15 01:55 <DIR> d-------- c:\documents and settings\Administrador 2\Dados de aplicativos\Windows Desktop Search

2009-01-15 01:54 . 2007-11-07 14:50 <DIR> d-------- c:\documents and settings\Administrador 2\Modelos

2009-01-15 01:54 . 2009-01-15 01:54 <DIR> dr------- c:\documents and settings\Administrador 2\Meus documentos

2009-01-15 01:54 . 2007-11-07 14:50 <DIR> dr------- c:\documents and settings\Administrador 2\Menu Iniciar

2009-01-15 01:54 . 2009-01-15 01:54 <DIR> dr------- c:\documents and settings\Administrador 2\Favoritos

2009-01-15 01:54 . 2007-11-07 14:50 <DIR> dr------- c:\documents and settings\Administrador 2\Dados de aplicativos

2009-01-15 01:54 . 2007-11-07 14:50 <DIR> d--h----- c:\documents and settings\Administrador 2\Configurações locais

2009-01-15 01:54 . 2007-11-07 14:50 <DIR> d-------- c:\documents and settings\Administrador 2\Ambiente de rede

2009-01-15 01:54 . 2007-11-07 14:50 <DIR> d-------- c:\documents and settings\Administrador 2\Ambiente de impressão

2009-01-15 01:54 . 2009-01-15 01:54 <DIR> d-------- c:\documents and settings\Administrador 2

2009-01-14 22:56 . 2009-01-14 22:56 <DIR> d-------- c:\arquivos de programas\TouchStoneSoftware

2009-01-13 20:48 . 2009-01-13 20:48 <DIR> d-------- c:\documents and settings\Daniel\Tracing

2009-01-13 20:16 . 2006-12-28 12:01 19,569 --a------ c:\windows\000003_.tmp

2009-01-13 19:29 . 2006-12-28 12:01 19,569 --a------ c:\windows\000002_.tmp

2009-01-13 19:12 . 2006-12-28 12:01 19,569 --a------ c:\windows\000001_.tmp

2009-01-13 18:58 . 2009-01-13 18:58 <DIR> d-------- c:\windows\system32\CatRoot_bak

2009-01-12 22:52 . 2009-01-12 22:52 <DIR> d-------- c:\documents and settings\Ronaldo\Dados de aplicativos\Windows Desktop Search

2009-01-12 22:30 . 2009-01-12 22:30 <DIR> d-------- c:\documents and settings\Ronaldo\Tracing

2009-01-12 22:25 . 2009-01-12 22:26 <DIR> d-------- c:\documents and settings\Joana\Tracing

2009-01-12 22:25 . 2009-01-12 22:25 184 --ah----- C:\sqmdata16.sqm

2009-01-12 22:25 . 2009-01-12 22:25 172 --ah----- C:\sqmnoopt16.sqm

2009-01-12 22:06 . 2009-01-12 22:06 244 --ah----- C:\sqmnoopt15.sqm

2009-01-12 22:06 . 2009-01-12 22:06 244 --ah----- C:\sqmdata15.sqm

2009-01-12 22:05 . 2009-01-12 22:05 <DIR> d-------- c:\arquivos de programas\Microsoft Sync Framework

2009-01-12 21:59 . 2009-01-12 21:59 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive

2009-01-12 21:59 . 2009-01-12 21:59 <DIR> d-------- c:\arquivos de programas\Microsoft

2009-01-12 20:26 . 2009-01-12 20:26 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-01-12 16:48 . 2009-01-12 16:48 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\SearchIn1Step

2009-01-12 16:45 . 2009-01-12 16:45 <DIR> d-------- c:\arquivos de programas\SearchIn1Step

2009-01-10 15:48 . 2009-01-10 15:49 230,424 --a------ C:\img2-001.raw

2009-01-09 23:56 . 2009-01-09 23:56 244 --ah----- C:\sqmnoopt14.sqm

2009-01-09 23:56 . 2009-01-09 23:56 244 --ah----- C:\sqmdata14.sqm

2009-01-09 21:34 . 2009-01-09 21:34 220 --ah----- C:\sqmdata13.sqm

2009-01-09 21:34 . 2009-01-09 21:34 172 --ah----- C:\sqmnoopt13.sqm

2009-01-09 21:26 . 2009-01-09 21:26 244 --ah----- C:\sqmnoopt12.sqm

2009-01-09 21:26 . 2009-01-09 21:26 244 --ah----- C:\sqmdata12.sqm

2009-01-09 19:08 . 2009-01-09 19:08 256 --ah----- C:\sqmdata11.sqm

2009-01-09 19:08 . 2009-01-09 19:08 244 --ah----- C:\sqmnoopt11.sqm

2009-01-07 13:22 . 2009-01-07 13:22 <DIR> d-------- c:\arquivos de programas\Wolfenstein - Enemy Territory

2009-01-07 10:38 . 2009-01-07 10:38 244 --ah----- C:\sqmnoopt10.sqm

2009-01-07 10:38 . 2009-01-07 10:38 244 --ah----- C:\sqmdata10.sqm

2009-01-06 23:17 . 2009-01-06 23:17 244 --ah----- C:\sqmnoopt09.sqm

2009-01-06 23:17 . 2009-01-06 23:17 244 --ah----- C:\sqmdata09.sqm

2009-01-05 19:58 . 2009-01-05 19:58 <DIR> d-------- c:\arquivos de programas\Mint Online TV

2009-01-05 16:46 . 2009-01-05 16:46 <DIR> d-------- c:\arquivos de programas\SopCast

2009-01-05 16:45 . 2009-01-05 16:45 <DIR> d-------- c:\arquivos de programas\Megacubo

2009-01-05 11:21 . 2009-01-05 11:21 244 --ah----- C:\sqmnoopt08.sqm

2009-01-05 11:21 . 2009-01-05 11:21 244 --ah----- C:\sqmdata08.sqm

2009-01-04 18:00 . 2009-01-04 18:00 <DIR> d-------- c:\documents and settings\Ronaldo\Dados de aplicativos\Windows Live Writer

2009-01-04 17:45 . 2009-01-04 17:45 <DIR> d-------- c:\arquivos de programas\AxBx

2009-01-04 15:50 . 2009-01-04 15:50 <DIR> d-------- c:\arquivos de programas\Cobian Backup 9

2009-01-04 15:17 . 2009-01-04 15:17 <DIR> d-------- c:\documents and settings\Ronaldo\Dados de aplicativos\Get Mail

2009-01-04 15:17 . 2009-01-04 15:17 <DIR> d-------- c:\arquivos de programas\PaulB

2009-01-04 14:36 . 2009-01-04 14:36 <DIR> d-------- c:\arquivos de programas\Microsoft Office Outlook Connector

2009-01-03 21:32 . 2009-01-03 21:32 244 --ah----- C:\sqmnoopt07.sqm

2009-01-03 21:32 . 2009-01-03 21:32 244 --ah----- C:\sqmdata07.sqm

2009-01-03 00:17 . 2009-01-03 00:17 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-01-03 00:16 . 2009-01-03 00:16 <DIR> d-------- c:\arquivos de programas\Super Internet TV

2009-01-01 18:29 . 2009-01-01 18:29 <DIR> d--hs---- C:\FOUND.060

2009-01-01 11:27 . 2009-01-01 11:27 280 --ah----- C:\sqmdata06.sqm

2009-01-01 11:27 . 2009-01-01 11:27 244 --ah----- C:\sqmnoopt06.sqm

2008-12-31 00:40 . 2008-12-31 00:40 196 --ah----- C:\sqmdata05.sqm

2008-12-31 00:40 . 2008-12-31 00:40 172 --ah----- C:\sqmnoopt05.sqm

2008-12-30 22:57 . 2008-12-30 22:57 244 --ah----- C:\sqmnoopt04.sqm

2008-12-30 22:57 . 2008-12-30 22:57 244 --ah----- C:\sqmdata04.sqm

2008-12-29 20:27 . 2008-12-29 20:27 244 --ah----- C:\sqmnoopt03.sqm

2008-12-29 20:27 . 2008-12-29 20:27 244 --ah----- C:\sqmdata03.sqm

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-21 19:45 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys

2009-01-21 19:45 47,360 ----a-w c:\documents and settings\Daniel\Dados de aplicativos\pcouffin.sys

2008-12-27 20:30 2,560 ----a-w c:\windows\_MSRSTRT.EXE

2008-12-27 20:20 --------- d-----w c:\arquivos de programas\ARCHPR

2008-12-26 19:08 --------- d-----w c:\arquivos de programas\ElcomSoft

2008-12-26 01:28 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2008-12-26 01:28 --------- d-----w c:\arquivos de programas\Messenger Plus! Live

2008-12-25 19:05 --------- d-----w c:\arquivos de programas\SuperAVConverter

2008-12-23 22:02 --------- d-----w c:\arquivos de programas\Digital Video Converter

2008-12-22 16:11 --------- d-----w c:\arquivos de programas\ViaVoice TTS

2008-12-21 23:22 --------- d-----w c:\arquivos de programas\Avira

2008-12-21 19:36 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Avira

2008-12-21 16:19 32 --sha-w c:\windows\system32\drivers\fidbox2.idx

2008-12-21 16:19 32 --sha-w c:\windows\system32\drivers\fidbox2.dat

2008-12-21 16:19 32 --sha-w c:\windows\system32\drivers\fidbox.idx

2008-12-21 16:19 32 --sha-w c:\windows\system32\drivers\fidbox.dat

2008-12-19 22:00 --------- d-----w c:\documents and settings\Ronaldo\Dados de aplicativos\drivers

2008-12-19 16:49 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab

2008-12-19 16:49 --------- d-----w c:\arquivos de programas\Kaspersky Lab

2008-12-18 01:54 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Symantec

2008-12-18 01:32 --------- d-----w c:\arquivos de programas\Arquivos comuns\Symantec Shared

2008-12-16 10:32 13,195 ----a-w c:\documents and settings\Daniel\ZGUICFGW.DAT

2008-12-11 02:19 --------- d-----w c:\arquivos de programas\Total Uninstall 5

2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll

2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll

2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll

2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll

2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll

2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll

2008-12-07 01:59 --------- d-----w c:\documents and settings\Daniel\Dados de aplicativos\DivX

2008-12-07 01:23 --------- d-----w c:\documents and settings\Daniel\Dados de aplicativos\GlarySoft

2008-12-05 02:03 308,072 ----a-w c:\windows\WLXPGSS.SCR

2008-12-03 20:58 --------- d-----w c:\arquivos de programas\Zapu

2008-12-03 01:37 49,480 ----a-w c:\windows\system32\sirenacm.dll

2008-11-06 16:37 524,288 ----a-w c:\windows\system32\DivXsm.exe

2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll

2008-11-06 16:35 200,704 ----a-w c:\windows\system32\ssldivx.dll

2008-11-06 16:35 1,044,480 ----a-w c:\windows\system32\libdivx.dll

2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx0c.dll

2008-11-06 16:33 823,296 ----a-w c:\windows\system32\divx_xx07.dll

2008-11-06 16:33 815,104 ----a-w c:\windows\system32\divx_xx0a.dll

2008-11-06 16:33 802,816 ----a-w c:\windows\system32\divx_xx11.dll

2008-11-06 16:33 684,032 ----a-w c:\windows\system32\DivX.dll

2008-11-06 16:33 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll

2008-01-24 18:32 2,088 ----a-w c:\arquivos de programas\z3D.log

2008-01-24 18:28 2,069 ----a-w c:\arquivos de programas\multiAutoSave

2008-01-24 18:28 2,069 ----a-w c:\arquivos de programas\demo1-Start

2008-06-17 19:43 32,768 --sha-w c:\windows\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\MSHist012008061720080618\index.dat

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"MsnMsgr"="c:\arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WinampAgent"="c:\arquivos de programas\Winamp\winampa.exe" [2008-01-15 37376]

"TkBellExe"="c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2008-04-01 185896]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784]

"RemoteControl"="c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]

"LtMoh"="c:\arquivos de programas\ltmoh\Ltmoh.exe" [2005-05-18 188416]

"HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

"GrooveMonitor"="c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"googletalk"="c:\arquivos de programas\Google\Google Talk\googletalk.exe" [2007-01-01 3735552]

"avgnt"="c:\arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"snpstd3"="c:\windows\vsnpstd3.exe" [2005-01-14 339968]

"USBFW"="c:\arquivos de programas\Net Studio\USB FireWall\USB FireWall.exe" [2008-09-01 1330688]

"VTTrayp"="VTtrayp.exe" [2006-08-30 c:\windows\system32\VTTrayp.exe]

"VTTimer"="VTTimer.exe" [2006-08-03 c:\windows\system32\VTTimer.exe]

"SoundMan"="SOUNDMAN.EXE" [2006-11-17 c:\windows\soundman.exe]

"AGRSMMSG"="AGRSMMSG.exe" [2005-06-30 c:\windows\AGRSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Joana\Menu Iniciar\Programas\Inicializar\

Recorte de tela e Iniciador do OneNote 2007.lnk - c:\arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\Ronaldo\Menu Iniciar\Programas\Inicializar\

Recorte de tela e Iniciador do OneNote 2007.lnk - c:\arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

Microsoft Office Groove.lnk - c:\arquivos de programas\Microsoft Office\Office12\GROOVE.EXE [2007-08-29 340856]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Windows Desktop Search.lnk - c:\arquivos de programas\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

HP Digital Imaging Monitor.lnk - c:\arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]

Adobe Reader Speed Launch.lnk - c:\arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]

"NoAutoUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\arquivos de programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2008-05-28 12:32 87352 c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.DIV3"= DivXc32.dll

"vidc.DIV4"= DivXc32f.dll

"vidc.3iv2"= 3ivxVfWCodec.dll

"msacm.divxa32"= divxa32.acm

"VIDC.HFYU"= huffyuv.dll

"VIDC.i263"= i263_32.drv

"msacm.imc"= imc32.acm

"VIDC.VP31"= vp31vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"TkBellExe"="c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

"QuickTime Task"="c:\arquivos de programas\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Arquivos de programas\\Ares\\Ares.exe"=

"c:\\Arquivos de programas\\DreMule\\emule.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Messenger\\Msmsgs.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5000:TCP"= 5000:TCP:AresChatServer

R4 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-09-11 45848]

R4 SeaPort;SeaPort;c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640]

R4 WinDefend;Windows Defender;c:\arquivos de programas\Windows Defender\MsMpEng.exe [2006-11-03 13592]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-08-02 32512]

S4 agrsm;Agere Modem Driver;c:\windows\system32\agrsmnt.sys [2007-12-13 1269584]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

\Shell\AutoRun\command - 2u.com

\Shell\explore\Command - 2u.com

\Shell\open\Command - 2u.com

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-01-27 c:\windows\Tasks\WebReg Deskjet F300 series.job

- c:\arquivos de programas\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 05:09]

2009-01-28 c:\windows\Tasks\MP Scheduled Scan.job

- c:\arquivos de programas\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]

2009-01-28 c:\windows\Tasks\AD92B7A891892B58.job

- c:\docume~1\daniel\dadosd~1\mealju~1\View Noun Mapi.exe []

.

------- Scan Suplementar -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uSearchURL,(Default) = hxxp://www.speedapps.com/search.htm

IE: &Descarregar tudo com o FlashGet - c:\arquivos de programas\FlashGet\jc_all.htm

IE: &Descarregar utilizando o FlashGet - c:\arquivos de programas\FlashGet\jc_link.htm

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: Crawler Search - tbr:iemenu

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {BE959707-E59A-4D10-A643-49268770758D} = 201.10.120.3,201.10.128.3

DPF: Microsoft XML Parser for Java

DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} - hxxps://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab

FF - ProfilePath -

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-27 22:41:14

Windows 5.1.2600 Service Pack 3 FAT NTAPI

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(748)

c:\windows\system32\LMIinit.dll

.

Tempo para conclusão: 2009-01-27 22:42:21

ComboFix-quarantined-files.txt 2009-01-28 01:42:20

ComboFix2.txt 2009-01-25 21:39:46

Pré-execução: 98 pasta(s) 15.901.032.448 bytes disponíveis

Pós execução: 98 pasta(s) 15,881,830,400 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

313

LOG DO HIJACKTHIS.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 07:23:27, on 28/1/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Winamp\winampa.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\WINDOWS\system32\VTTimer.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Java\jre1.6.0_04\bin\jusched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\ltmoh\Ltmoh.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\Restore\rstrui.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\vsnpstd3.exe

C:\Arquivos de programas\Net Studio\USB FireWall\USB FireWall.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

C:\Arquivos de programas\Microsoft Office\Office12\ONENOTEM.EXE

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Documents and Settings\Ronaldo\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\Ronaldo\Meus documentos\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60337

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60337

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.speedapps.com/search.htm