[Resolvido!] Tem alguém espionando meu computador?

Nigel · Junho 15, 2009

Bom dia, gostaria de saber se tem alguém espionando meu computador, porque tenho recebido e-mails anônimos. O computador está com a velocidade normal e não notei nada diferente.

Abaixo o log do HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:18:10, on 15/6/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\The Skins Factory\Hyperdesk\Common\HDThemeEnabler.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\LckFldService.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\vsnpstd.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.shareazaweb.com/br/

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [AudioDeck] C:\Arquivos de programas\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [OM2_Monitor] "C:\Arquivos de programas\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKCU\..\Run: [RemoveIT Pro XT] C:\Arquivos de programas\InCode Solutions\RemoveIT Pro v4-Trial\removeit.exe

O4 - HKCU\..\Run: [12CFG914-K641-26SF-N31P] C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0850\vsse32.exe

O4 - HKCU\..\Run: [13CFG914-K641-26SF-N31P] C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0950\vsse33.exe

O4 - HKCU\..\Run: [OM2_Monitor] "C:\Arquivos de programas\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [AdobeUpdater] "C:\Arquivos de programas\Arquivos comuns\Adobe\Updater5\AdobeUpdater.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Arquivos de programas\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Arquivos de programas\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')

O8 - Extra context menu item: &Clean Traces - C:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: Download Links As... - file://C:\WINDOWS\system32\page.htm

O8 - Extra context menu item: Download Target(s) As... - file://C:\WINDOWS\system32\link.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Arquivos de programas\MP3 Player Utilities 4.00\MediaManager\grab.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Windows Network Data Management System Service (BNDMSS) - Unknown owner - C:\WINDOWS\system32\bndmss.exe (file missing)

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Hyperdesk Theme Enabler (HdThemeEnabler) - The Skins Factory, Inc. - C:\Arquivos de programas\The Skins Factory\Hyperdesk\Common\HDThemeEnabler.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

O23 - Service: ServiceLayer - Nokia. - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Arquivos de programas\Arquivos comuns\Symantec Shared\SNDSrvc.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 8554 bytes

PedroN · Junho 15, 2009

- Faça o download do UsbFix e salve-o no desktop (área de trabalho):

● Desative o Avast! temporariamente. Para maiores informações de como desativá-lo, veja em:

Como desabilitar seu antivirus e anti-spyware temporariamente

● Dê um duplo clique no ícone do UsbFix e instale-o clicando em (Suivant > Aceite o contrato > Suivant > Suivant > Démarrer > Quitter);

● Dê um duplo clique no ícone do UsbFix criado no desktop para executá-lo;

● Tecle a opção 2 e pressione Enter;

● Insira seu pen drive, MP3, MP4 ou qualquer outra mídia removível que tenha na(s) porta(s) USB do PC e clique OK na mensagem. Seu desktop sumirá e aparecerá uma tela preta. Seu computador será reiniciado automaticamente;

● Mantenha a(s) mídia(s) no local. Não remova!

● Quando seu computador estiver reiniciando, seu desktop não será apresentado e aparecerá uma tela preta da ferramenta fazendo uma verificação final;

● Ao término Ao término, será aberto o bloco de notas para você com o log. O log também estará em C:\UsbFix.txt

● Feche o bloco de notas (clicando no X) para fechar o programa também.

OBS: Se após reiniciar o desktop ficar somente com o plano de fundo, sem ícones e barras, tecle Ctrl + Alt + Delete para rodar o gerenciador de tarefas. Clique em Arquivo > Executar nova tarefa, digite: explorer.exe e dê um OK.

Nigel · Junho 18, 2009

Antes de fazer o que você disse tenho notado que o computador tem uns problemas ao iniciar, o desktop fica zuado, os icones mudam de posição...

Ah, e quando tentei baixar o USBFIX seu link nao funcionou, entao baixei de outro lugar.

Segue o log dele e o do HithisJack (caso ajude em alguma coisa...)

-------------- UsbFix V2.395 ---------------

* User : uu - IRLEIDE

* Outils mis a jours le 20/10/2008 par Chiquitine29 et Chimay8

* Recherche effectuée à 16:44:42 le qui 18/06/2009

* Windows Xp - Internet Explorer 6.0.2900.5512

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\The Skins Factory\Hyperdesk\Common\HDThemeEnabler.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\userinit.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\DOCUME~1\uu\CONFIG~1\Temp\13.tmp\b2e.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\LckFldService.exe

C:\WINDOWS\vsnpstd.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\System32\alg.exe

--------------- [ Informations lecteurs ] ----------------

C: - Unidade de disco fixo

E: - Unidade de disco remov¡vel

G: - Unidade de disco remov¡vel

--------------- [ Registre / Startup ] ----------------

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

SiSPower REG_SZ Rundll32.exe SiSPower.dll,ModeAgent

SoundMAX REG_SZ "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

AudioDeck REG_SZ C:\Arquivos de programas\VIAudioi\SBADeck\ADeck.exe 1

Monitor REG_SZ C:\WINDOWS\PixArt\PAC207\Monitor.exe

SoundMAXPnP REG_SZ C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

QuickTime Task REG_SZ "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

snpstd REG_SZ C:\WINDOWS\vsnpstd.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

RemoveIT Pro XT REG_SZ C:\Arquivos de programas\InCode Solutions\RemoveIT Pro v4-Trial\removeit.exe

--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{15746c58-d298-11db-a0f1-00830801f13d}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{15746c58-d298-11db-a0f1-00830801f13d}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51baad56-9b1b-11dd-9c12-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51baad56-9b1b-11dd-9c12-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51baad56-9b1b-11dd-9c12-001558596689}\Shell\open\Command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51baad56-9b1b-11dd-9c12-001558596689}\Shell\open\Command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{579aa8be-a39d-11dc-a3b8-00830801f13d}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{579aa8be-a39d-11dc-a3b8-00830801f13d}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a34d230a-1ef9-11de-9d8f-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a34d230a-1ef9-11de-9d8f-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7c22868-068e-11dd-9a3d-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7c22868-068e-11dd-9a3d-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7c22868-068e-11dd-9a3d-001558596689}\Shell\open\Command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a7c22868-068e-11dd-9a3d-001558596689}\Shell\open\Command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c74e8e40-c6d9-11dd-9c99-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c74e8e40-c6d9-11dd-9c99-001558596689}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c74e8e40-c6d9-11dd-9c99-001558596689}\Shell\open\Command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c74e8e40-c6d9-11dd-9c99-001558596689}\Shell\open\Command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f086c7ce-5030-11dd-9b2c-00830801f13d}\Shell\AutoRun\command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f086c7ce-5030-11dd-9b2c-00830801f13d}\Shell\AutoRun\command

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f086c7ce-5030-11dd-9b2c-00830801f13d}\Shell\open\Command

Supprimé ! - HKEY_USERS\S-1-5-21-1060284298-1844823847-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f086c7ce-5030-11dd-9b2c-00830801f13d}\Shell\open\Command

--------------- [ Nettoyage des disques ] ----------------

Supprimé ! - C:\Recycled\Recycled

--------------- ! Fin du rapport ! ----------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:50:44, on 18/6/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\The Skins Factory\Hyperdesk\Common\HDThemeEnabler.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\LckFldService.exe

C:\WINDOWS\vsnpstd.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE

C:\WINDOWS\explorer.exe