[Resolvido!] Windows muito lento

Villalobos · Setembro 22, 2009

Meu Windows esta muito lento, nunca foi desta maneira, qualquer programa que vou utilizar demora para abrir ou trava. Utilizo o Internet Explorer 8.0 e esta absurdamente lento (minha internet é de 1mb), e quando abro mais de uma guia aparece a mensagem de que o programa não esta respondendo, mas após alguns minutos a mensagem some e volta a funcionar. Já desfragmentei a HD, utilizei o programa MV Regclean para limpar o registro e o programa Full Speed para melhorar a conexão da internet, já passei o antivirus Spybot, AVG e o Bitdefender, mas nada melhorou. Acredito que seja algum virus, malware, spy segue o log do HiJackThis e do BankerFix.

E todos os programas sem exceção travam por alguns segundos quando estão inicializando.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:45:00, on 21/9/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Scan Server\bdss.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Arquivos de programas\Softwin\BitDefender8\bdmcon.exe

C:\Arquivos de programas\Softwin\BitDefender8\bdnagent.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABP.EXE

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Innovative Solutions\DriverMax\devices.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = >>> 'Full Speed' Enabled <<<

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [bDMCon] "C:\Arquivos de programas\Softwin\BitDefender8\bdmcon.exe"

O4 - HKLM\..\Run: [bDNewsAgent] "C:\Arquivos de programas\Softwin\BitDefender8\bdnagent.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [EPSON Stylus C87 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABP.EXE /P23 "EPSON Stylus C87 Series" /O5 "LPT1:" /M "Stylus C87"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [DriverMax] "C:\Arquivos de programas\Innovative Solutions\DriverMax\devices.exe" -agent

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Arquivos de programas\Arquivos comuns\SureThing Shared\stllssvr.exe

O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Communicator\xcommsvr.exe

--

End of file - 9015 bytes

-------------------------------------------------------

BankerFix 3.1 VALKYRIE - Removedor de Bankers

Linha Defensiva | http://www.linhadefensiva.org

http://www.linhadefensiva.org/bankerfix/

-------------------------------------------------------

Data: 2009-09-21 - 22:48

-------------------------------------------------------

Lista de Definição: 2009-07-24-2 | CORE: 2009-07-24-1

=======================================================

----- Fim -------------------------

DigRam · Setembro 23, 2009

Boa Tarde! Villalobos

<@> Baixe: < > ( ...by OldTimer Tools )

<@> Salve-o no desktop!

<@> Segundo a imagem,mude a opção em "Output" para "Minimal Output".

<@> Duplo-clique em OTL.exe --> Marque a opção "Scan All Users".

<@> Clique em: < > --> Aguarde!

<@> Poste:

<1> OTL.txt <--

<2> Extra.txt <--

Abraços!

Villalobos · Setembro 24, 2009

Boa noite, DigRam!

Segue o OTL.txt e o Extras.txt

OTL logfile created on: 23/9/2009 20:47:25 - Run 1

OTL by OldTimer - Version 3.0.14.0 Folder = C:\Documents and Settings\Ricardo\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy

735,48 Mb Total Physical Memory | 201,11 Mb Available Physical Memory | 27,34% Memory free

1,76 Gb Paging File | 1,10 Gb Available in Paging File | 62,24% Paging File free

Paging file location(s): C:\pagefile.sys 1104 2208 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas

Drive C: | 74,55 Gb Total Space | 40,83 Gb Free Space | 54,77% Space Free | Partition Type: NTFS

Drive D: | 19,07 Gb Total Space | 8,24 Gb Free Space | 43,20% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: VILLALOBOS

Current User Name: Ricardo

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Arquivos de programas\GbPlugin\gbpsv.exe ( )

PRC - C:\Arquivos de programas\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)

PRC - C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Communicator\xcommsvr.exe (Softwin)

PRC - C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Scan Server\bdss.exe ()

PRC - C:\Arquivos de programas\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Arquivos de programas\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Arquivos de programas\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)

PRC - C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Arquivos de programas\Softwin\BitDefender8\bdmcon.exe (SOFTWIN S.R.L.)

PRC - C:\Arquivos de programas\Softwin\BitDefender8\bdnagent.exe ()

PRC - C:\Arquivos de programas\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABP.EXE (SEIKO EPSON CORPORATION)

PRC - C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)

PRC - C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

PRC - C:\Arquivos de programas\Innovative Solutions\DriverMax\devices.exe (Innovative Solutions)

PRC - C:\Arquivos de programas\Skype\Phone\Skype.exe (Skype Technologies S.A.)

PRC - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

PRC - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe (Hewlett-Packard Co.)

PRC - C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe (Skype Technologies)

PRC - C:\Arquivos de programas\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Documents and Settings\Ricardo\Desktop\HiJackThis.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)

SRV - (avg8emc [Auto | Running]) -- C:\Arquivos de programas\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)

SRV - (avg8wd [Auto | Running]) -- C:\Arquivos de programas\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (bdss [Auto | Running]) -- C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Scan Server\bdss.exe ()

SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)

SRV - (GbpSv [unknown | Running]) -- C:\Arquivos de programas\GbPlugin\gbpsv.exe ( )

SRV - (gusvc [On_Demand | Stopped]) -- C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)

SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)

SRV - (hpqcxs08 [On_Demand | Running]) -- C:\Arquivos de programas\HP\Digital Imaging\bin\hpqcxs08.dll (Hewlett-Packard Co.)

SRV - (hpqddsvc [Auto | Running]) -- C:\Arquivos de programas\HP\Digital Imaging\bin\hpqddsvc.dll (Hewlett-Packard Co.)

SRV - (idsvc [unknown | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)

SRV - (MDM [Auto | Running]) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)

SRV - (Net Driver HPZ12 [Auto | Running]) -- C:\WINDOWS\System32\HPZinw12.dll (Hewlett-Packard)

SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)

SRV - (Pml Driver HPZ12 [Auto | Running]) -- C:\WINDOWS\System32\HPZipm12.dll (Hewlett-Packard)

SRV - (stllssvr [On_Demand | Stopped]) -- C:\Arquivos de programas\Arquivos comuns\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)

SRV - (WLSetupSvc [On_Demand | Stopped]) -- C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)

SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Arquivos de programas\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

SRV - (XCOMM [Auto | Running]) -- C:\Arquivos de programas\Arquivos comuns\Softwin\BitDefender Communicator\xcommsvr.exe (Softwin)

========== Driver Services (SafeList) ==========

DRV - (AvgLdx86 [system | Running]) -- C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgMfx86 [system | Running]) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgTdiX [system | Running]) -- C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (cmuda [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\cmuda.sys (C-Media Inc)

DRV - (gameenum [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation)

DRV - (GbpKm [boot | Running]) -- C:\WINDOWS\system32\drivers\GbpKm.sys (GAS Tecnologia)

DRV - (HPZid412 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\HPZid412.sys (HP)

DRV - (HPZipr12 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\HPZipr12.sys (HP)

DRV - (HPZius12 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\HPZius12.sys (HP)

DRV - (lgmcbus [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcbus.sys (MCCI Corporation)

DRV - (lgmcmdfl [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcmdfl.sys (MCCI Corporation)

DRV - (lgmcmdm [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcmdm.sys (MCCI Corporation)

DRV - (lgmcmgmt [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcmgmt.sys (MCCI Corporation)

DRV - (lgmcnd5 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcnd5.sys (MCCI Corporation)

DRV - (lgmcobex [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcobex.sys (MCCI Corporation)

DRV - (lgmcunic [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\lgmcunic.sys (MCCI Corporation)

DRV - (ms_mpu401 [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\msmpu401.sys (Microsoft Corporation)

DRV - (NuidFltr [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\NuidFltr.sys (Microsoft Corporation)

DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)

DRV - (PxHelp20 [boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)

DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

DRV - (SiS315 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation)

DRV - (sisagp [boot | Running]) -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)

DRV - (SiSkp [system | Running]) -- C:\WINDOWS\System32\drivers\srvkp.sys ()

DRV - (SISNIC [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\sisnic.sys (SiS Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll ()

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll ()

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm

IE - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

IE - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\S-1-5-21-606747145-1993962763-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/01 13:54:58 | 00,000,000 | ---D | M]

O1 HOSTS File: (331655 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.123topsearch.com

O1 - Hosts: 127.0.0.1 123topsearch.com

O1 - Hosts: 127.0.0.1 www.132.com

O1 - Hosts: 127.0.0.1 132.com

O1 - Hosts: 127.0.0.1 www.136136.net

O1 - Hosts: 127.0.0.1 136136.net

O1 - Hosts: 127.0.0.1 www.163ns.com

O1 - Hosts: 127.0.0.1 163ns.com

O1 - Hosts: 11359 more lines...

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()

O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)

O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\Arquivos de programas\GbPlugin\gbiehAbn.dll (Banco ABN AMRO)

O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\..\Toolbar\ShellBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.

O3 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [AVG8_TRAY] C:\Arquivos de programas\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [bDMCon] C:\Arquivos de programas\Softwin\BitDefender8\bdmcon.exe (SOFTWIN S.R.L.)

O4 - HKLM..\Run: [bDNewsAgent] C:\Arquivos de programas\Softwin\BitDefender8\bdnagent.exe ()

O4 - HKLM..\Run: [Cmaudio] File not found

O4 - HKLM..\Run: [EPSON Stylus C87 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABP.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [siS Tray] File not found

O4 - HKLM..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.)

O4 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003..\Run: [DriverMax] C:\Arquivos de programas\Innovative Solutions\DriverMax\devices.exe (Innovative Solutions)

O4 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003..\Run: [skype] C:\Arquivos de programas\Skype\Phone\Skype.exe (Skype Technologies S.A.)

O4 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

O4 - Startup: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: E&xportar para o Microsoft Excel - C:\Arquivos de programas\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)

O12 - Plugin for: .spop - C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)

O15 - HKLM\..Trusted Domains: 58 domain(s) and sub-domain(s) not assigned to a zone.

O15 - HKU\.DEFAULT\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.

O15 - HKU\S-1-5-18\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.

O15 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx (get_atlcom Class)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab (GbPluginObj Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 200.204.0.10 200.204.0.138

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Arquivos de programas\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Arquivos de programas\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Arquivos de programas\Arquivos comuns\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)

O20 - HKU\S-1-5-21-606747145-1993962763-1957994488-1003 Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ GbPluginAbn: DllName - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll - C:\Arquivos de programas\GbPlugin\gbiehAbn.dll (Banco ABN AMRO)

O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found

O24 - Desktop Components:0 (Minha página inicial atual) - About:Home

O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399007} - C:\Arquivos de programas\GbPlugin\gbiehAbn.dll (Banco ABN AMRO)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/06/29 10:32:10 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2006/11/26 13:42:04 | 00,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck) - File not found

O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)

O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[6 C:\WINDOWS\System32\*.tmp files]

[2009/09/23 20:45:59 | 00,514,560 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ricardo\Desktop\HiJackThis.exe

[2009/09/21 22:47:01 | 00,000,000 | ---D | C] -- C:\LinhaDefensiva

[2009/09/21 22:44:12 | 00,001,813 | ---- | C] () -- C:\Documents and Settings\Ricardo\Desktop\HijackThis.lnk

[2009/09/21 22:44:10 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Trend Micro

[2009/09/18 23:16:40 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Haali

[2009/09/18 23:16:23 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\CoreCodec

[2009/09/17 19:14:23 | 00,000,996 | ---- | C] () -- C:\Documents and Settings\Ricardo\Desktop\Spybot - Search & Destroy.lnk

[2009/09/17 19:07:25 | 16,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Documents and Settings\Ricardo\Desktop\setup-spybotsd162.exe

[2009/09/17 14:25:44 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Microsoft

[2009/09/17 14:25:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documentos\microsoft

[2009/09/17 14:25:18 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Windows Live SkyDrive

[2009/09/17 14:17:40 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Arquivos comuns\Windows Live

[2009/09/17 13:57:55 | 00,000,769 | ---- | C] () -- C:\Documents and Settings\Ricardo\Desktop\MediaCoder.lnk

[2009/09/17 13:05:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ricardo\Dados de aplicativos\Broad Intelligence

[2009/09/13 20:04:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ricardo\Dados de aplicativos\Google

[2009/09/13 20:04:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ricardo\Configurações locais\Dados de aplicativos\Google

[2009/09/13 19:30:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Google

[2009/09/13 19:30:11 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Google

[2009/09/12 18:30:50 | 00,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2009/09/12 18:30:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ricardo\Dados de aplicativos\skypePM

[2009/09/12 18:30:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ricardo\Dados de aplicativos\Skype

[2009/09/12 18:29:21 | 00,001,896 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2009/09/12 18:29:19 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Arquivos comuns\Skype

[2009/09/12 18:29:12 | 00,000,000 | R--D | C] -- C:\Arquivos de programas\Skype

[2009/09/12 18:29:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Skype

[2009/09/11 19:55:34 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt10.sqm

[2009/09/11 19:55:34 | 00,000,232 | -H-- | C] () -- C:\sqmdata10.sqm

[2009/09/06 23:55:11 | 00,000,035 | ---- | C] () -- C:\Documents and Settings\Ricardo\Meus documentos\WUPDATE.INI

[2009/09/06 23:54:57 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Sexy Dreams

[2009/09/06 13:42:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Windows Genuine Advantage

[2009/09/06 11:27:09 | 00,018,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll

[2009/09/06 11:26:04 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Windows Media Connect 2

[2009/09/06 11:21:13 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf

[2009/09/06 11:21:01 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles

[2009/09/06 11:21:01 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF

[2009/09/04 20:44:33 | 00,000,000 | ---D | C] -- C:\Arquivos de programas\Sexy Poker 5

[2009/08/28 18:30:59 | 00,000,268 | -H-- | C] () -- C:\sqmdata09.sqm

[2009/08/28 18:30:59 | 00,000,244 | -H-- | C] () -- C:\sqmnoopt09.sqm

[2009/08/27 20:29:04 | 00,027,712 | ---- | C] () -- C:\Documents and Settings\Ricardo\Meus documentos\Domino.Rally.USA.Wii-APATHY(TorrentSpain.com) [mininova].torrent

[2009/08/26 14:32:26 | 00,005,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\MSTEE.sys

[2009/08/26 14:32:26 | 00,005,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstee.sys

[2009/08/26 14:32:17 | 00,010,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\NdisIP.sys

[2009/08/26 14:32:17 | 00,010,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndisip.sys

[2009/08/26 14:32:13 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ipsink.ax

[2009/08/26 14:32:13 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ipsink.ax

[2009/08/26 14:32:13 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\StreamIP.sys

[2009/08/26 14:32:13 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\streamip.sys

[2009/08/26 14:32:10 | 00,011,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\SLIP.sys

[2009/08/26 14:32:10 | 00,011,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\slip.sys

[2009/08/26 14:32:06 | 00,019,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\WSTCODEC.SYS

[2009/08/26 14:32:06 | 00,019,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wstcodec.sys

[2009/08/26 14:32:02 | 00,085,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\NABTSFEC.sys

[2009/08/26 14:32:02 | 00,085,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nabtsfec.sys

[2009/08/26 14:31:59 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\CCDECODE.sys

[2009/08/26 14:31:59 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ccdecode.sys

[2009/08/26 14:31:30 | 00,091,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kswdmcap.ax

[2009/08/26 14:31:30 | 00,091,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kswdmcap.ax

[2009/08/26 14:31:30 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kstvtune.ax

[2009/08/26 14:31:30 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kstvtune.ax

[2009/08/26 14:31:30 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vidcap.ax

[2009/08/26 14:31:30 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vidcap.ax

[2009/08/26 14:31:29 | 00,078,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbvideo.sys

[2009/08/26 14:31:29 | 00,078,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbvideo.sys

[2009/08/26 14:31:29 | 00,054,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vfwwdm32.dll

[2009/08/26 14:31:29 | 00,054,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vfwwdm32.dll

[2009/08/26 14:31:27 | 00,043,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksxbar.ax

[2009/08/26 14:31:27 | 00,043,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ksxbar.ax

[2009/08/26 14:31:27 | 00,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dshowext.ax

[2009/08/26 14:31:27 | 00,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dshowext.ax

[2009/06/14 07:39:56 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2009/06/14 07:39:56 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini

[2009/06/14 07:39:53 | 00,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2009/06/14 07:39:53 | 00,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2008/11/21 18:45:16 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest

[2008/11/21 18:45:16 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest

[2008/07/02 21:25:34 | 00,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2008/06/29 17:34:03 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll

[2008/06/29 15:06:04 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008/06/29 11:14:38 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008/06/29 11:03:50 | 00,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI

[2008/06/29 11:03:50 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI

[2008/06/29 11:03:49 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini

[2008/06/29 11:03:27 | 00,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll

[2008/06/29 11:00:35 | 00,032,738 | ---- | C] () -- C:\WINDOWS\System32\1_ssetup.ini

[2008/06/29 11:00:35 | 00,015,066 | ---- | C] () -- C:\WINDOWS\System32\sunistlog.ini

[2008/06/29 11:00:35 | 00,008,576 | R--- | C] () -- C:\WINDOWS\System32\drivers\srvkp.sys

[2008/06/29 10:59:25 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\setuplib.dll

[2008/06/29 10:57:02 | 00,032,768 | ---- | C] () -- C:\WINDOWS\SIS_LIB.DLL

[2005/01/18 13:34:36 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\akrip32.dll

[2004/11/09 11:08:20 | 00,864,256 | ---- | C] () -- C:\WINDOWS\System32\FreeImage.dll

[2003/11/18 01:29:04 | 00,055,808 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll

[2002/12/03 21:47:16 | 00,172,032 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll

[2001/10/28 09:07:38 | 00,001,391 | ---- | C] () -- C:\WINDOWS\win.ini

[2001/10/28 09:07:30 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[6 C:\WINDOWS\System32\*.tmp files]

[3 C:\WINDOWS\*.tmp files]

[2009/09/23 20:46:18 | 00,514,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ricardo\Desktop\HiJackThis.exe

[2009/09/23 19:59:49 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job

[2009/09/23 19:50:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2009/09/23 19:50:26 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2009/09/23 09:47:37 | 41,682,288 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm

[2009/09/22 20:15:31 | 00,112,900 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg

[2009/09/22 20:10:55 | 00,002,262 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2009/09/21 22:49:50 | 00,331,655 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2009/09/21 22:44:12 | 00,001,813 | ---- | M] () -- C:\Documents and Settings\Ricardo\Desktop\HijackThis.lnk

[2009/09/21 22:05:23 | 00,199,168 | ---- | M] () -- C:\Documents and Settings\Ricardo\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/09/17 20:32:05 | 00,331,657 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090920-141705.backup

[2009/09/17 20:31:19 | 00,331,657 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090917-203205.backup

[2009/09/17 19:19:41 | 00,145,216 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009/09/17 19:14:23 | 00,000,996 | ---- | M] () -- C:\Documents and Settings\Ricardo\Desktop\Spybot - Search & Destroy.lnk

[2009/09/17 19:09:38 | 16,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\Ricardo\Desktop\setup-spybotsd162.exe

[2009/09/17 19:02:05 | 00,262,472 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20090917-203118.backup

[2009/09/17 14:26:52 | 00,030,376 | ---- | M] () -- C:\Documents and Settings\Ricardo\Configurações locais\Dados de aplicativos\GDIPFONTCACHEV1.DAT

[2009/09/17 14:16:29 | 00,000,964 | ---- | M] () -- C:\Documents and Settings\Ricardo\Meus documentos\Minhas Pastas de Compartilhamento.lnk

[2009/09/17 13:57:55 | 00,000,769 | ---- | M] () -- C:\Documents and Settings\Ricardo\Desktop\MediaCoder.lnk

[2009/09/12 18:45:12 | 00,054,272 | ---- | M] () -- C:\Documents and Settings\Ricardo\Meus documentos\CV - Ricardo Villalobos.doc

[2009/09/12 18:30:50 | 00,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat

[2009/09/12 18:29:21 | 00,001,896 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2009/09/11 19:55:34 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm

[2009/09/11 19:55:34 | 00,000,232 | -H-- | M] () -- C:\sqmdata10.sqm

[2009/09/08 21:01:10 | 00,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2009/09/07 00:02:43 | 00,000,035 | ---- | M] () -- C:\Documents and Settings\Ricardo\Meus documentos\WUPDATE.INI

[2009/09/06 13:40:23 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb

[2009/09/06 13:40:23 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb

[2009/09/06 11:26:31 | 00,001,391 | ---- | M] () -- C:\WINDOWS\win.ini

[2009/09/06 11:23:17 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx

[2009/09/06 11:21:13 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf

[2009/09/06 10:42:56 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2009/08/28 18:38:20 | 24,689,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe

[2009/08/28 18:30:59 | 00,000,268 | -H-- | M] () -- C:\sqmdata09.sqm

[2009/08/28 18:30:59 | 00,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm

[2009/08/27 20:29:05 | 00,027,712 | ---- | M] () -- C:\Documents and Settings\Ricardo\Meus documentos\Domino.Rally.USA.Wii-APATHY(TorrentSpain.com) [mininova].torrent

[2009/08/25 18:13:51 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll

[2009/08/25 18:13:50 | 00,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys

[2009/08/25 18:13:50 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 262 bytes -> C:\WINDOWS\System32\drivers:GbpKmAp.lst

@Alternate Data Stream - 24 bytes -> C:\WINDOWS:8D34975E9892B1DE

< End of report >

OTL Extras logfile created on: 23/9/2009 20:47:25 - Run 1

OTL by OldTimer - Version 3.0.14.0 Folder = C:\Documents and Settings\Ricardo\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy

735,48 Mb Total Physical Memory | 201,11 Mb Available Physical Memory | 27,34% Memory free

1,76 Gb Paging File | 1,10 Gb Available in Paging File | 62,24% Paging File free

Paging file location(s): C:\pagefile.sys 1104 2208 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas

Drive C: | 74,55 Gb Total Space | 40,83 Gb Free Space | 54,77% Space Free | Partition Type: NTFS

Drive D: | 19,07 Gb Total Space | 8,24 Gb Free Space | 43,20% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: VILLALOBOS

Current User Name: Ricardo

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %* File not found

chm.file [open] -- "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)

cmdfile [open] -- "%1" %* File not found

comfile [open] -- "%1" %* File not found

exefile [open] -- "%1" %* File not found

htmlfile [edit] -- "C:\Arquivos de programas\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Arquivos de programas\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- "C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

https [open] -- "C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)

piffile [open] -- "%1" %* File not found

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1" File not found

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S File not found

txtfile [edit] -- Reg Error: Key error.

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Arquivos de programas\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe" = C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

"C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" = C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Arquivos de programas\AVG\AVG8\avgupd.exe" = C:\Arquivos de programas\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)

"C:\Arquivos de programas\AVG\AVG8\avgemc.exe" = C:\Arquivos de programas\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)

"C:\Arquivos de programas\uTorrent\uTorrent.exe" = C:\Arquivos de programas\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpqste08.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hposfx08.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hposid01.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- ()

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpoews01.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe -- (Hewlett-Packard Co.)

"C:\Arquivos de programas\Messenger\msmsgs.exe" = C:\Arquivos de programas\Messenger\msmsgs.exe:*:Enabled:Windows Messenger -- (Microsoft Corporation)

"C:\Arquivos de programas\Soulseek-Test\slsk.exe" = C:\Arquivos de programas\Soulseek-Test\slsk.exe:*:Enabled:SoulSeek -- ()

"C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE" = C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE:*:Disabled:Internet Explorer -- (Microsoft Corporation)

"C:\WINDOWS\system32\rtcshare.exe" = C:\WINDOWS\system32\rtcshare.exe:*:Disabled:Compartilhamento de aplicativo RTC -- (Microsoft Corporation)

"C:\Arquivos de programas\Windows Live\Messenger\msmnsgr.exe" = C:\Arquivos de programas\Windows Live\Messenger\msmnsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)

"C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe" = C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

"C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" = C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)

"C:\Arquivos de programas\Skype\Phone\Skype.exe" = C:\Arquivos de programas\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc

"{084BCE20-5505-4586-8A37-D454E2A6FB09}" = LG PC Suite II

"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp

"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch

"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II

"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Multimedia Launcher

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Ferramenta de Carregamento do Windows Live

"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer

"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg

"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan

"{32BC546A-8AA3-4239-AE92-9CF3291C35A6}" = Windows Live Call

"{350C9416-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant

"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform

"{44B2E182-DD85-45FC-9F51-326B81D7C7F1}" = Fax

"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply

"{51A9E3DD-37B8-47BB-8E67-5B76B3EFBC48}" = Assistente de Conexão do Windows Live

"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features

"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport

"{6059C682-4C5F-4106-8487-943E98225D3B}" = LG MC USB Modem driver

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder

"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{730837D4-FF5E-48DB-BA49-33E732DFF0B3}" = PanoStandAlone

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01

"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player

"{8BFFDBAB-FD81-4137-A98E-A769C828080C}" = BitDefender 8 Free Edition

"{90280416-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional com FrontPage

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant

"{AF145F8997B44EE9B106D018EF1DB58B}" = DivX Converter Mobile

"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B5ED7AB0-3838-4389-8549-7C8E22DD48F4}" = Windows Live Messenger

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player

"{B7FB6B99-C93C-4818-825B-37EF4B64C80C}" = PS_AIO_02_Software

"{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution

"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C14337B6-7777-4643-A0B0-B054EF10F59D}" = c5200_Help

"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver

"{C68BF996-C440-46f5-AFCF-A0CE584AB95C}" = C5200

"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1

"{D25BDCF5-19F6-4d9e-B9C9-273FE81446C4}" = PS_AIO_02_ProductContext

"{D64BC2CF-0F12-47d7-B412-B4F3FD684253}" = HP Photosmart All-In-One Software 9.0

"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm

"{E96DA799-C0DF-44d7-AE41-D8312824B898}" = C5200_doccd

"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox

"{EDA2E9CA-8B7E-4BC0-9B0F-34B299555BF3}" = Retail Virtual EVE

"{EF0D2E55-6FE2-4e35-BE22-A742E85D84E3}" = PS_AIO_02_Software_min

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F2CD4651-F948-467C-B014-71FD981B7F59}" = Windows Live Essentials

"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE

"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status

"18 Wheels of Steel American Long Haul 1.00" = 18 Wheels of Steel American Long Haul 1.00

"7-Zip" = 7-Zip 4.43 beta

"Adobe Acrobat 5.0" = Adobe Acrobat 5.0

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"AVG8Uninstall" = AVG Free 8.5

"Checkers" = Checkers

"Chess" = Chess

"C-Media Audio" = C-Media 3D Audio

"CoreAVC Pro" = CoreAVC Pro (remove only)

"DMX4_is1" = DriverMax 4

"DVD Shrink_is1" = DVD Shrink 3.2

"EPSON Printer and Utilities" = EPSON Printer Software

"ffdshow_is1" = ffdshow [rev 2744] [2009-03-05]

"'Full Speed' Internet Booster + Performance Tests3.4" = 'Full Speed' Internet Booster + Performance Tests

"Gonzo Heads" = Gonzo Heads

"HaaliMkx" = Haali Media Splitter

"Hearts" = Hearts

"HijackThis" = HijackThis 2.0.2

"HP Imaging Device Functions" = HP Imaging Device Functions 9.0

"HP Photosmart Essential" = HP Photosmart Essential 2.01

"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0

"HPExtendedCapabilities" = HP Customer Participation Program 9.0

"HPOCR" = HP OCR Software 9.0

"ie8" = Windows Internet Explorer 8

"ImgBurn" = ImgBurn

"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.9.0

"Laptop Drop" = Laptop Drop

"Mahjongg Master 4" = Mahjongg Master 4

"Mahjongg Master 5" = Mahjongg Master 5

"MediaCoder" = MediaCoder 0.6.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"MV RegClean 5.9_is1" = MV RegClean 5.9

"Nero - Burning Rom!UninstallKey" = Nero OEM

"NeroVision!UninstallKey" = Nero Digital

"PMP Transcoding Tool_is1" = PMP Transcoding Tool 0.5.1.0 For Windows NT/2000/XP

"Poker Palace" = Poker Palace

"Puzzle Master 3" = Puzzle Master 3

"Sexy Poker 5" = Sexy Poker 5

"SiS Compatible VGA V2.12" = SiS Compatible VGA V2.12

"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver

"Solitaire Master 3" = Solitaire Master 3

"Soulseek2" = SoulSeek Client 157 test 12c

"Spades" = Spades

"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20

"VobSub" = VobSub v2.23 (Remove Only)

"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

"WIC" = Windows Imaging Component

"WinAVI Video Converter 9.09.0" = WinAVI Video Converter 9.0

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinLiveSuite_Wave3" = Windows Live Essentials

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-606747145-1993962763-1957994488-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 12/9/2009 17:43:43 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 12/9/2009 17:55:51 | Computer Name = VILLALOBOS | Source = Windows Live Messenger | ID = 1000

Description =

Error - 13/9/2009 20:45:56 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 15/9/2009 00:01:53 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 17/9/2009 17:46:18 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 19/9/2009 18:23:22 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 20/9/2009 17:05:19 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 20/9/2009 22:35:09 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 20/9/2009 22:35:47 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha iexplore.exe, versão 8.0.6001.18702, módulo com

falha hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

Error - 21/9/2009 21:27:43 | Computer Name = VILLALOBOS | Source = Application Hang | ID = 1002

Description = Aplicativo com falha HiJackThis.exe, versão 2.0.0.2, módulo com falha

hungapp, versão 0.0.0.0, endereço com falha 0x00000000.

[ System Events ]

Error - 18/9/2009 18:20:52 | Computer Name = VILLALOBOS | Source = sr | ID = 1

Description = O filtro da restauração do sistema encontrou o erro inesperado '0xC0000001'