[Resolvido] &nbspVirus: Isc.exe

esdrasyave · Julho 21, 2011

De alguns dias pra cá tenho notado que qdo eu entro na net, quase q constantemente fica abrindo janela de sites de propaganda de forma aleatória e casual, do nada msm..

Tenho notado tb q o malware tem bloqueado a ação de um arquivo chamado ISC.EXE q fica na pasta: AppData/../Temp/Isc.exe

Esse mesmo programa está iniciando com o windows, vi isso no msconfig. Alguem poderia me dizer se essas duas coisas tem relação? as janelas de propaganda e o arquivo e cm removê-los

Desde ja meu mto obrigado!

Mário Monteiro · Julho 21, 2011

Leia este topico e siga as instruções

http://forum.imasters.com.br/index.php?/topic/165906-regra-n-02-utilizando-o-hijackthis/

esdrasyave · Julho 26, 2011

Aqui está o Log do Hjack

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:09:59, on 25/07/2011

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Users\ESDRAS\AppData\Local\Temp\Isc.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files (x86)\Control Center\CCenter.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\TIM Web Banda Larga\TIM Web Banda Larga.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\ESDRAS\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\ESDRAS\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=antn&s={searchTerms}&f=4

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: AC-Pro - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\ESDRAS\AppData\Roaming\Complitly\AutocompletePro.dll

O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files (x86)\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.5\bh\BabylonToolbar.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll

O2 - BHO: Qbyrd Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files (x86)\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll

O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll

O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.5\BabylonToolbarTlbr.dll

O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.6\facemoodsTlbr.dll

O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [Control Center] C:\Program Files (x86)\Control Center\CCenter.exe

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKCU\..\Run: [8DDYX0ZBPZ] C:\Users\ESDRAS\AppData\Local\Temp\Isc.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')

O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube Download - C:\Users\ESDRAS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\ESDRAS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll

O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{672112ED-82D3-4A6E-87E0-327EE3B61FAB}: NameServer = 189.40.226.80 189.40.224.5

O17 - HKLM\System\CS1\Services\Tcpip\..\{672112ED-82D3-4A6E-87E0-327EE3B61FAB}: NameServer = 189.40.226.80 189.40.224.5

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - AppInit_DLLs: AnyDiscHelp.dll C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL

O23 - Service: Emsisoft Anti-Malware 5.0 - Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Gerenciador do Google Desktop 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Virtual Disk Service Manager (MSR Service) - Unknown owner - C:\Program Files (x86)\Clarus\Samsung SecretZone\MSSvc.exe

O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files (x86)\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 13953 bytes

Power Max · Julho 26, 2011

:seta: Baixe o ERUNT e salve-o no desktop

*Crie uma pasta em C:\ chamada ERUNT e extraia para ela

*Execute o arquivo C:\ERUNT\ERUNT.exe

*Clique [OK] > [OK] > [sim] > [OK]

2. Sugiro que você salve ou imprima essas instruções abaixo, pois em alguns momentos você poderá precisar usar o computador sem o acesso à internet:

Faça o download do ComboFix

Salve-o no Desktop (área de trabalho).

* Desabilite as proteções residente de: antivírus, antispywares e firewall ( menos o do Windows! )

* Feche todas as janelas e execute a ferramenta.

* Ps: A execução, por comando, também é possível:

* Vá em Iniciar --> Executar --> Digite ou cole:

"%userprofile%\desktop\Combofix.exe" /killall

* Clique em Ok.

* Na solicitação: "Negação de garantia de software" --> Clique em Sim.

* Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo.

* Terminando,clique Sim ou Yes. --> Aguarde.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

:!: Caso aconteça a notificação de: Aplicativo Win32 inválido ou alguma mensagem parecida com esta, delete a ferramenta ComboFix.exe e faça, novamente, seu download.

* Salve-a no Desktop,renomeada como: Kombo.exe

* Ps: Nomeie durante o salvamento,e não após salvá-la!

* Ps: Surgindo alguma mensagem de erro, rode o ComboFix.exe em "Modo Seguro". <-- Link!

* Ps: Na presença de atividades rootkit,teremos a seguinte janela de notificação:

* Ps: Anote essas detecções, e dê o OK. Neste caso poste estas detecções que você terá anotado em sua próxima resposta juntamente com os logs pedidos.

* Ps: Para completar as remoções, talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

* Ps: Para evitar problemas, siga todas as recomendações propostas.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

* Abrir-se-á a janela Auto Scan. --> Aguarde!

* Para finalizar remoções, o ComboFix poderá reiniciar o computador.

* Se houver necessidade, digite a opção ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

* Durante o scan, evite manusear o mouse ou teclado! <-- Importante!

* Caso, por algum motivo de força maior, precise parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter.

<><><><><><><><><><><><>

Poste o log do Combofix que estará em C:\ComboFix.txt juntamente com um novo log do Hijackthis em sua próxima resposta e nos diga como está o seu PC depois disto.

Ficamos no aguardo.

esdrasyave · Julho 28, 2011

LOG DO COMBOFIX

ComboFix 11-07-27.03 - ESDRAS 28/07/2011 19:53:33.1.4 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.55.1046.18.3893.2473 [GMT -3:00]

Executando de: c:\users\ESDRAS\Desktop\Combofix.exe

Comandos utilizados :: /killall

AV: ESET Smart Security 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

FW: Firewall pessoal do ESET *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

SP: ESET Smart Security 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Criado um novo ponto de restauração

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\facemoods.com

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoods.crx

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoods.png

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoodsApp.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoodsEng.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoodsTlbr.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\uninstall.exe

c:\program files (x86)\facemoods.com\sqlite3.dll

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ar-SA\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ar-SA\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\cs-cz\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\cs-cz\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\da-dk\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\da-dk\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\de-DE\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\de-DE\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\el-gr\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\el-gr\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\es-es\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\es-es\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\fi-fi\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\fi-fi\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\fr-FR\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\fr-FR\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\he-IL\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\he-IL\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\hu-hu\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\hu-hu\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\it-it\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\it-it\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ja-jp\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ja-jp\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ko-kr\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ko-kr\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\nb-no\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\nb-no\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\nl-NL\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\nl-NL\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\pl-pl\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\pl-pl\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\pt-br\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\pt-br\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\pt-pt\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\pt-pt\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ru-RU\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\ru-RU\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\sv-se\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\sv-se\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\tr-tr\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\tr-tr\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\zh-cn\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\zh-cn\Desktop_2.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\zh-tw\Desktop_1.ini

c:\program files (x86)\Mozilla Firefox\ControlCenter 64\zh-tw\Desktop_2.ini

c:\programdata\Amazon.ico

c:\programdata\BeRuby.ico

c:\programdata\MercadoLivre.ico

c:\programdata\QuickStores.ico

c:\users\ESDRAS\AppData\Local\Microsoft\Windows\Temporary Internet Files\{6D4F644F-7BB8-4264-9C85-D7BBC36F32D5}.xps

c:\users\ESDRAS\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7EDBD5FE-CF69-4C18-857C-2088A197EE44}.xps

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\wpcap.dll

d:\drive cce\ControlCenter 64\ar-SA\Desktop_1.ini

d:\drive cce\ControlCenter 64\ar-SA\Desktop_2.ini

d:\drive cce\ControlCenter 64\cs-cz\Desktop_1.ini

d:\drive cce\ControlCenter 64\cs-cz\Desktop_2.ini

d:\drive cce\ControlCenter 64\da-dk\Desktop_1.ini

d:\drive cce\ControlCenter 64\da-dk\Desktop_2.ini

d:\drive cce\ControlCenter 64\de-DE\Desktop_1.ini

d:\drive cce\ControlCenter 64\de-DE\Desktop_2.ini

d:\drive cce\ControlCenter 64\el-gr\Desktop_1.ini

d:\drive cce\ControlCenter 64\el-gr\Desktop_2.ini

d:\drive cce\ControlCenter 64\es-es\Desktop_1.ini

d:\drive cce\ControlCenter 64\es-es\Desktop_2.ini

d:\drive cce\ControlCenter 64\fi-fi\Desktop_1.ini

d:\drive cce\ControlCenter 64\fi-fi\Desktop_2.ini

d:\drive cce\ControlCenter 64\fr-FR\Desktop_1.ini

d:\drive cce\ControlCenter 64\fr-FR\Desktop_2.ini

d:\drive cce\ControlCenter 64\he-IL\Desktop_1.ini

d:\drive cce\ControlCenter 64\he-IL\Desktop_2.ini

d:\drive cce\ControlCenter 64\hu-hu\Desktop_1.ini

d:\drive cce\ControlCenter 64\hu-hu\Desktop_2.ini

d:\drive cce\ControlCenter 64\it-it\Desktop_1.ini

d:\drive cce\ControlCenter 64\it-it\Desktop_2.ini

d:\drive cce\ControlCenter 64\ja-jp\Desktop_1.ini

d:\drive cce\ControlCenter 64\ja-jp\Desktop_2.ini

d:\drive cce\ControlCenter 64\ko-kr\Desktop_1.ini

d:\drive cce\ControlCenter 64\ko-kr\Desktop_2.ini

d:\drive cce\ControlCenter 64\nb-no\Desktop_1.ini

d:\drive cce\ControlCenter 64\nb-no\Desktop_2.ini

d:\drive cce\ControlCenter 64\nl-NL\Desktop_1.ini

d:\drive cce\ControlCenter 64\nl-NL\Desktop_2.ini

d:\drive cce\ControlCenter 64\pl-pl\Desktop_1.ini

d:\drive cce\ControlCenter 64\pl-pl\Desktop_2.ini

d:\drive cce\ControlCenter 64\pt-br\Desktop_1.ini

d:\drive cce\ControlCenter 64\pt-br\Desktop_2.ini

d:\drive cce\ControlCenter 64\pt-pt\Desktop_1.ini

d:\drive cce\ControlCenter 64\pt-pt\Desktop_2.ini

d:\drive cce\ControlCenter 64\ru-RU\Desktop_1.ini

d:\drive cce\ControlCenter 64\ru-RU\Desktop_2.ini

d:\drive cce\ControlCenter 64\sv-se\Desktop_1.ini

d:\drive cce\ControlCenter 64\sv-se\Desktop_2.ini

d:\drive cce\ControlCenter 64\tr-tr\Desktop_1.ini

d:\drive cce\ControlCenter 64\tr-tr\Desktop_2.ini

d:\drive cce\ControlCenter 64\zh-cn\Desktop_1.ini

d:\drive cce\ControlCenter 64\zh-cn\Desktop_2.ini

d:\drive cce\ControlCenter 64\zh-tw\Desktop_1.ini

d:\drive cce\ControlCenter 64\zh-tw\Desktop_2.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_npf

.

(((((((((((((((( Arquivos/Ficheiros criados de 2011-06-28 to 2011-07-28 ))))))))))))))))))))))))))))

.

2011-07-28 23:14 . 2011-07-28 23:14 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-27 21:53 . 2011-07-27 21:53 -------- d-----w- C:\Erunt

2011-07-26 04:57 . 2011-07-26 04:58 -------- d-----w- c:\users\ESDRAS\AppData\Roaming\Auslogics

2011-07-26 04:56 . 2011-07-26 04:56 -------- d-----w- c:\program files (x86)\Auslogics

2011-07-26 02:00 . 2011-07-26 02:00 -------- d-----w- C:\ROSA DE SARON

2011-07-24 16:12 . 2011-07-24 16:12 -------- d-----w- C:\Amar ao próximo_livrinho

2011-07-17 14:43 . 2011-07-17 14:43 -------- dc-h--w- c:\programdata\{D69A48BF-7653-4AA8-94BC-5847522A4573}

2011-07-17 14:42 . 2011-07-17 14:42 -------- d-----w- c:\program files (x86)\Common Files\Digidesign

2011-07-17 14:42 . 2011-07-17 14:42 -------- d-----w- c:\programdata\Native Instruments

2011-07-17 14:42 . 2011-07-17 14:42 -------- dc-h--w- c:\programdata\{0CC51CB2-911C-40BB-BC1B-BD3CAC590222}

2011-07-17 14:41 . 2011-07-17 14:41 -------- dc-h--w- c:\programdata\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}

2011-07-17 14:41 . 2011-07-17 14:42 -------- d-----w- c:\program files\Common Files\Native Instruments

2011-07-17 14:41 . 2011-07-17 14:42 -------- d-----w- c:\program files\Native Instruments

2011-07-17 14:37 . 2011-07-17 14:37 -------- d-----w- c:\users\ESDRAS\AppData\Roaming\Publish Providers

2011-07-17 14:34 . 2011-07-17 14:34 -------- d-----w- c:\programdata\Sony

2011-07-17 14:34 . 2011-07-17 14:34 -------- d-----w- c:\program files\Sony

2011-07-16 01:38 . 2011-07-16 01:38 -------- d-----w- c:\users\ESDRAS\AppData\Local\Unity

2011-07-13 15:42 . 2011-06-20 18:56 611603720 ----a-w- C:\CorelDRAWGraphicsSuiteX5Installer_EN.exe

2011-07-13 13:15 . 2011-07-13 13:15 115712 --sha-r- c:\windows\SysWow64\cryptxmlb.dll

2011-07-12 12:42 . 2011-07-12 12:42 -------- d-----w- c:\program files (x86)\Reg Organizer

2011-07-12 12:42 . 2011-07-12 12:43 -------- d-----w- c:\program files (x86)\Full Uninstall

2011-07-12 12:22 . 2011-06-20 11:57 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B943D56E-7A81-4E09-BE0D-B5376A2E0137}\mpengine.dll

2011-07-08 17:52 . 2011-07-17 14:37 -------- d-----w- c:\users\ESDRAS\AppData\Roaming\Sony

2011-07-08 17:51 . 2011-07-08 17:52 -------- d-----w- c:\users\ESDRAS\AppData\Local\Sony

2011-07-07 21:29 . 2011-07-07 21:29 34304 ----a-r- c:\users\ESDRAS\AppData\Roaming\Microsoft\Installer\{AEEB3643-71DE-414d-9E3F-1159177FE211}\misc.exe.D0DF3458_A845_11D3_8D0A_0050046416B9.exe

2011-07-05 13:25 . 2011-07-17 21:06 -------- d-----w- C:\Niver - Esdras

2011-06-29 16:07 . 2011-05-24 11:42 404480 ----a-w- c:\windows\system32\umpnpmgr.dll

2011-06-29 16:07 . 2011-05-24 10:37 252928 ----a-w- c:\windows\SysWow64\drvinst.exe

2011-06-29 16:07 . 2011-05-24 10:40 64512 ----a-w- c:\windows\SysWow64\devobj.dll

2011-06-29 16:07 . 2011-05-24 10:40 44544 ----a-w- c:\windows\SysWow64\devrtl.dll

2011-06-29 16:07 . 2011-05-24 10:39 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-07-06 22:52 . 2011-03-12 05:14 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-07-06 22:52 . 2011-03-12 05:14 25912 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-28 13:12 . 2011-06-06 22:15 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-06-08 12:43 . 2011-06-08 12:43 0 ---ha-w- c:\users\ESDRAS\AppData\Local\BITB281.tmp

2011-06-03 05:57 . 2011-07-13 12:47 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2011-05-24 22:14 . 2011-02-19 02:35 270720 ------w- c:\windows\system32\MpSigStub.exe

2011-05-13 15:13 . 2011-05-13 15:13 0 ---ha-w- c:\users\ESDRAS\AppData\Local\BITEB0F.tmp

2011-05-03 15:03 . 2011-04-19 22:06 78848 ----a-w- c:\windows\KMSEmulator.exe

2011-05-03 05:29 . 2011-06-17 00:28 976896 ----a-w- c:\windows\system32\inetcomm.dll

2011-05-03 04:30 . 2011-06-17 00:28 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll

2010-01-26 13:11 . 2011-03-11 23:20 444283 ----a-w- c:\program files (x86)\Common Files\WinPcapNmap.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por padrão não são apresentadas.

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-03-10 1395664]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2010-04-27 13:08 2393184 ----a-w- c:\program files (x86)\DVDVideoSoftTB\tbDVDV.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-03-10 22:33 1395664 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-03-10 1395664]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-12-21 1483264]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Control Center"="c:\program files (x86)\Control Center\CCenter.exe" [2010-04-27 800256]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-20 136176]

R2 MSR Service;Virtual Disk Service Manager;c:\program files (x86)\Clarus\Samsung SecretZone\MSSvc.exe [2010-03-13 114688]

R3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2011-02-20 85800]

R3 FLASHSYS;FLASHSYS; [x]

R3 GoogleDesktopManager-051210-111108;Gerenciador do Google Desktop 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-02-19 30192]

R3 gupdatem;Serviço do Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-20 136176]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]

R3 MsibiosDevice;MsibiosDevice; [x]

R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [x]

R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [x]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

R3 WatAdminSvc;Serviço de Tecnologias de Ativação do Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S0 tpsacpi;TPS Firmware Extension Device Driver;c:\windows\system32\DRIVERS\tpsacpi.SYS [x]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-07-26 3029208]

S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x]

S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]

S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-01-12 810144]

S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]

S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2009-07-17 4948992]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

Conteúdo da pasta 'Tarefas Agendadas'

.

2011-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-20 16:26]

.

2011-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-20 16:26]

.

2011-07-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4107228167-2851879655-1333348234-1000Core.job

- c:\users\ESDRAS\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-10 19:11]

.

2011-07-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4107228167-2851879655-1333348234-1000UA.job

- c:\users\ESDRAS\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-10 19:11]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"combofix"="c:\combofix\CF3516.cfxxe" [X]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]

"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2918656]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-10 8321568]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

IE: &Enviar para o OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: E&xportar para o Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\ESDRAS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\ESDRAS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

FF - ProfilePath - c:\users\ESDRAS\AppData\Roaming\Mozilla\Firefox\Profiles\kr2a4tqd.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=10813

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.gmail.com

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=

FF - prefs.js: network.proxy.http - proxy.ufc..br

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.type - 0

.

------- Associação de arquivos/ficheiros -------

.

.txt=Word Reader-TXT

.

- - - - ORFÃOS REMOVIDOS - - - -

.

BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll

Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\facemoodsTlbr.dll

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.6\uninstall.exe

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)