ieca 0 Denunciar post Postado Setembro 21, 2011 Bom dia, nao consigo usar minha senha do bb na internet. Ja fui ao banco e fiz o desbloqueio. A moça falou q se eu n to conseguindo usar é por causa de virus. Alguém pode me ajudar? Segue meu log. Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 08:11:06, on 21/09/2011 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v8.00 (8.00.7601.17514) Boot mode: Normal Running processes: C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe C:\PROGRA~1\GbPlugin\GbpSv.exe C:\Windows\system32\svchost.exe c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe C:\Windows\system32\wuauclt.exe C:\Program Files\VIVO ZAP\VIVO ZAP.exe C:\Windows\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\HijackThis\HiJackThis.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\svchost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&mntrId=760238ee000000000000000000000000&tlver=1.4.19.19&ss=1&affID=17394 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=760238ee000000000000000000000000&tlver=1.4.19.19&ss=1&affID=17394 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {12fc3d37-2a42-4fe3-8489-81296878cba5} - (no file) R3 - URLSearchHook: (no name) - {e0301295-ab3e-4af3-979f-3d453c5f9f48} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files\GbPlugin\gbieh.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll O15 - Trusted Zone: www.bancobrasil.com.br O15 - Trusted Zone: www14.bancobrasil.com.br O15 - Trusted Zone: www2.bancobrasil.com.br O15 - Trusted Zone: www.bb.com.br O17 - HKLM\System\CCS\Services\Tcpip\..\{47E39A1D-6C3C-43F9-9E66-7FD11123F2A3}: NameServer = 200.220.227.57 200.142.132.32 O17 - HKLM\System\CCS\Services\Tcpip\..\{DE52D955-BE2D-40E6-AC7D-7EE244C13FAB}: NameServer = 200.220.227.56 200.142.130.202 O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O20 - Winlogon Notify: GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~1\GbPlugin\GbpSv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe -- End of file - 6864 bytes Grata Compartilhar este post Link para o post Compartilhar em outros sites
wings 22 Denunciar post Postado Setembro 21, 2011 Olá ieca 1. *Baixe o Bankerfix e salve-o no desktop *Clique com o botão direito do mouse no bankerfix e selecione "Executar como administrador", clique [OK] > [sIM] (se pedir alguma atualização) > [OK] > [ENTER] *Ao finalizar, tecle [ENTER] *Cole o relatório C:\LinhaDefensiva\relatorio.txt 2. *Baixe o MalwareBytes,instale o programa e aguarde a atualização *O programa será aberto automaticamente *Na aba [Verificação], selecione [Verificação completa] *Clique [Verificar] e selecione a partição onde o Windows está instalado *Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados] > [Remover Selecionados] *Cole o relatório apresentado Caso já tenhas o Malwarebytes instalado.... *Abra o Malwarebytes, clique [Atualização] > [baixar Atualizações] *Na aba [Verificação], selecione [x] Verificação completa *Clique [Verificar] e selecione a partição onde o Windows está instalado *Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados] > [Remover Selecionados] *Cole o relatório apresentado Compartilhar este post Link para o post Compartilhar em outros sites
ieca 0 Denunciar post Postado Setembro 21, 2011 Epa, aqui está. BankerFix BankerFix 3.1 VALKYRIE - Removedor de Bankers Linha Defensiva | http://www.linhadefensiva.org http://www.linhadefensiva.org/bankerfix/ ------------------------------------------------------- Data: 2011-09-21 - 08:30 ------------------------------------------------------- Lista de Definição: 2011-08-28-1 | CORE: 2010-12-28-6 ======================================================= ----- Fim ------------------------- Malware Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Versão da Base de Dados: 7624 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 21/09/2011 13:53:25 mbam-log-2011-09-21 (13-53-24).txt Tipo de Verificação: Verificação Completa (C:\|) Objetos escaneados: 248054 Tempo decorrido: 47 minuto(s), 2 segundo(s) Processos de Memória Infectados: 0 Módulos de Memória Infectados: 0 Chaves de Registro Infectadas: 0 Valores de Registro Infectados: 0 Itens de Dados no Registro Infectados: 0 Pastas Infectadas: 0 Arquivos Infectados: 0 Processos de Memória Infectados: (Não foram detectados ítens maliciosos) Módulos de Memória Infectados: (Não foram detectados ítens maliciosos) Chaves de Registro Infectadas: (Não foram detectados ítens maliciosos) Valores de Registro Infectados: (Não foram detectados ítens maliciosos) Itens de Dados no Registro Infectados: (Não foram detectados ítens maliciosos) Pastas Infectadas: (Não foram detectados ítens maliciosos) Arquivos Infectados: (Não foram detectados ítens maliciosos) Grata Compartilhar este post Link para o post Compartilhar em outros sites
wings 22 Denunciar post Postado Setembro 21, 2011 *Baixe o OTS e salve-o no desktop *Execute-o e selecione as opções: Scan All Users Use Company Name WhiteList Skip Microsoft Files *Em Additional Scans selecione: File - Lop Check File - Purity Scan *Selecione, copie, e cole o código no espaço abaixo de Custom Scans: %ALLUSERSPROFILE%\*.* %ALLUSERSPROFILE%\Dados de aplicativos\* %ALLUSERSPROFILE%\Dados de aplicativos\*.* %ALLUSERSPROFILE%\Menu Iniciar\Programas\Inicializar\*.* %APPDATA%\* %APPDATA%\*.* %LOCALAPPDATA%\*.* %SYSTEMDRIVE%\* %SYSTEMDRIVE%\*.* %USERPROFILE%\*.* CREATERESTOREPOINT *Clique [Run Scan] *Cole o relatório apresentado Caso o relatório fique demasiadamente grande... *Acesse este link *Clique [Enviar arquivo] *Localize o arquivo OTS.txt no desktop *Clique [Abrir] > [Créer le lien Cjoint] *Cole o endereço criado Compartilhar este post Link para o post Compartilhar em outros sites
ieca 0 Denunciar post Postado Setembro 21, 2011 La vai... OTS logfile created on: 21/09/2011 19:57:58 - Run 3 OTS by OldTimer - Version 3.1.44.6 Folder = C:\Users\Zita\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 139,99 Gb Total Space | 66,93 Gb Free Space | 47,81% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 12,36 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ZITA-PC Current User Name: Zita Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: On File Age = 30 Days [Processes - Safe List] ots.exe -> C:\Users\Zita\Desktop\OTS.exe -> [2011/09/21 19:52:48 | 000,646,656 | ---- | M] (OldTimer Tools) gbpsv.exe -> C:\Program Files\GbPlugin\GbpSv.exe -> [2011/08/08 11:23:18 | 000,208,672 | ---- | M] ( ) vivo zap.exe -> C:\Program Files\VIVO ZAP\VIVO ZAP.exe -> [2011/03/13 08:31:46 | 000,110,592 | ---- | M] () explorer.exe -> C:\Windows\explorer.exe -> [2011/02/25 02:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) msseces.exe -> C:\Program Files\Microsoft Security Client\msseces.exe -> [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) taskhost.exe -> C:\Windows\System32\taskhost.exe -> [2010/11/20 09:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) nissrv.exe -> c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -> [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) msmpeng.exe -> c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -> [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) tosbtsrv.exe -> C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -> [2007/02/25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Modules - No Company Name] ppgooglenaclpluginchrome.dll -> C:\Users\Zita\AppData\Local\Google\Chrome\Application\14.0.835.186\ppgooglenaclpluginchrome.dll -> [2011/09/20 00:07:39 | 000,412,728 | ---- | M] () pdf.dll -> C:\Users\Zita\AppData\Local\Google\Chrome\Application\14.0.835.186\pdf.dll -> [2011/09/20 00:07:37 | 003,696,184 | ---- | M] () avutil-51.dll -> C:\Users\Zita\AppData\Local\Google\Chrome\Application\14.0.835.186\avutil-51.dll -> [2011/09/20 00:06:11 | 000,142,568 | ---- | M] () avformat-53.dll -> C:\Users\Zita\AppData\Local\Google\Chrome\Application\14.0.835.186\avformat-53.dll -> [2011/09/20 00:06:10 | 000,253,320 | ---- | M] () avcodec-53.dll -> C:\Users\Zita\AppData\Local\Google\Chrome\Application\14.0.835.186\avcodec-53.dll -> [2011/09/20 00:06:09 | 002,403,240 | ---- | M] () gcswf32.dll -> C:\Users\Zita\AppData\Local\Google\Chrome\Application\14.0.835.186\gcswf32.dll -> [2011/09/19 21:32:41 | 006,338,720 | ---- | M] () office.odf -> C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF -> [2011/03/15 07:13:46 | 004,254,560 | ---- | M] () vivo zap.exe -> C:\Program Files\VIVO ZAP\VIVO ZAP.exe -> [2011/03/13 08:31:46 | 000,110,592 | ---- | M] () viewerps.dll -> C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll -> [2010/09/22 21:12:20 | 000,016,832 | ---- | M] () rarext.dll -> C:\Program Files\WinRAR\RarExt.dll -> [2010/03/15 11:28:24 | 000,141,824 | ---- | M] () localemgrplugin.dll -> C:\Program Files\VIVO ZAP\LocaleMgrPlugin.dll -> [2008/09/11 18:33:04 | 000,135,168 | ---- | M] () smsplugin.dll -> C:\Program Files\VIVO ZAP\SMSPlugin.dll -> [2008/09/11 18:32:28 | 000,151,552 | ---- | M] () notifyserviceplugin.dll -> C:\Program Files\VIVO ZAP\NotifyServicePlugin.dll -> [2008/09/11 18:31:42 | 000,032,768 | ---- | M] () configfileplugin.dll -> C:\Program Files\VIVO ZAP\ConfigFilePlugin.dll -> [2008/09/11 18:29:54 | 000,057,344 | ---- | M] () devicemgrplugin.dll -> C:\Program Files\VIVO ZAP\DeviceMgrPlugin.dll -> [2008/09/11 18:28:52 | 000,102,400 | ---- | M] () netinfoplugin.dll -> C:\Program Files\VIVO ZAP\NetInfoPlugin.dll -> [2008/09/11 18:27:04 | 000,098,304 | ---- | M] () dialupplugin.dll -> C:\Program Files\VIVO ZAP\DialUpPlugin.dll -> [2008/09/11 18:25:14 | 000,086,016 | ---- | M] () devicemgruiplugin.dll -> C:\Program Files\VIVO ZAP\DeviceMgrUIPlugin.dll -> [2008/09/11 18:24:14 | 000,155,648 | ---- | M] () ndisapi.dll -> C:\Program Files\VIVO ZAP\NDISAPI.dll -> [2008/09/11 18:19:24 | 000,651,264 | ---- | M] () detectdev.dll -> C:\Program Files\VIVO ZAP\DetectDev.dll -> [2008/01/25 12:41:36 | 000,139,264 | ---- | M] () atcomm.dll -> C:\Program Files\VIVO ZAP\atcomm.dll -> [2008/01/25 12:41:28 | 000,491,520 | ---- | M] () deviceoperate.dll -> C:\Program Files\VIVO ZAP\DeviceOperate.dll -> [2008/01/17 12:57:46 | 000,045,056 | ---- | M] () xcodec.dll -> C:\Program Files\VIVO ZAP\XCodec.dll -> [2008/01/17 12:57:24 | 000,041,472 | ---- | M] () isaputrace.dll -> C:\Program Files\VIVO ZAP\isaputrace.dll -> [2007/08/23 17:39:30 | 000,014,848 | ---- | M] () filemanager.dll -> C:\Program Files\VIVO ZAP\FileManager.dll -> [2007/07/31 16:50:04 | 000,090,112 | ---- | M] () atiacmxx.dll -> C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll -> [2007/03/02 10:44:34 | 000,073,728 | ---- | M] () [Win32 Services - Safe List] (GbpSv) Gbp Service [unknown | Running] -> C:\Program Files\GbPlugin\GbpSv.exe -> [2011/08/08 11:23:18 | 000,208,672 | ---- | M] ( ) (WatAdminSvc) WatAdminSvc [unknown | Stopped] -> C:\Windows\System32\Wat\WatAdminSvc.exe -> [2011/01/19 22:06:37 | 001,343,400 | ---- | M] () (NisSrv) Microsoft Network Inspection [On_Demand | Running] -> c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -> [2010/11/11 12:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) (MsMpSvc) Microsoft Antimalware Service [Auto | Running] -> c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -> [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) (Microsoft SharePoint Workspace Audit Service) Microsoft SharePoint Workspace Audit Service [On_Demand | Stopped] -> C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -> [2010/03/25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) (SensrSvc) Adaptive Brightness [On_Demand | Stopped] -> C:\Windows\System32\sensrsvc.dll -> [2009/07/13 22:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) (PeerDistSvc) BranchCache [On_Demand | Stopped] -> C:\Windows\System32\PeerDistSvc.dll -> [2009/07/13 22:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) (WinDefend) Windows Defender [On_Demand | Stopped] -> C:\Program Files\Windows Defender\MpSvc.dll -> [2009/07/13 22:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) (TOSHIBA Bluetooth Service) TOSHIBA Bluetooth Service [Auto | Running] -> C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -> [2007/02/25 21:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Driver Services - Safe List] (MpKsl74e4f04a) MpKsl74e4f04a [Kernel | System | Running] -> c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F5A97ACF-2377-41A9-945A-146C63664E9D}\MpKsl74e4f04a.sys -> [2011/09/21 10:24:22 | 000,028,752 | ---- | M] (Microsoft Corporation) (GbpKm) Gbp KernelMode [Kernel | Boot | Running] -> C:\Windows\system32\drivers\gbpkm.sys -> [2011/08/08 11:23:42 | 000,044,064 | ---- | M] (GAS Tecnologia) (vmbus) Virtual Machine Bus [Kernel | Boot | Running] -> C:\Windows\system32\drivers\vmbus.sys -> [2010/11/20 09:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) (storflt) Disk Virtual Machine Bus Acceleration Filter Driver [Kernel | Boot | Running] -> C:\Windows\system32\drivers\vmstorfl.sys -> [2010/11/20 09:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) (storvsc) storvsc [Kernel | On_Demand | Stopped] -> C:\Windows\system32\drivers\storvsc.sys -> [2010/11/20 09:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) (TsUsbFlt) TsUsbFlt [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\TsUsbFlt.sys -> [2010/11/20 07:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) (RdpVideoMiniport) Remote Desktop Video Miniport Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\rdpvideominiport.sys -> [2010/11/20 07:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) (WinUsb) WinUsb [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\winusb.sys -> [2010/11/20 06:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) (VMBusHID) VMBusHID [Kernel | On_Demand | Stopped] -> C:\Windows\system32\drivers\VMBusHID.sys -> [2010/11/20 06:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) (s3cap) s3cap [Kernel | On_Demand | Stopped] -> C:\Windows\system32\drivers\vms3cap.sys -> [2010/11/20 06:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) (NisDrv) Microsoft Network Inspection System [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\NisDrvWFP.sys -> [2010/10/24 21:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) (MpNWMon) Microsoft Malware Protection Network Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\MpNWMon.sys -> [2010/10/24 21:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) (Btcsrusb) Bluetooth USB For Bluetooth Service [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\btcusb.sys -> [2010/01/04 09:31:48 | 000,035,848 | ---- | M] (IVT Corporation.) (NMgamingmsFltr) USB Optical Mouse [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\NMgamingms.sys -> [2009/07/24 08:56:16 | 000,009,472 | ---- | M] (Primax Ltd) (netw5v32) Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\netw5v32.sys -> [2009/07/13 19:02:51 | 004,231,168 | ---- | M] (Intel Corporation) (hwdatacard) Huawei DataCard USB Modem and USB Serial [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\ewusbmdm.sys -> [2008/03/17 12:05:30 | 000,101,632 | R--- | M] (Huawei Technologies Co., Ltd.) (atikmdag) atikmdag [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\atikmdag.sys -> [2007/11/28 13:35:36 | 002,591,232 | ---- | M] (ATI Technologies Inc.) (ti21sony) ti21sony [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\ti21sony.sys -> [2007/11/28 13:35:12 | 000,812,544 | ---- | M] (Texas Instruments) (R5U870FLx86) R5U870 UVC Lower Filter [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\R5U870FLx86.sys -> [2007/11/27 16:18:04 | 000,073,472 | ---- | M] (Ricoh) (R5U870FUx86) R5U870 UVC Upper Filter [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\R5U870FUx86.sys -> [2007/11/27 16:18:04 | 000,043,904 | ---- | M] (Ricoh) (SFEP) Sony Firmware Extension Parser [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\SFEP.sys -> [2007/08/03 04:36:10 | 000,009,344 | ---- | M] (Sony Corporation) (Tosrfusb) Bluetooth USB Controller [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\tosrfusb.sys -> [2007/04/24 19:36:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) (tosrfbd) Bluetooth RFBUS [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\tosrfbd.sys -> [2007/04/24 13:20:06 | 000,113,920 | ---- | M] (TOSHIBA CORPORATION) (Tosrfhid) Bluetooth RFHID [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\Tosrfhid.sys -> [2007/03/01 16:53:12 | 000,073,728 | ---- | M] (TOSHIBA Corporation.) (TosRfSnd) Bluetooth Audio [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\TosRfSnd.sys -> [2007/01/22 10:43:26 | 000,053,376 | ---- | M] (TOSHIBA Corporation) (tosrfbnp) Bluetooth RFBNEP [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\tosrfbnp.sys -> [2006/11/20 17:55:16 | 000,036,480 | ---- | M] (TOSHIBA Corporation) (tosporte) Bluetooth COM Port [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\tosporte.sys -> [2006/10/10 19:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) (Tosrfcom) Bluetooth RFCOMM [Kernel | System | Running] -> C:\Windows\System32\drivers\tosrfcom.sys -> [2005/08/01 16:45:00 | 000,064,896 | ---- | M] (TOSHIBA Corporation) (tosrfnds) Bluetooth Personal Area Network [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\tosrfnds.sys -> [2005/01/06 13:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Registry - Safe List] < Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=760238ee000000000000000000000000&tlver=1.4.19.19&ss=1&affID=17394 -> < Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> < Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> < Internet Explorer Settings [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\] > -> -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: Main\\"Start Page" -> http://search.babylon.com/?babsrc=HP_ss&mntrId=760238ee000000000000000000000000&tlver=1.4.19.19&ss=1&affID=17394 -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: Main\\"Start Page Redirect Cache" -> http://br.msn.com/?ocid=iehp -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: Main\\"Start Page Redirect Cache AcceptLangs" -> pt-br -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: Main\\"Start Page Redirect Cache_TIMESTAMP" -> 59 7A C4 8C A8 32 CC 01 [binary data] -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: URLSearchHooks\\"{12fc3d37-2a42-4fe3-8489-81296878cba5}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: URLSearchHooks\\"{e0301295-ab3e-4af3-979f-3d453c5f9f48}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\: "ProxyEnable" -> 0 -> < FireFox Settings [Prefs.js] > -> C:\Users\Zita\AppData\Roaming\Mozilla\FireFox\Profiles\joav621b.default\prefs.js -> browser.search.selectedEngine -> "Search the web (Babylon)" -> browser.startup.homepage -> "http://br.msn.com/" -> extensions.enabledItems -> engine@conduit.com:3.2.5.2 -> extensions.enabledItems -> {12fc3d37-2a42-4fe3-8489-81296878cba5}:3.2.5.2 -> extensions.enabledItems -> {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 -> extensions.enabledItems -> {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6 -> extensions.enabledItems -> {87F8774F-B485-47E2-A755-A40A8A5E886C}:1.0.18.2 -> keyword.URL -> "http://search.babylon.com/?babsrc=toolbar2&q=" -> < FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla < FireFox Extensions [user Folders] > -> -> C:\Users\Zita\AppData\Roaming\Mozilla\Extensions -> [2011/03/01 21:14:50 | 000,000,000 | ---D | M] -> C:\Users\Zita\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org -> [2011/03/01 21:14:50 | 000,000,000 | ---D | M] -> C:\Users\Zita\AppData\Roaming\Mozilla\Firefox\Profiles\joav621b.default\extensions -> [2011/08/17 03:11:03 | 000,000,000 | ---D | M] Softonic_Brasil Community Toolbar -> C:\Users\Zita\AppData\Roaming\Mozilla\Firefox\Profiles\joav621b.default\extensions\{12fc3d37-2a42-4fe3-8489-81296878cba5} -> [2011/08/17 03:10:24 | 000,000,000 | ---D | M] Image Zoom -> C:\Users\Zita\AppData\Roaming\Mozilla\Firefox\Profiles\joav621b.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68} -> [2011/03/21 06:22:09 | 000,000,000 | ---D | M] Modulo de Seguranca - Banco do Brasil SA -> C:\Users\Zita\AppData\Roaming\Mozilla\Firefox\Profiles\joav621b.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E886C} -> [2011/08/17 03:11:03 | 000,000,000 | ---D | M] -> C:\Users\Zita\AppData\Roaming\Mozilla\Firefox\Profiles\joav621b.default\extensions\engine@conduit.com -> [2011/05/24 23:11:13 | 000,000,000 | ---D | M] < FireFox SearchPlugins [user Folders] > -> < HOSTS File > ([2011/09/21 08:31:27 | 000,000,698 | ---- | M] - 19 lines) -> C:\Windows\System32\drivers\etc\hosts -> Reset Hosts 127.0.0.1 localhost < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} [HKLM] -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [Groove GFS Browser Helper] -> [2010/03/25 10:25:22 | 004,222,864 | ---- | M] (Microsoft Corporation) {B4F3A835-0E21-4959-BA22-42B3008E02FF} [HKLM] -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [Office Document Cache Handler] -> [2010/02/28 02:20:14 | 000,561,552 | ---- | M] (Microsoft Corporation) {C41A1C0E-EA6C-11D4-B1B8-444553540000} [HKLM] -> C:\Program Files\GbPlugin\gbieh.dll [GbIehObj Class] -> [2011/09/15 09:25:56 | 001,719,584 | ---- | M] (Banco do Brasil) < Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found < Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\] > -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\"{12FC3D37-2A42-4FE3-8489-81296878CBA5}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found WebBrowser\\"{E0301295-AB3E-4AF3-979F-3D453C5F9F48}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found < RunOnce [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> "mctadmin" -> C:\Windows\System32\mctadmin.exe [C:\Windows\System32\mctadmin.exe] -> [2009/07/13 22:14:23 | 000,093,696 | ---- | M] (Microsoft Corporation) < RunOnce [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> "mctadmin" -> C:\Windows\System32\mctadmin.exe [C:\Windows\System32\mctadmin.exe] -> [2009/07/13 22:14:23 | 000,093,696 | ---- | M] (Microsoft Corporation) < CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> < CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"ConsentPromptBehaviorAdmin" -> [5] -> File not found \\"ConsentPromptBehaviorUser" -> [3] -> File not found \\"EnableLUA" -> [0] -> File not found HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000] > -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [145] -> File not found < Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\] > -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\Software\Microsoft\Internet Explorer\MenuExt\ -> &Enviar para o OneNote -> C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll [res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105] -> [2010/02/28 04:41:04 | 000,643,472 | ---- | M] (Microsoft Corporation) E&xportar para o Microsoft Excel -> C:\Program Files\Microsoft Office\Office14\EXCEL.EXE [res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000] -> [2011/03/16 23:26:08 | 020,759,392 | ---- | M] (Microsoft Corporation) < Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> {2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll [button: Enviar para o OneNote] -> [2010/02/28 04:41:04 | 000,643,472 | ---- | M] (Microsoft Corporation) {2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll [Menu: &Enviar para o OneNote] -> [2010/02/28 04:41:04 | 000,643,472 | ---- | M] (Microsoft Corporation) {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}:{FFFDC614-B694-4AE6-AB38-5D6374584B52} [HKLM] -> C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll [button: &Anotações Vinculadas do OneNote] -> [2010/02/28 04:41:04 | 000,496,528 | ---- | M] (Microsoft Corporation) {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}:{FFFDC614-B694-4AE6-AB38-5D6374584B52} [HKLM] -> C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll [Menu: &Anotações Vinculadas do OneNote] -> [2010/02/28 04:41:04 | 000,496,528 | ---- | M] (Microsoft Corporation) < Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> < Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix "" -> http:// < Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\] > -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 2 domain(s) found. -> www_bancobrasil.com.br [*] -> Trusted sites -> www14_bancobrasil.com.br [*] -> Trusted sites -> www2_bancobrasil.com.br [*] -> Trusted sites -> www_bb.com.br [*] -> Trusted sites -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\] > -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> {8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab [Java Plug-in 1.6.0_27] -> {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab [Java Plug-in 1.6.0_27] -> {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab [Java Plug-in 1.6.0_27] -> < Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> *Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> explorer.exe -> C:\Windows\explorer.exe -> [2011/02/25 02:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) *MultiFile Done* -> -> *UserInit* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit -> C:\Windows\system32\userinit.exe -> C:\Windows\System32\userinit.exe -> [2010/11/20 09:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) *MultiFile Done* -> -> *VMApplet* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet -> SystemPropertiesPerformance.exe -> C:\Windows\System32\SystemPropertiesPerformance.exe -> [2009/07/13 22:14:42 | 000,081,920 | ---- | M] (Microsoft Corporation) /pagefile -> -> File not found *MultiFile Done* -> -> < Winlogon settings [HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000] > -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> *Shell* -> HKEY_USERS\S-1-5-21-703093345-3958698311-1046026413-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> explorer.exe -> C:\Windows\explorer.exe -> [2011/02/25 02:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) *MultiFile Done* -> -> < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> GbPluginBb -> C:\Program Files\GbPlugin\gbieh.dll -> [2011/09/15 09:25:56 | 001,719,584 | ---- | M] (Banco do Brasil) < SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck] -> File not found < ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" [HKLM] -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [Groove GFS Stub Execution Hook] -> [2010/03/25 10:25:22 | 004,222,864 | ---- | M] (Microsoft Corporation) "{E37CB5F0-51F5-4395-A808-5FA49E399F83}" [HKLM] -> C:\Program Files\GbPlugin\gbieh.dll [GbPlugin ShlObj] -> [2011/09/15 09:25:56 | 001,719,584 | ---- | M] (Banco do Brasil) < SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> < CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom -> "AutoRun" -> 1 -> "DisplayName" -> CD-ROM Driver -> "ImagePath" -> [system32\DRIVERS\cdrom.sys] -> File not found < Drives with AutoRun files > -> -> C:\autoexec.bat [REM Dummy file for NTVDM | ] -> C:\autoexec.bat [ NTFS ] -> [2009/06/10 18:42:20 | 000,000,024 | ---- | M] () E:\AutoRun.exe [MZ | ] -> E:\AutoRun.exe [ CDFS ] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) E:\AUTORUN.INF [[AutoRun] | open=AutoRun.exe | icon=VIVO ZAP.ico | ] -> E:\AUTORUN.INF [ CDFS ] -> [2008/09/18 06:59:58 | 000,000,046 | R--- | M] () < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> \E HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\shell \E\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\shell\AutoRun\command \E\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{121c9bec-a365-11e0-9bb6-001a80421186} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{121c9bec-a365-11e0-9bb6-001a80421186}\shell \{121c9bec-a365-11e0-9bb6-001a80421186}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{121c9bec-a365-11e0-9bb6-001a80421186}\shell\AutoRun\command \{121c9bec-a365-11e0-9bb6-001a80421186}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{1ce195cc-2318-11e0-b7fc-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ce195cc-2318-11e0-b7fc-001bfbcdc073}\shell \{1ce195cc-2318-11e0-b7fc-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ce195cc-2318-11e0-b7fc-001bfbcdc073}\shell\AutoRun\command \{1ce195cc-2318-11e0-b7fc-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{1ce1983d-2318-11e0-b7fc-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ce1983d-2318-11e0-b7fc-001bfbcdc073}\shell \{1ce1983d-2318-11e0-b7fc-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ce1983d-2318-11e0-b7fc-001bfbcdc073}\shell\AutoRun\command \{1ce1983d-2318-11e0-b7fc-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{20187fa7-8bc7-11e0-b57f-001a80421186} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20187fa7-8bc7-11e0-b57f-001a80421186}\shell \{20187fa7-8bc7-11e0-b57f-001a80421186}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20187fa7-8bc7-11e0-b57f-001a80421186}\shell\AutoRun\command \{20187fa7-8bc7-11e0-b57f-001a80421186}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{5f00458c-8885-11e0-b5dd-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f00458c-8885-11e0-b5dd-001bfbcdc073}\shell \{5f00458c-8885-11e0-b5dd-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f00458c-8885-11e0-b5dd-001bfbcdc073}\shell\AutoRun\command \{5f00458c-8885-11e0-b5dd-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{5f00459d-8885-11e0-b5dd-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f00459d-8885-11e0-b5dd-001bfbcdc073}\shell \{5f00459d-8885-11e0-b5dd-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f00459d-8885-11e0-b5dd-001bfbcdc073}\shell\AutoRun\command \{5f00459d-8885-11e0-b5dd-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{a0b6ae6d-2a28-11e0-8d2e-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a0b6ae6d-2a28-11e0-8d2e-001bfbcdc073}\shell \{a0b6ae6d-2a28-11e0-8d2e-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a0b6ae6d-2a28-11e0-8d2e-001bfbcdc073}\shell\AutoRun\command \{a0b6ae6d-2a28-11e0-8d2e-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{c8fbb998-c8ca-11e0-85b1-001a80421186} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8fbb998-c8ca-11e0-85b1-001a80421186}\shell \{c8fbb998-c8ca-11e0-85b1-001a80421186}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8fbb998-c8ca-11e0-85b1-001a80421186}\shell\AutoRun\command \{c8fbb998-c8ca-11e0-85b1-001a80421186}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{c8fbb9a9-c8ca-11e0-85b1-001a80421186} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8fbb9a9-c8ca-11e0-85b1-001a80421186}\shell \{c8fbb9a9-c8ca-11e0-85b1-001a80421186}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8fbb9a9-c8ca-11e0-85b1-001a80421186}\shell\AutoRun\command \{c8fbb9a9-c8ca-11e0-85b1-001a80421186}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{c8fbb9ad-c8ca-11e0-85b1-001a80421186} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8fbb9ad-c8ca-11e0-85b1-001a80421186}\shell \{c8fbb9ad-c8ca-11e0-85b1-001a80421186}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8fbb9ad-c8ca-11e0-85b1-001a80421186}\shell\AutoRun\command \{c8fbb9ad-c8ca-11e0-85b1-001a80421186}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{c924753c-537a-11e0-9773-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c924753c-537a-11e0-9773-001bfbcdc073}\shell \{c924753c-537a-11e0-9773-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c924753c-537a-11e0-9773-001bfbcdc073}\shell\AutoRun\command \{c924753c-537a-11e0-9773-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{eb44e477-4d36-11e0-a485-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb44e477-4d36-11e0-a485-001bfbcdc073}\shell \{eb44e477-4d36-11e0-a485-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb44e477-4d36-11e0-a485-001bfbcdc073}\shell\AutoRun\command \{eb44e477-4d36-11e0-a485-001bfbcdc073}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> [2008/04/23 18:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) \{eb44e47d-4d36-11e0-a485-001bfbcdc073} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb44e47d-4d36-11e0-a485-001bfbcdc073}\shell \{eb44e47d-4d36-11e0-a485-001bfbcdc073}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb44e47d-4d36-11e0-a485-001bfbcdc073}\shell\AutoRun\command \{eb44e47d-4d36-11e0-a485-001bfbcdc073}\shell\AutoRun\command\\"" -> [F:\AutoRun.exe] -> File not found < Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> comfile [open] -> "%1" %* -> exefile [open] -> "%1" %* -> < File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\ -> .com [@ = comfile] -> "%1" %* -> .exe [@ = exefile] -> "%1" %* -> [Files/Folders - Created Within 30 Days] OTS.exe -> C:\Users\Zita\Desktop\OTS.exe -> [2011/09/21 19:52:05 | 000,646,656 | ---- | C] (OldTimer Tools) Marina -> C:\Users\Zita\Desktop\Marina -> [2011/09/21 18:18:40 | 000,000,000 | ---D | C] {1436E14D-DE28-4362-9387-9F750CA81A62} -> C:\Users\Zita\AppData\Local\{1436E14D-DE28-4362-9387-9F750CA81A62} -> [2011/09/21 14:32:43 | 000,000,000 | ---D | C] {F7B5D9B7-3F61-4E6A-AEBA-FB02E82280B4} -> C:\Users\Zita\AppData\Local\{F7B5D9B7-3F61-4E6A-AEBA-FB02E82280B4} -> [2011/09/21 13:49:34 | 000,000,000 | ---D | C] LinhaDefensiva -> C:\LinhaDefensiva -> [2011/09/21 08:29:53 | 000,000,000 | ---D | C] HostsXpert -> C:\Users\Zita\Desktop\HostsXpert -> [2011/09/21 08:27:53 | 000,000,000 | ---D | C] bankerfix.exe -> C:\Users\Zita\Desktop\bankerfix.exe -> [2011/09/21 08:26:17 | 000,178,597 | ---- | C] (Igor Pavlov) HijackThis -> C:\HijackThis -> [2011/09/21 08:09:20 | 000,000,000 | ---D | C] Java' -> C:\Program Files\Java' -> [2011/09/13 23:22:09 | 000,000,000 | ---D | C] Java -> C:\Program Files\Common Files\Java -> [2011/09/13 23:07:34 | 000,000,000 | ---D | C] GbpKm.sys -> C:\Windows\System32\drivers\GbpKm.sys -> [2011/09/13 22:50:01 | 000,044,064 | ---- | C] (GAS Tecnologia) GbPlugin -> C:\Program Files\GbPlugin -> [2011/09/13 22:49:28 | 000,000,000 | ---D | C] {B358CE1C-DF00-461E-B448-E0F3F8E1E334} -> C:\Users\Zita\AppData\Local\{B358CE1C-DF00-461E-B448-E0F3F8E1E334} -> [2011/09/01 06:05:36 | 000,000,000 | ---D | C] Catalyst Control Center -> C:\Users\Zita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center -> [2011/09/01 03:24:46 | 000,000,000 | ---D | C] pss -> C:\Windows\pss -> [2011/09/01 03:17:45 | 000,000,000 | ---D | C] {7F3EF2EB-1B69-4CD8-A081-5FC28FCDA2A9} -> C:\Users\Zita\AppData\Local\{7F3EF2EB-1B69-4CD8-A081-5FC28FCDA2A9} -> [2011/09/01 01:07:59 | 000,000,000 | ---D | C] Tracing -> C:\Users\Zita\Tracing -> [2011/09/01 01:07:43 | 000,000,000 | ---D | C] Google Chrome -> C:\Users\Zita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome -> [2011/09/01 00:51:37 | 000,000,000 | ---D | C] Google -> C:\Users\Zita\AppData\Local\Google -> [2011/09/01 00:45:13 | 000,000,000 | ---D | C] [Files/Folders - Modified Within 30 Days] ntuser.dat -> C:\Users\Zita\ntuser.dat -> [2011/09/21 19:59:20 | 002,359,296 | -HS- | M] () OTS.exe -> C:\Users\Zita\Desktop\OTS.exe -> [2011/09/21 19:52:48 | 000,646,656 | ---- | M] (OldTimer Tools) GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000UA.job -> C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000UA.job -> [2011/09/21 19:50:16 | 000,001,074 | ---- | M] () 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 -> [2011/09/21 19:12:01 | 000,014,544 | -H-- | M] () 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 -> [2011/09/21 19:12:01 | 000,014,544 | -H-- | M] () PerfStringBackup.INI -> C:\Windows\System32\PerfStringBackup.INI -> [2011/09/21 18:17:48 | 001,159,906 | ---- | M] () perfh009.dat -> C:\Windows\System32\perfh009.dat -> [2011/09/21 18:17:48 | 000,621,012 | ---- | M] () perfh00D.dat -> C:\Windows\System32\perfh00D.dat -> [2011/09/21 18:17:48 | 000,358,526 | ---- | M] () perfc009.dat -> C:\Windows\System32\perfc009.dat -> [2011/09/21 18:17:48 | 000,108,232 | ---- | M] () perfc00D.dat -> C:\Windows\System32\perfc00D.dat -> [2011/09/21 18:17:48 | 000,070,938 | ---- | M] () Ikeext.etl -> C:\Windows\System32\Ikeext.etl -> [2011/09/21 10:24:16 | 000,065,536 | ---- | M] () SA.DAT -> C:\Windows\tasks\SA.DAT -> [2011/09/21 10:24:16 | 000,000,006 | -H-- | M] () bootstat.dat -> C:\Windows\bootstat.dat -> [2011/09/21 10:24:00 | 000,067,584 | --S- | M] () hiberfil.sys -> C:\hiberfil.sys -> [2011/09/21 10:23:36 | 1609,375,744 | -HS- | M] () IconCache.db -> C:\Users\Zita\AppData\Local\IconCache.db -> [2011/09/21 09:49:49 | 002,239,687 | -H-- | M] () hosts -> C:\Windows\System32\drivers\etc\hosts -> [2011/09/21 08:31:27 | 000,000,698 | ---- | M] () bankerfix.exe -> C:\Users\Zita\Desktop\bankerfix.exe -> [2011/09/21 08:27:19 | 000,178,597 | ---- | M] (Igor Pavlov) GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000Core.job -> C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000Core.job -> [2011/09/21 00:50:00 | 000,001,022 | ---- | M] () VIVO ZAP.lnk -> C:\Users\Public\Desktop\VIVO ZAP.lnk -> [2011/09/20 21:05:59 | 000,000,965 | ---- | M] () Adobe Reader 9.lnk -> C:\Users\Public\Desktop\Adobe Reader 9.lnk -> [2011/09/14 14:08:06 | 000,001,944 | ---- | M] () CCleaner.lnk -> C:\Users\Public\Desktop\CCleaner.lnk -> [2011/09/01 00:44:09 | 000,000,925 | ---- | M] () FNTCACHE.DAT -> C:\Windows\System32\FNTCACHE.DAT -> [2011/09/01 00:11:56 | 000,418,408 | ---- | M] () 12 C:\Users\Zita\AppData\Local\Temp\*.tmp files -> C:\Users\Zita\AppData\Local\Temp\*.tmp -> [Files - No Company Name] GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000UA.job -> C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000UA.job -> [2011/09/01 00:45:16 | 000,001,074 | ---- | C] () GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000Core.job -> C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-703093345-3958698311-1046026413-1000Core.job -> [2011/09/01 00:45:15 | 000,001,022 | ---- | C] () perfh00D.dat -> C:\Windows\System32\perfh00D.dat -> [2011/05/27 15:49:58 | 000,358,526 | ---- | C] () perfi00D.dat -> C:\Windows\System32\perfi00D.dat -> [2011/05/27 15:49:58 | 000,229,316 | ---- | C] () perfc00D.dat -> C:\Windows\System32\perfc00D.dat -> [2011/05/27 15:49:58 | 000,070,938 | ---- | C] () perfd00D.dat -> C:\Windows\System32\perfd00D.dat -> [2011/05/27 15:49:58 | 000,032,166 | ---- | C] () resmon.resmoncfg -> C:\Users\Zita\AppData\Local\resmon.resmoncfg -> [2011/04/15 05:03:42 | 000,007,597 | ---- | C] () ativpsrm.bin -> C:\Windows\ativpsrm.bin -> [2011/04/15 04:44:30 | 000,000,000 | ---- | C] () burnaware.ini -> C:\Users\Zita\AppData\Roaming\burnaware.ini -> [2011/04/14 19:00:21 | 000,000,040 | ---- | C] () IconCache.db -> C:\Users\Zita\AppData\Local\IconCache.db -> [2011/04/06 09:56:01 | 002,239,687 | -H-- | C] () tosOBEX.INI -> C:\Windows\tosOBEX.INI -> [2011/04/02 07:43:28 | 000,000,000 | ---- | C] () RDVGHelper.exe -> C:\Windows\System32\RDVGHelper.exe -> [2011/04/02 01:47:22 | 000,080,896 | ---- | C] () PrintBrmUi.exe -> C:\Windows\System32\PrintBrmUi.exe -> [2011/04/02 01:45:24 | 000,066,048 | ---- | C] () dosx.exe -> C:\Windows\System32\dosx.exe -> [2011/04/02 01:45:21 | 000,053,600 | ---- | C] () mlfcache.dat -> C:\Windows\System32\mlfcache.dat -> [2011/03/23 07:19:18 | 000,143,836 | -H-- | C] () RtNicProp32.dll -> C:\Windows\System32\RtNicProp32.dll -> [2011/03/21 13:22:06 | 000,080,416 | ---- | C] () OGACheckControl.dll -> C:\Windows\System32\OGACheckControl.dll -> [2011/03/19 14:26:59 | 000,667,136 | ---- | C] () WgaTray.exe -> C:\Windows\System32\WgaTray.exe -> [2011/03/19 14:26:59 | 000,323,072 | ---- | C] () WgaLogon.dll -> C:\Windows\System32\WgaLogon.dll -> [2011/03/19 14:26:59 | 000,190,976 | ---- | C] () MusiccityDownload.exe -> C:\Windows\MusiccityDownload.exe -> [2011/01/29 17:00:24 | 000,030,568 | ---- | C] () cis-2.4.dll -> C:\Windows\System32\cis-2.4.dll -> [2011/01/29 17:00:22 | 000,974,848 | ---- | C] () issacapi_bs-2.3.dll -> C:\Windows\System32\issacapi_bs-2.3.dll -> [2011/01/29 17:00:22 | 000,081,920 | ---- | C] () issacapi_pe-2.3.dll -> C:\Windows\System32\issacapi_pe-2.3.dll -> [2011/01/29 17:00:22 | 000,065,536 | ---- | C] () issacapi_se-2.3.dll -> C:\Windows\System32\issacapi_se-2.3.dll -> [2011/01/29 17:00:22 | 000,057,344 | ---- | C] () atiumdva.dat -> C:\Windows\System32\atiumdva.dat -> [2011/01/19 02:29:10 | 003,107,788 | ---- | C] () atitmmxx.dll -> C:\Windows\System32\atitmmxx.dll -> [2011/01/19 02:29:10 | 000,159,744 | ---- | C] () atiicdxx.dat -> C:\Windows\System32\atiicdxx.dat -> [2011/01/19 02:29:10 | 000,145,050 | ---- | C] () WdfCoInstaller01000.dll -> C:\Windows\System32\WdfCoInstaller01000.dll -> [2011/01/19 01:52:40 | 001,060,424 | ---- | C] () GDIPFONTCACHEV1.DAT -> C:\Users\Zita\AppData\Local\GDIPFONTCACHEV1.DAT -> [2011/01/18 12:48:56 | 000,111,360 | ---- | C] () unrar.dll -> C:\Windows\System32\unrar.dll -> [2011/01/18 12:48:35 | 000,178,176 | ---- | C] () avisplitter.ini -> C:\Windows\avisplitter.ini -> [2011/01/18 12:48:35 | 000,000,038 | ---- | C] () xvidcore.dll -> C:\Windows\System32\xvidcore.dll -> [2011/01/18 12:48:33 | 000,881,664 | ---- | C] () xvidvfw.dll -> C:\Windows\System32\xvidvfw.dll -> [2011/01/18 12:48:33 | 000,205,824 | ---- | C] () qt-dx331.dll -> C:\Windows\System32\qt-dx331.dll -> [2011/01/18 12:48:32 | 003,596,288 | ---- | C] () ff_vfw.dll -> C:\Windows\System32\ff_vfw.dll -> [2011/01/18 12:48:30 | 000,085,504 | ---- | C] () ff_vfw.dll.manifest -> C:\Windows\System32\ff_vfw.dll.manifest -> [2011/01/18 12:48:30 | 000,000,547 | ---- | C] () PerfStringBackup.INI -> C:\Windows\System32\PerfStringBackup.INI -> [2011/01/18 12:38:29 | 001,159,906 | ---- | C] () bootstat.dat -> C:\Windows\bootstat.dat -> [2009/07/14 01:57:37 | 000,067,584 | --S- | C] () GlobalUserInterface.CompositeFont -> C:\Windows\Fonts\GlobalUserInterface.CompositeFont -> [2009/07/14 01:52:31 | 000,043,318 | ---- | C] () GlobalSerif.CompositeFont -> C:\Windows\Fonts\GlobalSerif.CompositeFont -> [2009/07/14 01:52:31 | 000,029,779 | ---- | C] () GlobalSansSerif.CompositeFont -> C:\Windows\Fonts\GlobalSansSerif.CompositeFont -> [2009/07/14 01:52:31 | 000,026,489 | ---- | C] () GlobalMonospace.CompositeFont -> C:\Windows\Fonts\GlobalMonospace.CompositeFont -> [2009/07/14 01:52:31 | 000,026,040 | ---- | C] () FNTCACHE.DAT -> C:\Windows\System32\FNTCACHE.DAT -> [2009/07/14 01:33:53 | 000,418,408 | ---- | C] () perfh009.dat -> C:\Windows\System32\perfh009.dat -> [2009/07/13 23:05:48 | 000,621,012 | ---- | C] () perfi009.dat -> C:\Windows\System32\perfi009.dat -> [2009/07/13 23:05:48 | 000,291,294 | ---- | C] () perfc009.dat -> C:\Windows\System32\perfc009.dat -> [2009/07/13 23:05:48 | 000,108,232 | ---- | C] () perfd009.dat -> C:\Windows\System32\perfd009.dat -> [2009/07/13 23:05:48 | 000,031,548 | ---- | C] () NOISE.DAT -> C:\Windows\System32\NOISE.DAT -> [2009/07/13 23:05:05 | 000,000,741 | ---- | C] () msdfmap.ini -> C:\Windows\msdfmap.ini -> [2009/07/13 23:04:57 | 000,001,405 | ---- | C] () win.ini -> C:\Windows\win.ini -> [2009/07/13 23:04:23 | 000,000,478 | ---- | C] () system.ini -> C:\Windows\system.ini -> [2009/07/13 23:04:23 | 000,000,219 | ---- | C] () dssec.dat -> C:\Windows\System32\dssec.dat -> [2009/07/13 23:04:11 | 000,215,943 | ---- | C] () mib.bin -> C:\Windows\mib.bin -> [2009/07/13 20:55:01 | 000,043,131 | ---- | C] () BthpanContextHandler.dll -> C:\Windows\System32\BthpanContextHandler.dll -> [2009/07/13 20:51:43 | 000,073,728 | ---- | C] () BWContextHandler.dll -> C:\Windows\System32\BWContextHandler.dll -> [2009/07/13 20:42:10 | 000,064,000 | ---- | C] () winver.exe -> C:\Windows\System32\winver.exe -> [2009/07/13 20:41:47 | 000,001,536 | ---- | C] () mscdexnt.exe -> C:\Windows\System32\mscdexnt.exe -> [2009/07/13 18:41:05 | 000,000,718 | ---- | C] () redir.exe -> C:\Windows\System32\redir.exe -> [2009/07/13 18:41:04 | 000,002,842 | ---- | C] () share.exe -> C:\Windows\System32\share.exe -> [2009/07/13 18:41:02 | 000,000,882 | ---- | C] () fastopen.exe -> C:\Windows\System32\fastopen.exe -> [2009/07/13 18:41:02 | 000,000,882 | ---- | C] () GRAPHICS.COM -> C:\Windows\System32\GRAPHICS.COM -> [2009/07/13 18:41:01 | 000,019,694 | ---- | C] () KB16.COM -> C:\Windows\System32\KB16.COM -> [2009/07/13 18:40:59 | 000,014,710 | ---- | C] () nlsfunc.exe -> C:\Windows\System32\nlsfunc.exe -> [2009/07/13 18:40:57 | 000,007,052 | ---- | C] () LOADFIX.COM -> C:\Windows\System32\LOADFIX.COM -> [2009/07/13 18:40:57 | 000,001,131 | ---- | C] () mem.exe -> C:\Windows\System32\mem.exe -> [2009/07/13 18:40:56 | 000,039,274 | ---- | C] () setver.exe -> C:\Windows\System32\setver.exe -> [2009/07/13 18:40:54 | 000,011,753 | ---- | C] () debug.exe -> C:\Windows\System32\debug.exe -> [2009/07/13 18:40:52 | 000,020,634 | ---- | C] () exe2bin.exe -> C:\Windows\System32\exe2bin.exe -> [2009/07/13 18:40:51 | 000,008,424 | ---- | C] () edlin.exe -> C:\Windows\System32\edlin.exe -> [2009/07/13 18:40:50 | 000,012,642 | ---- | C] () append.exe -> C:\Windows\System32\append.exe -> [2009/07/13 18:40:49 | 000,012,498 | ---- | C] () COMMAND.COM -> C:\Windows\System32\COMMAND.COM -> [2009/07/13 18:40:48 | 000,050,648 | ---- | C] () country.sys -> C:\Windows\System32\country.sys -> [2009/07/13 18:40:44 | 000,027,097 | ---- | C] () KEY01.SYS -> C:\Windows\System32\KEY01.SYS -> [2009/07/13 18:40:43 | 000,042,809 | ---- | C] () KEYBOARD.SYS -> C:\Windows\System32\KEYBOARD.SYS -> [2009/07/13 18:40:43 | 000,042,537 | ---- | C] () ANSI.SYS -> C:\Windows\System32\ANSI.SYS -> [2009/07/13 18:40:41 | 000,009,029 | ---- | C] () HIMEM.SYS -> C:\Windows\System32\HIMEM.SYS -> [2009/07/13 18:40:40 | 000,004,768 | ---- | C] () NTDOS412.SYS -> C:\Windows\System32\NTDOS412.SYS -> [2009/07/13 18:40:39 | 000,029,274 | ---- | C] () NTDOS411.SYS -> C:\Windows\System32\NTDOS411.SYS -> [2009/07/13 18:40:35 | 000,029,370 | ---- | C] () NTDOS404.SYS -> C:\Windows\System32\NTDOS404.SYS -> [2009/07/13 18:40:31 | 000,029,146 | ---- | C] () NTDOS804.SYS -> C:\Windows\System32\NTDOS804.SYS -> [2009/07/13 18:40:27 | 000,029,146 | ---- | C] () NTDOS.SYS -> C:\Windows\System32\NTDOS.SYS -> [2009/07/13 18:40:23 | 000,027,866 | ---- | C] () NTIO412.SYS -> C:\Windows\System32\NTIO412.SYS -> [2009/07/13 18:40:19 | 000,035,536 | ---- | C] () NTIO411.SYS -> C:\Windows\System32\NTIO411.SYS -> [2009/07/13 18:40:17 | 000,035,776 | ---- | C] () NTIO404.SYS -> C:\Windows\System32\NTIO404.SYS -> [2009/07/13 18:40:15 | 000,034,672 | ---- | C] () NTIO804.SYS -> C:\Windows\System32\NTIO804.SYS -> [2009/07/13 18:40:13 | 000,034,672 | ---- | C] () NTIO.SYS -> C:\Windows\System32\NTIO.SYS -> [2009/07/13 18:40:11 | 000,033,952 | ---- | C] () msjetoledb40.dll -> C:\Windows\System32\msjetoledb40.dll -> [2009/07/13 18:03:59 | 000,364,544 | ---- | C] () win87em.dll -> C:\Windows\System32\win87em.dll -> [2009/07/13 17:29:46 | 000,013,312 | ---- | C] () edit.com -> C:\Windows\System32\edit.com -> [2009/06/10 18:42:32 | 000,069,886 | ---- | C] () tcpmon.ini -> C:\Windows\System32\tcpmon.ini -> [2009/06/10 18:39:59 | 000,060,124 | ---- | C] () mlang.dat -> C:\Windows\System32\mlang.dat -> [2009/06/10 18:26:10 | 000,673,088 | ---- | C] () TosBtAcc.dll -> C:\Windows\System32\TosBtAcc.dll -> [2006/12/05 13:05:06 | 000,114,688 | ---- | C] () TosCommAPI.dll -> C:\Windows\System32\TosCommAPI.dll -> [2005/07/22 21:30:20 | 000,065,536 | ---- | C] () [File - Lop Check] AVG10 -> C:\Users\Zita\AppData\Roaming\AVG10 -> [2011/01/26 10:43:09 | 000,000,000 | ---D | M] Desktopicon -> C:\Users\Zita\AppData\Roaming\Desktopicon -> [2011/03/13 02:33:04 | 000,000,000 | ---D | M] EurekaLog -> C:\Users\Zita\AppData\Roaming\EurekaLog -> [2011/08/17 03:09:22 | 000,000,000 | ---D | M] iPodder -> C:\Users\Zita\AppData\Roaming\iPodder -> [2011/02/27 15:35:26 | 000,000,000 | ---D | M] Kazaa Lite -> C:\Users\Zita\AppData\Roaming\Kazaa Lite -> [2011/01/26 15:38:19 | 000,000,000 | ---D | M] MediaMonkey -> C:\Users\Zita\AppData\Roaming\MediaMonkey -> [2011/08/17 03:10:23 | 000,000,000 | ---D | M] RadarSync -> C:\Users\Zita\AppData\Roaming\RadarSync -> [2011/04/06 01:03:05 | 000,000,000 | ---D | M] Samsung -> C:\Users\Zita\AppData\Roaming\Samsung -> [2011/04/06 03:57:26 | 000,000,000 | ---D | M] Shareaza -> C:\Users\Zita\AppData\Roaming\Shareaza -> [2011/03/13 10:57:25 | 000,000,000 | ---D | M] Uniblue -> C:\Users\Zita\AppData\Roaming\Uniblue -> [2011/01/26 11:35:54 | 000,000,000 | ---D | M] VIVO INTERNET -> C:\Users\Zita\AppData\Roaming\VIVO INTERNET -> [2011/05/27 14:52:54 | 000,000,000 | ---D | M] SCHEDLGU.TXT -> C:\Windows\Tasks\SCHEDLGU.TXT -> [2011/06/25 22:23:22 | 000,032,610 | ---- | M] () [File - Purity Scan] [Custom Scans] < %ALLUSERSPROFILE%\*.* > < %ALLUSERSPROFILE%\Dados de aplicativos\* > < %ALLUSERSPROFILE%\Dados de aplicativos\*.* > < %ALLUSERSPROFILE%\Menu Iniciar\Programas\Inicializar\*.* > < %APPDATA%\* > burnaware.ini -> C:\Users\Zita\AppData\Roaming\burnaware.ini -> [2011/04/14 19:00:21 | 000,000,040 | ---- | M] () < %APPDATA%\*.* > burnaware.ini -> C:\Users\Zita\AppData\Roaming\burnaware.ini -> [2011/04/14 19:00:21 | 000,000,040 | ---- | M] () < %LOCALAPPDATA%\*.* > GDIPFONTCACHEV1.DAT -> C:\Users\Zita\AppData\Local\GDIPFONTCACHEV1.DAT -> [2011/08/17 02:58:46 | 000,111,360 | ---- | M] () IconCache.db -> C:\Users\Zita\AppData\Local\IconCache.db -> [2011/09/21 09:49:49 | 002,239,687 | -H-- | M] () PrimoBurnerMM.log -> C:\Users\Zita\AppData\Local\PrimoBurnerMM.log -> [2011/08/17 03:08:33 | 000,013,975 | ---- | M] () resmon.resmoncfg -> C:\Users\Zita\AppData\Local\resmon.resmoncfg -> [2011/04/15 05:04:36 | 000,007,597 | ---- | M] () < %SYSTEMDRIVE%\* > autoexec.bat -> C:\autoexec.bat -> [2009/06/10 18:42:20 | 000,000,024 | ---- | M] () bootmgr -> C:\bootmgr -> [2011/08/17 00:59:23 | 000,383,786 | RHS- | M] () BOOTSECT.BAK -> C:\BOOTSECT.BAK -> [2011/01/18 18:26:23 | 000,008,192 | RHS- | M] () config.sys -> C:\config.sys -> [2009/06/10 18:42:20 | 000,000,010 | ---- | M] () hiberfil.sys -> C:\hiberfil.sys -> [2011/09/21 10:23:36 | 1609,375,744 | -HS- | M] () IO.SYS -> C:\IO.SYS -> [2011/07/10 21:20:27 | 000,000,000 | RHS- | M] () MMiPodExcept.log -> C:\MMiPodExcept.log -> [2011/08/17 03:08:37 | 000,000,000 | ---- | M] () MMWMDMExcept.log -> C:\MMWMDMExcept.log -> [2011/08/17 03:08:38 | 000,000,000 | ---- | M] () MSDOS.SYS -> C:\MSDOS.SYS -> [2011/07/10 21:20:27 | 000,000,000 | RHS- | M] () pagefile.sys -> C:\pagefile.sys -> [2011/09/21 10:23:40 | 2145,837,056 | -HS- | M] () VZOSF -> C:\VZOSF -> [2011/02/25 22:10:54 | 000,385,741 | RHS- | M] () w7lxe.exe -> C:\w7lxe.exe -> [2010/05/22 07:58:47 | 028,135,936 | ---- | M] () win7.ld -> C:\win7.ld -> [2011/02/25 22:10:54 | 000,000,020 | RHS- | M] () < %SYSTEMDRIVE%\*.* > autoexec.bat -> C:\autoexec.bat -> [2009/06/10 18:42:20 | 000,000,024 | ---- | M] () bootmgr -> C:\bootmgr -> [2011/08/17 00:59:23 | 000,383,786 | RHS- | M] () BOOTSECT.BAK -> C:\BOOTSECT.BAK -> [2011/01/18 18:26:23 | 000,008,192 | RHS- | M] () config.sys -> C:\config.sys -> [2009/06/10 18:42:20 | 000,000,010 | ---- | M] () hiberfil.sys -> C:\hiberfil.sys -> [2011/09/21 10:23:36 | 1609,375,744 | -HS- | M] () IO.SYS -> C:\IO.SYS -> [2011/07/10 21:20:27 | 000,000,000 | RHS- | M] () MMiPodExcept.log -> C:\MMiPodExcept.log -> [2011/08/17 03:08:37 | 000,000,000 | ---- | M] () MMWMDMExcept.log -> C:\MMWMDMExcept.log -> [2011/08/17 03:08:38 | 000,000,000 | ---- | M] () MSDOS.SYS -> C:\MSDOS.SYS -> [2011/07/10 21:20:27 | 000,000,000 | RHS- | M] () pagefile.sys -> C:\pagefile.sys -> [2011/09/21 10:23:40 | 2145,837,056 | -HS- | M] () VZOSF -> C:\VZOSF -> [2011/02/25 22:10:54 | 000,385,741 | RHS- | M] () w7lxe.exe -> C:\w7lxe.exe -> [2010/05/22 07:58:47 | 028,135,936 | ---- | M] () win7.ld -> C:\win7.ld -> [2011/02/25 22:10:54 | 000,000,020 | RHS- | M] () < %USERPROFILE%\*.* > ntuser.dat -> C:\Users\Zita\ntuser.dat -> [2011/09/21 19:59:20 | 002,359,296 | -HS- | M] () ntuser.dat.LOG1 -> C:\Users\Zita\ntuser.dat.LOG1 -> [2011/09/21 19:59:20 | 000,262,144 | -HS- | M] () ntuser.dat.LOG2 -> C:\Users\Zita\ntuser.dat.LOG2 -> [2011/01/18 12:34:18 | 000,000,000 | -HS- | M] () ntuser.dat{401b946d-2926-11e0-a483-001bfbcdc073}.TM.blf -> C:\Users\Zita\ntuser.dat{401b946d-2926-11e0-a483-001bfbcdc073}.TM.blf -> [2011/01/26 10:29:42 | 000,065,536 | -HS- | M] () ntuser.dat{401b946d-2926-11e0-a483-001bfbcdc073}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{401b946d-2926-11e0-a483-001bfbcdc073}.TMContainer00000000000000000001.regtrans-ms -> [2011/01/26 10:29:41 | 000,524,288 | -HS- | M] () ntuser.dat{401b946d-2926-11e0-a483-001bfbcdc073}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{401b946d-2926-11e0-a483-001bfbcdc073}.TMContainer00000000000000000002.regtrans-ms -> [2011/01/26 10:29:42 | 000,524,288 | -HS- | M] () NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf -> C:\Users\Zita\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf -> [2011/01/18 13:17:19 | 000,065,536 | -HS- | M] () NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms -> [2011/01/18 13:17:19 | 000,524,288 | -HS- | M] () NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms -> [2011/01/18 13:17:19 | 000,524,288 | -HS- | M] () ntuser.dat{7a41749c-294f-11e0-878d-001bfbcdc073}.TM.blf -> C:\Users\Zita\ntuser.dat{7a41749c-294f-11e0-878d-001bfbcdc073}.TM.blf -> [2011/01/26 20:55:08 | 000,065,536 | -HS- | M] () ntuser.dat{7a41749c-294f-11e0-878d-001bfbcdc073}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{7a41749c-294f-11e0-878d-001bfbcdc073}.TMContainer00000000000000000001.regtrans-ms -> [2011/01/26 20:55:07 | 000,524,288 | -HS- | M] () ntuser.dat{7a41749c-294f-11e0-878d-001bfbcdc073}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{7a41749c-294f-11e0-878d-001bfbcdc073}.TMContainer00000000000000000002.regtrans-ms -> [2011/01/26 20:55:08 | 000,524,288 | -HS- | M] () ntuser.dat{930630ec-c875-11e0-ad00-001a80421186}.TM.blf -> C:\Users\Zita\ntuser.dat{930630ec-c875-11e0-ad00-001a80421186}.TM.blf -> [2011/08/17 00:45:54 | 000,065,536 | -HS- | M] () ntuser.dat{930630ec-c875-11e0-ad00-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{930630ec-c875-11e0-ad00-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> [2011/08/17 00:45:54 | 000,524,288 | -HS- | M] () ntuser.dat{930630ec-c875-11e0-ad00-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{930630ec-c875-11e0-ad00-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> [2011/08/17 00:45:54 | 000,524,288 | -HS- | M] () ntuser.dat{bfa49c69-6013-11e0-b0ba-001bfbcdc073}.TM.blf -> C:\Users\Zita\ntuser.dat{bfa49c69-6013-11e0-b0ba-001bfbcdc073}.TM.blf -> [2011/04/06 04:27:53 | 000,065,536 | -HS- | M] () ntuser.dat{bfa49c69-6013-11e0-b0ba-001bfbcdc073}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{bfa49c69-6013-11e0-b0ba-001bfbcdc073}.TMContainer00000000000000000001.regtrans-ms -> [2011/04/06 04:27:53 | 000,524,288 | -HS- | M] () ntuser.dat{bfa49c69-6013-11e0-b0ba-001bfbcdc073}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{bfa49c69-6013-11e0-b0ba-001bfbcdc073}.TMContainer00000000000000000002.regtrans-ms -> [2011/04/06 04:27:53 | 000,524,288 | -HS- | M] () ntuser.dat{c927a6c8-6006-11e0-a3cd-001a80421186}.TM.blf -> C:\Users\Zita\ntuser.dat{c927a6c8-6006-11e0-a3cd-001a80421186}.TM.blf -> [2011/04/06 03:03:59 | 000,065,536 | -HS- | M] () ntuser.dat{c927a6c8-6006-11e0-a3cd-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{c927a6c8-6006-11e0-a3cd-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> [2011/04/06 03:03:59 | 000,524,288 | -HS- | M] () ntuser.dat{c927a6c8-6006-11e0-a3cd-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{c927a6c8-6006-11e0-a3cd-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> [2011/04/06 03:03:59 | 000,524,288 | -HS- | M] () ntuser.dat{f13355be-be96-11e0-af18-001a80421186}.TM.blf -> C:\Users\Zita\ntuser.dat{f13355be-be96-11e0-af18-001a80421186}.TM.blf -> [2011/08/05 01:24:03 | 000,065,536 | -HS- | M] () ntuser.dat{f13355be-be96-11e0-af18-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{f13355be-be96-11e0-af18-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> [2011/08/05 01:24:03 | 000,524,288 | -HS- | M] () ntuser.dat{f13355be-be96-11e0-af18-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{f13355be-be96-11e0-af18-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> [2011/08/05 01:24:03 | 000,524,288 | -HS- | M] () ntuser.dat{fa8f7948-5fe9-11e0-9118-001a80421186}.TM.blf -> C:\Users\Zita\ntuser.dat{fa8f7948-5fe9-11e0-9118-001a80421186}.TM.blf -> [2011/04/06 01:17:25 | 000,065,536 | -HS- | M] () ntuser.dat{fa8f7948-5fe9-11e0-9118-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Zita\ntuser.dat{fa8f7948-5fe9-11e0-9118-001a80421186}.TMContainer00000000000000000001.regtrans-ms -> [2011/04/06 01:17:25 | 000,524,288 | -HS- | M] () ntuser.dat{fa8f7948-5fe9-11e0-9118-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> C:\Users\Zita\ntuser.dat{fa8f7948-5fe9-11e0-9118-001a80421186}.TMContainer00000000000000000002.regtrans-ms -> [2011/04/06 01:17:25 | 000,524,288 | -HS- | M] () ntuser.ini -> C:\Users\Zita\ntuser.ini -> [2011/01/18 12:34:19 | 000,000,020 | -HS- | M] () [Alternate Data Streams] @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DBC416F8 @Alternate Data Stream - 16 bytes -> C:\Users\Zita\Downloads:Shareaza.GUID @Alternate Data Stream - 2 bytes -> C:\Windows\System32:17E7EF84_Bb.gbp @Alternate Data Stream - 204 bytes -> C:\Windows\System32\drivers:GbpKmAp.lst < End of report > Valeu Compartilhar este post Link para o post Compartilhar em outros sites
wings 22 Denunciar post Postado Setembro 21, 2011 Você usou o HostsXpert antes de postar? Seu log está limpo. O problema foi resolvido? 1. *Delete o Bankerfix e a pasta C:\LinhaDefensiva 2. *Execute o OTS, clique [CleanUp] > [Yes] *O PC será reiniciado Compartilhar este post Link para o post Compartilhar em outros sites
ieca 0 Denunciar post Postado Setembro 22, 2011 Muito obrigada, você é um anjo!!! Ta funcionando direitinho agora. Abraços Compartilhar este post Link para o post Compartilhar em outros sites
wings 22 Denunciar post Postado Setembro 22, 2011 PROBLEMA RESOLVIDO Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
