[Arquivado] Minha conexão (via rádio) cai várias vezes.

[srspereira 0]

Boa noite! Minha conexão (via rádio) cai várias vezes. Seria MALWARE?

Abaixo, segue Logfile HIjack:

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 19:21:05, on 03/09/2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16448)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Sergio\Desktop\Downloads\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)

O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O3 - Toolbar: SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [iObit Malware Fighter] "C:\Program Files\IObit\IObit Malware Fighter\IMF.exe" /autostart

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: VIA Karaoke digital mixer Service (VIAKaraokeService) - VIA Technologies, Inc. - C:\Windows\system32\viakaraokesrv.exe

 

--

End of file - 6155 bytes

[DigRam 144]

Bom Dia! srspereira

 

|- Baixe: < > ( ... par Nicolas Coolman )

 

|- Salve-o no desktop!

|- Para Windows Vista ou 7,clique direito e execute o arquivo como administrador.

|- Aguarde a conclusão do scan e clique em "Copier". <- Aguarde!

 

 

|- Além do relatório,teremos no desktop: ZHP_uninstall, MBRCheck, ZHPDiag, ZHPFix

|- Poste e/ou cole aqui,o link que foi gerado!

 

Abs!

[srspereira 0]

Rapport de ZHPDiag v1.31.16 par Nicolas Coolman, Update du 04/09/2012

Run by Sergio at 04/09/2012 21:50:57

Web site : http://nicolascoolman.skyrock.com/

State : Error during network connexion

 

 

---\\ Web Browser

MSIE: Internet Explorer v9.0.8112.16421

MFIE: Mozilla Firefox 12.0 v12.0

GCIE: Google Chrome v21.0.1180.83 (Defaut)

 

---\\ Windows Product Information

~ Langage: Anglais

Windows 7 Home Basic Edition, 32-bit Service Pack 1 (Build 7601)

Windows Server License Manager Script : OK

Software Protection Service (Protection logicielle) : OK

Windows Automatic Updates : OK

Windows Activation Technologies : OK

 

---\\ System Information

~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel

~ Operating System: 32 Bits

Boot mode: Normal (Normal boot)

Total RAM: 3062 MB (65% free)

System Restore: Activé (Enable)

System drive C: has 324 GB (69%) free of 466 GB

 

---\\ Logged in mode

~ Computer Name: SERGIO-ORO01

~ User Name: Sergio

~ All Users Names: Sergio, Convidado, Administrador,

~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89

Logged in as Administrator

 

---\\ Environnement Variables

~ System Unit : C:\

~ %AppData% : C:\Users\Sergio\AppData\Roaming\

~ %Desktop% : C:\Users\Sergio\Desktop\

~ %Favorites% : C:\Users\Sergio\Favorites\

~ %LocalAppData% : C:\Users\Sergio\AppData\Local\

~ %StartMenu% : C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\

~ %Windir% : C:\Windows\

~ %System% : C:\Windows\System32\

 

---\\ DOS/Devices

C:\ Hard drive, Flash drive, Thumb drive (Free 324 Go of 466 Go)

D:\ CD-ROM drive (Free 0 Go of 6 Go)

 

 

 

---\\ Security Center & Tools Informations

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK

[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK

~ Scan Security Center in 00mn 00s

 

 

 

---\\ Search Generic System Files

[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Windows Explorer.) (.16/03/2012 - 17:15:33.) -- C:\Windows\Explorer.exe [2616320]

[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:14:45.) -- C:\Windows\System32\Wininit.exe [96256]

[MD5.75A97A2C060E72AB49E071E08C7DD2BA] - (.Microsoft Corporation - Internet Extensions para Win32.) (.28/06/2012 - 21:09:01.) -- C:\Windows\System32\wininet.dll [1129472]

[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 18:29:06.) -- C:\Windows\System32\Winlogon.exe [286720]

[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 18:29:24.) -- C:\Windows\System32\sppcomapi.dll [193536]

[MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.01/05/2012 - 19:53:48.) -- C:\Windows\system32\Drivers\AFD.sys [338944]

[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]

[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]

[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 18:29:03.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]

[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 18:29:07.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]

[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 18:29:03.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]

[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]

[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 20:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]

[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.14/05/2012 - 20:04:16.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]

[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 18:29:08.) -- C:\Windows\system32\Drivers\netBT.sys [187904]

[MD5.81189C3D7763838E55C397759D49007A] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.09/05/2012 - 21:22:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1211264]

[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 20:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]

[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 20:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]

[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 20:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]

[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 18:29:07.) -- C:\Windows\system32\Drivers\tdx.sys [74752]

[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 18:29:03.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]

~ Scan Generic Processes in 00mn 00s

 

 

 

---\\ Hidden files state (Hidden/Total)

~ Mes images (My Pictures) : 3/220

~ Mes musiques (My Musics) : 5/30

~ Mes Videos (My Videos) : 1/47

~ Mes Favoris (My Favorites) : 1/22

~ Mes Documents (My Documents) : 2/1341

~ Mon Bureau (My Desktop) : 2/28701

~ Menu demarrer (Programs) : 1/41

~ Scan Hidden Files in 00mn 16s

 

 

 

---\\ Running Processes

[MD5.BAD0D303EF0A519409C625738F3E10A3] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4282728] [PID.2892]

[MD5.9C2692541D9C828A51B42EB83ED10CE8] - (.IObit - Advanced SystemCare 5 Tray.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe [1647448] [PID.2904]

[MD5.2339760B238226DAD9ED03F939D92323] - (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe [1229848] [PID.3920]

[MD5.1007F26082E382C0196D6756902D7B10] - (...) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [3762688] [PID.3464]

~ Scan Processes Running in 00mn 00s

 

 

 

---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)

C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Preferences

G1 - GCS: Preference [user Data\Default] None

~ Scan Google Browser in 00mn 00s

 

 

 

---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)

C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\prefs.js

C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\user.js

M3 - MFPP: Plugins - [sergio] -- C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\searchplugins\sweetim.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\babylon.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\buscape.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\mercadolivre.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\mystartggtb.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\twitter.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-br.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-br.xml

M0 - MFSP: prefs.js [sergio - hscznr7j.default] about:blank

M0 - MFSP: user.js [sergio - hscznr7j.default] about:home

M2 - MFEP: prefs.js [sergio - hscznr7j.default\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}] [] Memory Fox v7.4 (.IDEVFH.)

P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll

P2 - FPN: [HKLM] [@adobe.com/ShockwavePlayer] - (.Adobe Systems, Inc. - Adobe Shockwave for Director Netscape plug-in, version 11.6.) -- C:\Windows\system32\Adobe\Director\np32dsw.dll

P2 - FPN: [HKLM] [@Google.com/GoogleEarthPlugin] - (.Google - GEPlugin.) -- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

P2 - FPN: [HKLM] [@google.com/npPicasa3,version=3.0.0] - (.Google, Inc. - Picasa plugin.) -- C:\Program Files\Google\Picasa3\npPicasa3.dll

P2 - FPN: [HKLM] [@java.com/DTPlugin,version=10.5.1] - (.Oracle Corporation - NPRuntime Script Plug-in Library for Java Deploy.) -- C:\Windows\system32\npDeployJava1.dll

P2 - FPN: [HKLM] [@java.com/JavaPlugin,version=10.5.1] - (.Oracle Corporation - Next Generation Java Plug-in 10.5.1 for Mozilla browsers.) -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 5.1.10411.0.) -- C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3502.0922] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3538.0513] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3555.0308] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@mytalkpal.com/ffplugin] - (.Shanghai Qitai Tech. Co., Ltd. - Talkpal ASR Scriptable Plugin for Mozilla.) -- C:\Program Files\Talkpal\Speech Plugin For EF\npTalkpalPlugin.dll

P2 - FPN: [HKLM] [@nvidia.com/3DVision] - (.NVIDIA Corporation - NVIDIA 3D Vision plugin for Mozilla browsers.) -- C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

P2 - FPN: [HKLM] [@nvidia.com/3DVisionStreaming] - (.NVIDIA Corporation - NVIDIA 3D Vision Streaming plugin for Mozilla browsers.) -- C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

P2 - FPN: [HKLM] [@real.com/nppl3260;version=6.0.12.450] - (.RealNetworks, Inc. - RealPlayer LiveConnect-Enabled Plug-In.) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

P2 - FPN: [HKLM] [@real.com/nprpjplug;version=6.0.12.448] - (.RealNetworks, Inc. - 6.0.12.448.) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKLM] [Adobe Reader] - (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 10.1.4.) -- C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Users\Sergio\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Users\Sergio\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKCU] [@unity3d.com/UnityPlayer,version=1.0] - (.Unity Technologies ApS - Unity Player 3.4.0f5.) -- C:\Users\Sergio\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

~ Scan Firefox Browser in 00mn 00s

 

 

 

---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)

R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com

R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Unity Technologies ApS - Unity Player 3.4.0f5.) (No version) -- (.not file.)

R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1

~ Scan IE Browser in 00mn 00s

 

 

 

---\\ Internet Explorer, Proxy Management (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

~ Scan Proxy management in 00mn 00s

 

 

 

---\\ Changed inifile Value, Mapped to Registry (F2)

F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,

F2 - REG:system.ini: Shell=C:\Windows\explorer.exe

F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe

~ Scan Keys in 00mn 00s

 

 

 

---\\ Hosts file redirection (O1)

~ Le fichier hosts est sain (The hosts file is clean).

~ Scan Hosts File in 00mn 00s

~ Nombre de lignes (Lines number): 21

 

 

 

---\\ Browser Helper Objects (O2)

O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} Orphean Key

O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Orphean Key

O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} Orphean Key

O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} Orphean Key

~ Scan BHO in 00mn 00s

 

 

 

---\\ Internet Explorer toolbars (O3)

O3 - Toolbar: (no name) - [HKLM]{EEE6C35B-6118-11DC-9C72-001320C79847} . (...) -- (.not file.)

O3 - Toolbar: (no name) - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (...) -- (.not file.)

~ Scan Toolbar in 00mn 00s

 

 

 

---\\ Auto loading programs from Registry and folders (O4)

O4 - HKLM\..\Run: [iObit Malware Fighter] . (.IObit - IObit Malware Fighter.) -- C:\Program Files\IObit\IObit Malware Fighter\IMF.exe

O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe

O4 - HKCU\..\Run: [Advanced SystemCare 5] . (.IObit - Advanced SystemCare 5 Tray.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe

O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe

O4 - HKUS\S-1-5-21-233118252-3700368971-1040465616-1000\..\Run: [Advanced SystemCare 5] . (.IObit - Advanced SystemCare 5 Tray.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe

~ Scan Application in 00mn 00s

 

 

 

---\\ Other User Links (O4)

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Angr Birds.lnk . (...) -- C:\Users\Sergio\Documents\Thales\Angry Birds Pc Game

O4 - Global Startup: C:\Users\Sergio\Desktop\ASC - Atalho.lnk . (.IObit.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASC.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\CHROME.lnk . (.Google Inc..) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Computador.lnk - Orphean Key

O4 - Global Startup: C:\Users\Sergio\Desktop\FIFA 11.lnk . (.Electronic Arts.) -- C:\Program Files\EA Sports\FIFA 11\Game\fifa.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Format Factory.lnk . (.Free Time.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\HijackThis - Atalho.lnk . (.Trend Micro Inc..) -- C:\Users\Sergio\Desktop\Downloads\HijackThis.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Painel de Controle - Atalho.lnk - Orphean Key

O4 - Global Startup: C:\Users\Sergio\Desktop\SC - Atalho.lnk - Orphean Key

O4 - Global Startup: C:\Users\Sergio\Desktop\The Sims 3.lnk . (.Electronic Arts, Inc..) -- C:\Program Files\Electronic Arts\The Sims 3\Game\Bin\TS3.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\aTube Catcher.lnk . (.DsNET.) -- C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Fotosizer.lnk . (.Fotosizer.com.) -- C:\Program Files\Fotosizer\Fotosizer.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk . (.Google Inc..) -- C:\Program Files\Google\Picasa3\Picasa3.exe

~ Scan Global Startup in 00mn 00s

 

 

 

---\\ IE Options icon not visible in Control Panel (O5)

O5 - control.ini: [HKLM\..\Control Panel] inetcpl.cpl=no

~ Scan IE Control Panel in 00mn 00s

 

 

 

---\\ Winsock hijacker (Layered Service Provider) (O10)

O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll

O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Provedor de Correção de Nomeação de Emails.) -- C:\Windows\system32\napinsp.dll

O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\Windows\system32\pnrpnsp.dll

O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\Windows\system32\pnrpnsp.dll

O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Provedor de serviços do Microsoft Windows Sockets 2.0.) -- C:\Windows\system32\mswsock.dll

O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll

O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.dll

O10 - WLSP:\000000000008\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.dll

~ Scan Winsock in 00mn 00s

 

 

 

---\\ Extra protocols (O18)

O18 - Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} . (.Microsoft Corporation - Controle ActiveX para streaming de vídeo.) -- C:\Windows\System32\msvidctl.dll

O18 - Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\System32\itss.dll

O18 - Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\Program Files\Windows Live\Messenger\msgrapp.dll

O18 - Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\Windows\system32\inetcomm.dll

O18 - Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\System32\itss.dll

O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\Program Files\Windows Live\Messenger\msgrapp.dll

O18 - Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} . (.Skype Technologies S.A. - Skype Click to Call for Internet Explorer.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\Program Files\Common Files\Skype\Skype4COM.dll

O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} . (.Microsoft Corporation - Controle ActiveX para streaming de vídeo.) -- C:\Windows\System32\msvidctl.dll

O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll

O18 - Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll

O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll

~ Scan Protocole Additionnel in 00mn 00s

 

 

 

---\\ AppInit_DLLs Registry value Autorun (O20)

O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll

~ Scan Winlogon in 00mn 00s

 

 

 

---\\ ShellServiceObjectDelayLoad (O21)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

~ Scan SSODL in 00mn 00s

 

 

 

---\\ non Microsoft non disabled Windows XP/NT/2000 Services (O23)

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) . (.IObit - Advanced SystemCare Service.) - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

O23 - Service: avast! Antivirus (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Google Update Service (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: IMF Service (IMFservice) . (.IObit - IObit Malware Fighter Service.) - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

O23 - Service: Intel® Management and Security Applica (LMS) . (.Intel Corporation - Local Manageability Service.) - C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 260.6.) - C:\Windows\System32\nvvsvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) . (.Unknown owner - RichVideo Module.) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) . (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: Intel® Management and Security Applica (UNS) . (.Intel Corporation - User Notification Service.) - C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: VIA Karaoke digital mixer Service (VIAKaraokeService) . (.VIA Technologies, Inc. - Service binary.) - C:\Windows\System32\viakaraokesrv.exe

~ Scan Services in 00mn 00s

 

 

 

---\\ Windows Active Desktop & MHTML Editor (O24)

O24 - Default MHTML Editor: Last - .(...) - (.not file.)

~ Scan Desktop Component in 00mn 00s

 

 

 

---\\

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

~ Scan Keys in 00mn 00s

 

 

 

---\\ Task Planned Automatically(039)

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Adobe Flash Player Updater.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\AWC Startup.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000Core.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000UA.job

[MD5.A9D3B95E8466BD58EEB8A1154654E162] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

[MD5.B174DE0DE6C9AA8AFFD3B926653E625F] [APT] [avast! Emergency Update] (.AVAST Software.) -- C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe

[MD5.00000000000000000000000000000000] [APT] [AWC Startup] (...) -- C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (.not file.)

[MD5.6E8A4256CEC328029C0D923EADA47F04] [APT] [CCleanerSkipUAC] (.Piriform Ltd.) -- C:\Program Files\CCleaner\CCleaner.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000Core] (.Google Inc..) -- C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000UA] (.Google Inc..) -- C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

[MD5.00000000000000000000000000000000] [APT] [Your File Updater] (...) -- C:\Program Files\YourFileDownloader\YourFileUpdater.exe (.not file.)

[MD5.92B476DD52794881A4B91A5529C2706B] [APT] [{06813D29-5971-421C-9BB7-F11B97330C4D}] (...) -- C:\Program Files\AVAST Software\Avast\aswRundll.exe

[MD5.2339760B238226DAD9ED03F939D92323] [APT] [{0A863E78-F2F5-48AD-91F3-089BA4C4FF87}] (.Google Inc..) -- c:\users\Sergio\appdata\local\google\chrome\application\chrome.exe

[MD5.00000000000000000000000000000000] [APT] [{23871746-E748-4EAB-8F71-56D591FE1CCA}] (...) -- D:\SETUP.exe (.not file.)

[MD5.00000000000000000000000000000000] [APT] [{AB3101C9-BCDC-46F3-A8F0-022C19D1F841}] (...) -- D:\SETUP.exe (.not file.)

~ Scan Scheduled Task in 00mn 01s

 

 

 

---\\ ActiveSetup Installed Components (O40)

O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\Windows\System32\wmploc.dll

O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe

O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} . (.Microsoft Corporation - Identidade visual IEAK.) -- C:\Windows\System32\iedkcs32.dll

O40 - ASIC: Microsoft Windows Media Player 12.0 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\Windows\System32\wmpdxm.dll

O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API de tema do Windows.) -- C:\Windows\System32\themeui.dll

O40 - ASIC: Microsoft Windows - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe

O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extensão shell da pasta FTP do Microsoft Internet Explorer.) -- C:\Windows\System32\msieftp.dll

O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\Windows\System32\wmploc.dll

O40 - ASIC: Windows Desktop Update - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL comum do Shell do Windows.) -- C:\Windows\System32\shell32.dll

O40 - ASIC: Web Platform Customizations - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe

O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\Windows\system32\mscories.dll

~ Scan Active Setup in 00mn 00s

 

 

 

---\\ Drivers launched at startup (O41)

O41 - Driver: C:\Windows\System32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys

O41 - Driver: (aswRdr) . (.AVAST Software - avast! WFP Redirect Driver.) - C:\Windows\system32\Drivers\aswrdr2.sys

O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\system32\drivers\blbdrive.sys

O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys

O41 - Driver: C:\Windows\System32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys

O41 - Driver: C:\Windows\System32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys

O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\system32\drivers\mssmbios.sys

O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys

O41 - Driver: C:\Windows\System32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys

O41 - Driver: C:\Windows\System32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys

O41 - Driver: C:\Windows\System32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Agendador de pacotes de serviço.) - C:\Windows\System32\DRIVERS\pacer.sys

O41 - Driver: C:\Windows\System32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Driver do Subsistema de Buffer da Unidade R.) - C:\Windows\System32\DRIVERS\rdbss.sys

O41 - Driver: C:\Windows\System32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys

O41 - Driver: C:\Windows\System32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys

O41 - Driver: C:\Windows\System32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys

O41 - Driver: C:\Windows\System32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys

O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\system32\drivers\termdd.sys

O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys

O41 - Driver: C:\Windows\System32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys

O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys

~ Scan Drivers in 00mn 00s

 

 

 

---\\ Software installed (O42)

O42 - Logiciel: Adobe Flash Player 11 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX

O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin

O42 - Logiciel: Adobe Reader X (10.1.4) - Português - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1046-7B44-AA1000000001}

O42 - Logiciel: Adobe Shockwave Player 11.6 - (.Adobe Systems, Inc..) [HKLM] -- Adobe Shockwave Player

O42 - Logiciel: Advanced SystemCare 5 - (.IObit.) [HKLM] -- Advanced SystemCare 5_is1

O42 - Logiciel: BrOffice 3.3 - (.LibreOffice.) [HKLM] -- {3D33A4EB-957B-4212-BF0D-7F7FB02F1BE3}

O42 - Logiciel: BrOffice 3.3 Help Pack (Portuguese (Brazil)) - (.LibreOffice.) [HKLM] -- {8519EEBE-0090-4C86-8AF6-FDCABBB26E96}

O42 - Logiciel: Brothers In Arms - (.Ubisoft.) [HKLM] -- BrothersInArms

O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner

O42 - Logiciel: Controle ActiveX do Windows Live Mesh para Conexões Remotas - (.Microsoft Corporation.) [HKLM] -- {39B3184E-0BFB-40FA-ADDC-E7E2D535CDA9}

O42 - Logiciel: D3DX10 - (.Microsoft.) [HKLM] -- {E09C4DB7-630C-4F06-A631-8EA7239923AF}

O42 - Logiciel: DVD Suite - (.CyberLink Corporation.) [HKLM] -- {1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}

O42 - Logiciel: EF Englishtown Advanced Speech Recognition versão 4.6.449.1 - (.Shanghai Kingtas Technology Co., Ltd..) [HKLM] -- EF Englishtown Advanced Speech Recognition_is1

O42 - Logiciel: FIFA 11 - (.Electronic Arts.) [HKLM] -- {3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}

O42 - Logiciel: FM Screen Capture Codec (Remove Only) - (.Unknown owner.) [HKLM] -- FMCODEC

O42 - Logiciel: FormatFactory 2.90 - (.Free Time.) [HKLM] -- FormatFactory

O42 - Logiciel: Fotosizer 1.32 - (.Fotosizer.com.) [HKLM] -- Fotosizer

O42 - Logiciel: GetDataBack for NTFS - (.Runtime Software.) [HKLM] -- {56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}

O42 - Logiciel: Google Chrome - (.Google Inc..) [HKCU] -- Google Chrome

O42 - Logiciel: Google Earth Plug-in - (.Google.) [HKLM] -- {33286280-8617-11E1-8FF6-B8AC6F97B88E}

O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

O42 - Logiciel: IObit Malware Fighter - (.IObit.) [HKLM] -- IObit Malware Fighter_is1

O42 - Logiciel: Intel® Management Engine Components - (.Intel Corporation.) [HKLM] -- {65153EA5-8B6E-43B6-857B-C6E4FC25798A}

O42 - Logiciel: Internet Explorer Toolbar 4.6 by SweetPacks - (.SweetIM Technologies Ltd..) [HKLM] -- {C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}

O42 - Logiciel: Java 7 Update 5 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83217005FF}

O42 - Logiciel: JavaFX 2.1.1 - (.Oracle Corporation.) [HKLM] -- {1111706F-666A-4037-7777-211328764D10}

O42 - Logiciel: K-Lite Mega Codec Pack 5.5.1 - (.Unknown owner.) [HKLM] -- KLiteCodecPack_is1

O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}

O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile PTB Language Pack - (.Microsoft Corporation.) [HKLM] -- {20A15757-4AE4-3C82-9711-863C84AFE6AA}

O42 - Logiciel: Microsoft Office Word Viewer 2003 - (.Microsoft Corporation.) [HKLM] -- {90850409-6000-11D3-8CFE-0150048383C9}

O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}

O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - (.Microsoft Corporation.) [HKLM] -- {9BE518E6-ECC6-35A9-88E4-87755C07200F}

O42 - Logiciel: Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 - (.Microsoft Corporation.) [HKLM] -- {196BB40D-1578-3D01-B289-BEFC77A11A1E}

O42 - Logiciel: Microsoft WSE 3.0 Runtime - (.Microsoft Corp..) [HKLM] -- {E3E71D07-CD27-46CB-8448-16D4FB29AA13}

O42 - Logiciel: MiniTool Power Data Recovery - (.MiniTool Solution Ltd..) [HKLM] -- MiniTool Power Data Recovery_is1

O42 - Logiciel: Mozilla Firefox 12.0 (x86 pt-BR) - (.Mozilla.) [HKLM] -- Mozilla Firefox 12.0 (x86 pt-BR)

O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM] -- MozillaMaintenanceService

O42 - Logiciel: NVIDIA Driver de gráficos 260.63 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver

O42 - Logiciel: NVIDIA Driver de áudio HD 1.1.9.0 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver

O42 - Logiciel: NVIDIA Driver do 3D Vision 260.63 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision

O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM] -- {B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}

O42 - Logiciel: NVIDIA Software do sistema PhysX 9.10.0514 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX

O42 - Logiciel: NVIDIA Stereoscopic 3D Driver - (.NVIDIA Corporation.) [HKLM] -- NVIDIAStereo

O42 - Logiciel: Nero 7 Essentials - (.Nero AG.) [HKLM] -- {9B4E6CB9-E54D-47F7-A414-E2D5740E1046}

O42 - Logiciel: PC Camera - (.PixArt.) [HKLM] -- {B2920232-19DA-44FC-835F-68E427EAE2CE}

O42 - Logiciel: Pacote de Idiomas do Microsoft .NET Framework 4 Client Profile - Português - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile PTB Language Pack

O42 - Logiciel: Picasa 3 - (.Google, Inc..) [HKLM] -- Picasa 3

O42 - Logiciel: PowerDVD - (.CyberLink Corporation.) [HKLM] -- {6811CAA0-BF12-11D4-9EA1-0050BAE317E1}

O42 - Logiciel: Project64 1.6 - (.Project64.) [HKLM] -- {9559F7CA-5E34-4237-A2D9-D856464AD727}

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2604121

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656351

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656368v2

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656405

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2686827

O42 - Logiciel: Skype Click to Call - (.Skype Technologies S.A..) [HKLM] -- {B6CF2967-C81E-40C0-9815-C05774FEF120}

O42 - Logiciel: Skype™ 5.10 - (.Skype Technologies S.A..) [HKLM] -- {EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}

O42 - Logiciel: Speccy - (.Piriform.) [HKLM] -- Speccy

O42 - Logiciel: The Sims™ 3 - (.Electronic Arts.) [HKLM] -- {C05D8CDB-417D-4335-A38C-A0659EDFD6B8}

O42 - Logiciel: Unity Web Player - (.Unity Technologies ApS.) [HKCU] -- UnityWebPlayer

O42 - Logiciel: Update Manager for SweetPacks 1.1 - (.SweetIM Technologies Ltd..) [HKLM] -- {EA8FA6BE-29BE-4AF2-9352-841F83215EB0}

O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2468871) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871

O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2533523) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523

O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2600217) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217

O42 - Logiciel: VIA Gerenciador de dispositivo de plataforma - (.VIA Technologies, Inc..) [HKLM] -- InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}

O42 - Logiciel: WinRAR 4.01 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver

O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {D45240D3-B6B3-4FF9-B243-54ECE3E10066}

O42 - Logiciel: Windows Live Essentials - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite

O42 - Logiciel: Windows Live Essentials - (.Microsoft Corporation.) [HKLM] -- {43B43577-2514-4CE0-B14A-7E85C17C0453}

O42 - Logiciel: Windows Live Family Safety - (.Microsoft Corporation.) [HKLM] -- {2922DB34-682F-4A9C-BE18-6E579DBD1420}

O42 - Logiciel: Windows Live Family Safety - (.Microsoft Corporation.) [HKLM] -- {2D6E3D97-1FDF-4993-AC75-72F59EC445C5}

O42 - Logiciel: Windows Live Galeria de Fotos - (.Microsoft Corporation.) [HKLM] -- {F7A46527-DF1F-4B0F-9637-98547E189442}

O42 - Logiciel: Windows Live ID Sign-in Assistant - (.Microsoft Corporation.) [HKLM] -- {C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}

O42 - Logiciel: Windows Live Installer - (.Microsoft Corporation.) [HKLM] -- {0B0F231F-CE6A-483D-AA23-77B364F75917}

O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {C9E1343D-E21E-4508-A1BE-04A089EC137D}

O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {E5B21F11-6933-4E0B-A25C-7963E3C07D11}

O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {92EA4134-10D1-418A-91E1-5A0453131A38}

O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}

O42 - Logiciel: Windows Live PIMT Platform - (.Microsoft Corporation.) [HKLM] -- {83C292B7-38A5-440B-A731-07070E81A64F}

O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM] -- {A9BDCA6B-3653-467B-AC83-94367DA3BFE3}

O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM] -- {B33B61FE-701F-425F-98AB-2B85725CBF68}

O42 - Logiciel: Windows Live Photo Gallery - (.Microsoft Corporation.) [HKLM] -- {3336F667-9049-4D46-98B6-4C743EEBC5B1}

O42 - Logiciel: Windows Live SOXE - (.Microsoft Corporation.) [HKLM] -- {682B3E4F-696A-42DE-A41C-4C07EA1678B4}

O42 - Logiciel: Windows Live SOXE Definitions - (.Microsoft Corporation.) [HKLM] -- {200FEC62-3C34-4D60-9CE8-EC372E01C08F}

O42 - Logiciel: Windows Live UX Platform - (.Microsoft Corporation.) [HKLM] -- {CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}

O42 - Logiciel: Windows Live UX Platform Language Pack - (.Microsoft Corporation.) [HKLM] -- {DF71ABBB-B834-41C0-BB58-80B0545D754C}

O42 - Logiciel: Windows Media Player Firefox Plugin - (.Microsoft Corp.) [HKLM] -- {69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

O42 - Logiciel: aTube Catcher - (.DsNET Corp.) [HKLM] -- aTube Catcher

O42 - Logiciel: avast! Free Antivirus v7.0.1466.0 - (.AVAST Software.) [HKLM] -- avast

O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}

O42 - Logiciel: swMSM - (.Adobe Systems, Inc.) [HKLM] -- {612C34C7-5E90-47D8-9B5C-0F717DD82726}

O42 - Logiciel: upapp - (.Hewlett-Packard.) [HKLM] -- {4EF69D40-4DC9-485E-95D3-B1C22F218FC8}

 

---\\ HKCU & HKLM Software Keys

[HKCU\Software\AVAST Software]

[HKCU\Software\Adobe]

[HKCU\Software\Afom]

[HKCU\Software\Ahead]

[HKCU\Software\AppDataLow\Software\Adobe]

[HKCU\Software\AppDataLow\Software\Microsoft]

[HKCU\Software\AppDataLow\Software\Smartbar]

[HKCU\Software\AppDataLow\Software\Unity]

[HKCU\Software\AppDataLow\Software\fastestd]

[HKCU\Software\AppDataLow\Software]

[HKCU\Software\AppDataLow]

[HKCU\Software\Bugsplat]

[HKCU\Software\Classes]

[HKCU\Software\Clients]

[HKCU\Software\Conduit]

[HKCU\Software\Convar]

[HKCU\Software\CyberLink]

[HKCU\Software\DivXNetworks]

[HKCU\Software\DsNET Corp.]

[HKCU\Software\EA Sports]

[HKCU\Software\Electronic Arts]

[HKCU\Software\Fastest Free YouTube Downloader]

[HKCU\Software\Fotosizer]

[HKCU\Software\FreeTime]

[HKCU\Software\GNU]

[HKCU\Software\GSpot Appliance Corp]

[HKCU\Software\Gabest]

[HKCU\Software\Google]

[HKCU\Software\Haali]

[HKCU\Software\IM Providers]

[HKCU\Software\INCAInternet]

[HKCU\Software\JaboSoft]

[HKCU\Software\JavaSoft]

[HKCU\Software\Leadertech]

[HKCU\Software\LibreOffice]

[HKCU\Software\Local AppWizard-Generated Applications]

[HKCU\Software\MONOGRAM]

[HKCU\Software\Macromedia]

[HKCU\Software\MediaInfo]

[HKCU\Software\MozillaPlugins]

[HKCU\Software\N64 Emulation]

[HKCU\Software\NVIDIA Corporation]

[HKCU\Software\Netscape]

[HKCU\Software\Opera Software]

[HKCU\Software\PS2Eplugin]

[HKCU\Software\Piriform]

[HKCU\Software\Policies]

[HKCU\Software\RealNetworks]

[HKCU\Software\SecuROM]

[HKCU\Software\SkypeRS]

[HKCU\Software\Skype]

[HKCU\Software\SweetIM]

[HKCU\Software\Trolltech]

[HKCU\Software\Ubisoft]

[HKCU\Software\Unity]

[HKCU\Software\VB and VBA Program Settings]

[HKCU\Software\Valve]

[HKCU\Software\WinRAR SFX]

[HKCU\Software\WinRAR]

[HKCU\Software\YourFileDownloader]

[HKCU\Software\eBook Maestro Books]

[HKCU\Software\madFlac]

[HKLM\Software\685D6D1C-D73A-4F37-B7E5E53660311DDB]

[HKLM\Software\AGEIA Technologies]

[HKLM\Software\ATI Technologies]

[HKLM\Software\AVAST Software]

[HKLM\Software\Adobe]

[HKLM\Software\Ahead]

[HKLM\Software\AppDataLow]

[HKLM\Software\AviSynth]

[HKLM\Software\Babylon]

[HKLM\Software\CBSTEST]

[HKLM\Software\Classes]

[HKLM\Software\Clients]

[HKLM\Software\Codec Tweak Tool]

[HKLM\Software\CyberLink]

[HKLM\Software\DivXNetworks]

[HKLM\Software\EA Sports]

[HKLM\Software\Electronic Arts]

[HKLM\Software\GNU]

[HKLM\Software\Google]

[HKLM\Software\HaaliMkx]

[HKLM\Software\Hewlett-Packard]

[HKLM\Software\Huawei technologies]

[HKLM\Software\IObit]

[HKLM\Software\InstallShield]

[HKLM\Software\Intel]

[HKLM\Software\JavaSoft]

[HKLM\Software\JreMetrics]

[HKLM\Software\KLCodecPack]

[HKLM\Software\Khronos]

[HKLM\Software\Lake]

[HKLM\Software\LexmarkLaser]

[HKLM\Software\LibreOffice]

[HKLM\Software\Licenses]

[HKLM\Software\LightComm]

[HKLM\Software\Macromedia]

[HKLM\Software\MozillaPlugins]

[HKLM\Software\Mozilla]

[HKLM\Software\NVIDIA Corporation]

[HKLM\Software\Nero]

[HKLM\Software\ODBC]

[HKLM\Software\Oracle]

[HKLM\Software\Piriform]

[HKLM\Software\PixArt]

[HKLM\Software\Policies]

[HKLM\Software\QSound Labs, Inc.]

[HKLM\Software\RTS]

[HKLM\Software\RealNetworks]

[HKLM\Software\RegisteredApplications]

[HKLM\Software\Runtime Software]

[HKLM\Software\S3R521]

[HKLM\Software\Sims]

[HKLM\Software\Skype]

[HKLM\Software\Software]

[HKLM\Software\SweetIM]

[HKLM\Software\Systweak]

[HKLM\Software\TrendMicro]

[HKLM\Software\Ubisoft]

[HKLM\Software\Uniblue]

[HKLM\Software\VIA Technologies, Inc]

[HKLM\Software\WOW6432Node]

[HKLM\Software\WinRAR]

[HKLM\Software\YourFileDownloader]

[HKLM\Software\mozilla.org]

[HKLM\Software\v9magic]

~ Scan Softwares in 00mn 00s

 

 

 

---\\ Contents of the Common Files folders (O43)

O43 - CFD: 25/07/2011 - 10:51:41 - [111,709] ----D C:\Program Files\Adobe

O43 - CFD: 23/07/2011 - 13:46:33 - [0] R---D C:\Program Files\Arquivos Comuns

O43 - CFD: 01/09/2012 - 19:38:24 - [245,643] ----D C:\Program Files\AVAST Software

O43 - CFD: 14/04/2012 - 14:53:53 - [-1245,451] ----D C:\Program Files\BrothersInArms

O43 - CFD: 26/08/2012 - 17:50:50 - [4,684] ----D C:\Program Files\CCleaner

O43 - CFD: 23/07/2012 - 01:49:36 - [198,470] ----D C:\Program Files\Common Files

O43 - CFD: 05/04/2012 - 17:30:23 - [2,699] ----D C:\Program Files\Convar

O43 - CFD: 04/07/2011 - 17:21:03 - [96,490] ----D C:\Program Files\CyberLink

O43 - CFD: 14/04/2012 - 14:43:52 - [0] ----D C:\Program Files\DealPly

O43 - CFD: 26/07/2012 - 17:49:25 - [37,418] ----D C:\Program Files\DsNET Corp

O43 - CFD: 20/11/2010 - 23:33:04 - [3,997] ----D C:\Program Files\DVD Maker

O43 - CFD: 27/12/2011 - 19:30:52 - [-1940,999] ----D C:\Program Files\EA Sports

O43 - CFD: 24/07/2011 - 19:51:33 - [1517,861] ----D C:\Program Files\Electronic Arts

O43 - CFD: 26/07/2012 - 00:13:19 - [25,815] ----D C:\Program Files\FormatFactory

O43 - CFD: 31/08/2011 - 22:31:08 - [4,091] ----D C:\Program Files\Fotosizer

O43 - CFD: 23/07/2011 - 23:09:47 - [111,406] ----D C:\Program Files\FreeTime

O43 - CFD: 02/08/2012 - 22:56:13 - [146,877] ----D C:\Program Files\Google

O43 - CFD: 13/08/2011 - 23:00:59 - [1,287] ----D C:\Program Files\Hewlett-Packard

O43 - CFD: 27/12/2011 - 10:25:51 - [1,021] ----D C:\Program Files\hp deskjet 3420 series

O43 - CFD: 26/08/2012 - 17:58:41 - [1,469] --H-D C:\Program Files\InstallJammer Registry

O43 - CFD: 23/07/2012 - 00:54:28 - [19,068] --H-D C:\Program Files\InstallShield Installation Information

O43 - CFD: 04/07/2011 - 16:47:30 - [10,574] ----D C:\Program Files\Intel

O43 - CFD: 01/09/2012 - 19:32:44 - [4,929] ----D C:\Program Files\Internet Explorer

O43 - CFD: 30/06/2012 - 17:56:17 - [248,585] ----D C:\Program Files\IObit

O43 - CFD: 23/07/2012 - 01:45:44 - [176,542] ----D C:\Program Files\Java

O43 - CFD: 24/07/2011 - 19:44:21 - [63,447] ----D C:\Program Files\K-Lite Codec Pack

O43 - CFD: 06/03/2012 - 10:58:50 - [0,075] ----D C:\Program Files\Lexmark

O43 - CFD: 27/07/2011 - 12:39:37 - [462,377] ----D C:\Program Files\LibreOffice 3

O43 - CFD: 14/07/2009 - 01:52:30 - [44,793] ----D C:\Program Files\Microsoft Games

O43 - CFD: 24/07/2011 - 00:56:42 - [11,281] ----D C:\Program Files\Microsoft Office

O43 - CFD: 18/05/2012 - 12:41:09 - [40,838] ----D C:\Program Files\Microsoft Silverlight

O43 - CFD: 04/07/2011 - 15:20:48 - [1,745] ----D C:\Program Files\Microsoft SQL Server Compact Edition

O43 - CFD: 24/07/2011 - 20:20:47 - [0,934] ----D C:\Program Files\Microsoft WSE

O43 - CFD: 10/07/2012 - 09:44:18 - [0,015] ----D C:\Program Files\Microsoft.NET

O43 - CFD: 25/05/2012 - 15:22:30 - [40,391] ----D C:\Program Files\Mozilla Firefox

O43 - CFD: 25/05/2012 - 15:22:33 - [0,210] ----D C:\Program Files\Mozilla Maintenance Service

O43 - CFD: 16/03/2012 - 17:11:29 - [0,224] ----D C:\Program Files\Mozilla Thunderbird

O43 - CFD: 14/07/2009 - 01:52:30 - [0,025] ----D C:\Program Files\MSBuild

O43 - CFD: 24/07/2011 - 00:56:26 - [25,894] ----D C:\Program Files\MSECache

O43 - CFD: 14/05/2012 - 20:00:19 - [0] ----D C:\Program Files\MSXML 4.0

O43 - CFD: 04/07/2011 - 17:23:18 - [179,641] ----D C:\Program Files\Nero

O43 - CFD: 23/07/2011 - 13:58:51 - [297,892] ----D C:\Program Files\NVIDIA Corporation

O43 - CFD: 05/05/2012 - 19:07:10 - [0,000] ----D C:\Program Files\Opera

O43 - CFD: 23/07/2012 - 01:46:55 - [33,207] ----D C:\Program Files\Oracle

O43 - CFD: 04/06/2012 - 23:39:11 - [0] ----D C:\Program Files\Pando Networks

O43 - CFD: 23/07/2012 - 04:09:56 - [6,869] ----D C:\Program Files\PC Inspector File Recovery

O43 - CFD: 17/03/2012 - 23:35:24 - [0,086] ----D C:\Program Files\PDF Printer Pilot Pro

O43 - CFD: 17/03/2012 - 23:47:08 - [8,929] ----D C:\Program Files\PDFCreator

O43 - CFD: 02/07/2012 - 16:12:05 - [0,003] ----D C:\Program Files\PhotoScape

O43 - CFD: 31/07/2011 - 22:27:09 - [0,152] ----D C:\Program Files\PixArt

O43 - CFD: 24/07/2012 - 00:07:38 - [16,381] ----D C:\Program Files\PowerDataRecovery

O43 - CFD: 12/11/2011 - 19:26:02 - [3,364] ----D C:\Program Files\Project64 1.6

O43 - CFD: 22/07/2012 - 21:05:06 - [9,208] ----D C:\Program Files\PSafe

O43 - CFD: 14/07/2009 - 01:52:30 - [37,262] ----D C:\Program Files\Reference Assemblies

O43 - CFD: 23/07/2012 - 04:09:40 - [4,388] ----D C:\Program Files\Runtime Software

O43 - CFD: 22/07/2012 - 21:05:07 - [33,200] R---D C:\Program Files\Skype

O43 - CFD: 05/04/2012 - 20:02:51 - [0,444] ----D C:\Program Files\Sony

O43 - CFD: 25/07/2011 - 20:36:18 - [4,347] ----D C:\Program Files\Speccy

O43 - CFD: 01/09/2012 - 19:32:41 - [0] ----D C:\Program Files\Spyware Terminator

O43 - CFD: 01/10/2011 - 22:53:53 - [0,000] ----D C:\Program Files\Stellar Phoenix Photo Recovery

O43 - CFD: 04/09/2012 - 20:56:31 - [6,634] ----D C:\Program Files\SweetIM

O43 - CFD: 21/03/2012 - 22:49:16 - [12,875] ----D C:\Program Files\Talkpal

O43 - CFD: 14/07/2009 - 01:53:23 - [0] --H-D C:\Program Files\Uninstall Information

O43 - CFD: 01/09/2012 - 19:32:42 - [0,779] ----D C:\Program Files\v9Soft

O43 - CFD: 04/07/2011 - 17:02:42 - [24,170] ----D C:\Program Files\VIA

O43 - CFD: 27/02/2012 - 09:08:20 - [0,010] ----D C:\Program Files\VSLogonScreenCustomizer

O43 - CFD: 20/11/2010 - 23:33:03 - [2,897] ----D C:\Program Files\Windows Defender

O43 - CFD: 09/07/2012 - 20:10:17 - [119,631] ----D C:\Program Files\Windows Live

O43 - CFD: 06/03/2012 - 10:58:56 - [5,870] ----D C:\Program Files\Windows Mail

O43 - CFD: 17/03/2012 - 23:47:08 - [6,286] ----D C:\Program Files\Windows Media Player

O43 - CFD: 23/07/2011 - 13:46:33 - [11,630] ----D C:\Program Files\Windows NT

O43 - CFD: 20/11/2010 - 23:33:04 - [4,210] ----D C:\Program Files\Windows Photo Viewer

O43 - CFD: 20/11/2010 - 18:33:48 - [0,181] ----D C:\Program Files\Windows Portable Devices

O43 - CFD: 06/03/2012 - 10:58:50 - [5,900] ----D C:\Program Files\Windows Sidebar

O43 - CFD: 23/07/2011 - 23:03:31 - [5,206] ----D C:\Program Files\WinRAR

O43 - CFD: 04/09/2012 - 21:51:23 - [10,038] ----D C:\Program Files\ZHPDiag

O43 - CFD: 25/07/2011 - 10:51:46 - [3,721] ----D C:\Program Files\Common Files\Adobe

O43 - CFD: 04/07/2011 - 17:25:15 - [83,324] ----D C:\Program Files\Common Files\Ahead

O43 - CFD: 04/07/2011 - 17:20:40 - [4,657] ----D C:\Program Files\Common Files\InstallShield

O43 - CFD: 23/07/2012 - 01:49:36 - [1,181] ----D C:\Program Files\Common Files\Java

O43 - CFD: 17/03/2012 - 23:47:08 - [38,431] ----D C:\Program Files\Common Files\microsoft shared

O43 - CFD: 17/03/2012 - 23:47:08 - [15,994] ----D C:\Program Files\Common Files\PAC7302

O43 - CFD: 04/07/2011 - 16:47:34 - [0,155] ----D C:\Program Files\Common Files\postureAgent

O43 - CFD: 13/07/2009 - 23:37:05 - [0,003] ----D C:\Program Files\Common Files\Services

O43 - CFD: 23/07/2011 - 13:46:33 - [0] ----D C:\Program Files\Common Files\Sistema

O43 - CFD: 22/07/2012 - 21:05:07 - [2,056] ----D C:\Program Files\Common Files\Skype

O43 - CFD: 13/07/2009 - 23:37:05 - [39,200] ----D C:\Program Files\Common Files\SpeechEngines

O43 - CFD: 09/05/2012 - 23:50:26 - [9,748] ----D C:\Program Files\Common Files\System

O43 - CFD: 04/07/2011 - 15:18:39 - [0] ----D C:\Program Files\Common Files\Windows Live

O43 - CFD: 08/10/2011 - 12:00:12 - [168,998] ----D C:\ProgramData\Adobe

O43 - CFD: 04/07/2011 - 17:25:20 - [0,000] ----D C:\ProgramData\Ahead

O43 - CFD: 06/03/2012 - 10:57:48 - [4,056] ----D C:\ProgramData\AlawarWrapper

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Application Data

O43 - CFD: 26/07/2012 - 17:48:11 - [3,966] ----D C:\ProgramData\Ask

O43 - CFD: 01/09/2012 - 19:38:24 - [2,044] ----D C:\ProgramData\AVAST Software

O43 - CFD: 05/04/2012 - 17:24:17 - [0] ----D C:\ProgramData\Babylon

O43 - CFD: 17/02/2012 - 21:50:46 - [0] ----D C:\ProgramData\CasualForge

O43 - CFD: 23/07/2011 - 23:30:30 - [0,023] ----D C:\ProgramData\CyberLink

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Dados de aplicativos

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Desktop

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Documentos

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Documents

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Favorites

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Favoritos

O43 - CFD: 04/07/2011 - 17:04:28 - [0,001] ----D C:\ProgramData\Intel

O43 - CFD: 01/09/2012 - 19:32:42 - [0,000] ----D C:\ProgramData\IObit

O43 - CFD: 03/01/2012 - 11:36:56 - [0,037] ----D C:\ProgramData\lightcomm

O43 - CFD: 25/07/2011 - 09:49:56 - [0] ----D C:\ProgramData\McAfee

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Menu Iniciar

O43 - CFD: 06/03/2012 - 10:57:49 - [499,610] -S--D C:\ProgramData\Microsoft

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Modelos

O43 - CFD: 25/05/2012 - 15:22:32 - [0,000] ----D C:\ProgramData\Mozilla

O43 - CFD: 17/01/2012 - 08:24:03 - [0,014] ----D C:\ProgramData\NCH Swift Sound

O43 - CFD: 04/07/2011 - 17:23:18 - [4,715] ----D C:\ProgramData\Nero

O43 - CFD: 04/09/2012 - 21:38:48 - [1,929] ----D C:\ProgramData\NVIDIA

O43 - CFD: 23/07/2011 - 13:56:16 - [0,512] ----D C:\ProgramData\NVIDIA Corporation

O43 - CFD: 03/01/2012 - 11:36:56 - [0,075] ----D C:\ProgramData\OI

O43 - CFD: 22/07/2012 - 19:44:01 - [24,665] ----D C:\ProgramData\PSafe

O43 - CFD: 08/10/2011 - 12:00:12 - [0,002] ----D C:\ProgramData\regid.1986-12.com.adobe

O43 - CFD: 26/07/2012 - 15:59:48 - [50,058] ----D C:\ProgramData\Skype

O43 - CFD: 01/09/2012 - 19:32:41 - [0] ----D C:\ProgramData\Spyware Terminator

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Start Menu

O43 - CFD: 06/03/2012 - 22:58:56 - [0,000] ----D C:\ProgramData\Sun

O43 - CFD: 01/10/2011 - 00:39:16 - [0] ---AD C:\ProgramData\TEMP

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Templates

O43 - CFD: 18/11/2011 - 14:28:19 - [0] ----D C:\ProgramData\Web Installer

O43 - CFD: 17/03/2012 - 23:41:09 - [0] ----D C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

O43 - CFD: 08/10/2011 - 12:00:23 - [5,099] ----D C:\Users\Sergio\AppData\Roaming\Adobe

O43 - CFD: 20/08/2011 - 15:16:02 - [0,044] ----D C:\Users\Sergio\AppData\Roaming\Ahead

O43 - CFD: 31/01/2012 - 21:57:11 - [0,006] ----D C:\Users\Sergio\AppData\Roaming\Audacity

O43 - CFD: 05/04/2012 - 17:24:17 - [0,019] ----D C:\Users\Sergio\AppData\Roaming\Babylon

O43 - CFD: 17/02/2012 - 21:50:46 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\CasualForge

O43 - CFD: 23/07/2011 - 23:30:09 - [0,006] ----D C:\Users\Sergio\AppData\Roaming\CyberLink

O43 - CFD: 14/04/2012 - 12:21:29 - [0,055] ----D C:\Users\Sergio\AppData\Roaming\Gearbox Software

O43 - CFD: 18/11/2011 - 14:52:08 - [0] ----D C:\Users\Sergio\AppData\Roaming\GetRightToGo

O43 - CFD: 20/11/2010 - 17:57:14 - [0] ----D C:\Users\Sergio\AppData\Roaming\Identities

O43 - CFD: 30/06/2012 - 23:37:25 - [10,676] ----D C:\Users\Sergio\AppData\Roaming\IObit

O43 - CFD: 27/12/2011 - 19:44:37 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Leadertech

O43 - CFD: 27/07/2011 - 12:37:17 - [22,836] ----D C:\Users\Sergio\AppData\Roaming\LibreOffice

O43 - CFD: 20/02/2012 - 19:59:11 - [0] ----D C:\Users\Sergio\AppData\Roaming\LOKIBIT.COM

O43 - CFD: 23/07/2011 - 23:40:53 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Macromedia

O43 - CFD: 01/09/2012 - 20:09:34 - [0] ----D C:\Users\Sergio\AppData\Roaming\Media Player Classic

O43 - CFD: 16/03/2012 - 16:49:41 - [4,700] -S--D C:\Users\Sergio\AppData\Roaming\Microsoft

O43 - CFD: 14/04/2012 - 23:24:55 - [4,942] ----D C:\Users\Sergio\AppData\Roaming\Mozilla

O43 - CFD: 22/07/2012 - 23:27:34 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\OfficeRecovery

O43 - CFD: 05/05/2012 - 19:07:08 - [0] ----D C:\Users\Sergio\AppData\Roaming\Opera

O43 - CFD: 26/07/2012 - 00:37:52 - [0] ----D C:\Users\Sergio\AppData\Roaming\OxelonMC

O43 - CFD: 14/03/2012 - 22:41:41 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\pdfforge

O43 - CFD: 02/07/2012 - 15:34:59 - [0,040] ----D C:\Users\Sergio\AppData\Roaming\PhotoScape

O43 - CFD: 29/12/2011 - 11:58:06 - [0] ----D C:\Users\Sergio\AppData\Roaming\Real

O43 - CFD: 17/09/2011 - 21:47:10 - [0,014] ----D C:\Users\Sergio\AppData\Roaming\Rovio

O43 - CFD: 02/09/2012 - 15:47:56 - [16,124] ----D C:\Users\Sergio\AppData\Roaming\Skype

O43 - CFD: 09/10/2011 - 22:19:51 - [9,534] ----D C:\Users\Sergio\AppData\Roaming\Thinstall

O43 - CFD: 25/07/2011 - 00:50:16 - [0,426] ----D C:\Users\Sergio\AppData\Roaming\Thunderbird

O43 - CFD: 22/10/2011 - 19:54:19 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Unity

O43 - CFD: 20/07/2012 - 15:27:40 - [1,383] ----D C:\Users\Sergio\AppData\Roaming\uTorrent

O43 - CFD: 23/07/2011 - 23:09:35 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\WinRAR

O43 - CFD: 22/07/2012 - 23:15:20 - [0] ----D C:\Users\Sergio\AppData\Roaming\YourFileDownloader

O43 - CFD: 03/01/2012 - 12:15:13 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Youtube Downloader HD

O43 - CFD: 08/10/2011 - 12:00:30 - [14,826] ----D C:\Users\Sergio\AppData\Local\Adobe

O43 - CFD: 25/07/2011 - 19:36:02 - [1,860] ----D C:\Users\Sergio\AppData\Local\Ahead

O43 - CFD: 23/07/2012 - 00:02:56 - [2,736] ----D C:\Users\Sergio\AppData\Local\Apps

O43 - CFD: 23/07/2011 - 13:46:55 - [0] ----D C:\Users\Sergio\AppData\Local\Dados de aplicativos

O43 - CFD: 06/03/2012 - 12:31:09 - [0] ----D C:\Users\Sergio\AppData\Local\Deployment

O43 - CFD: 22/08/2012 - 21:20:40 - [6,359] ----D C:\Users\Sergio\AppData\Local\Diagnostics

O43 - CFD: 26/08/2012 - 17:57:15 - [0,673] ----D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics

O43 - CFD: 17/01/2012 - 10:19:35 - [0,059] ----D C:\Users\Sergio\AppData\Local\Facebook

O43 - CFD: 30/06/2012 - 17:56:21 - [1171,840] ----D C:\Users\Sergio\AppData\Local\Google

O43 - CFD: 23/07/2011 - 13:46:55 - [0] ----D C:\Users\Sergio\AppData\Local\Histórico

O43 - CFD: 05/07/2012 - 20:59:56 - [0] ----D C:\Users\Sergio\AppData\Local\Macromedia

O43 - CFD: 03/05/2012 - 21:25:14 - [551,285] ----D C:\Users\Sergio\AppData\Local\Microsoft

O43 - CFD: 18/12/2011 - 20:48:53 - [0,659] ----D C:\Users\Sergio\AppData\Local\Microsoft Games

O43 - CFD: 09/08/2012 - 19:17:00 - [30,769] ----D C:\Users\Sergio\AppData\Local\Mozilla

O43 - CFD: 05/05/2012 - 19:07:08 - [0] ----D C:\Users\Sergio\AppData\Local\Opera

O43 - CFD: 29/11/2011 - 21:57:33 - [0] ----D C:\Users\Sergio\AppData\Local\PackageAware

O43 - CFD: 04/09/2012 - 21:50:42 - [0,486] ----D C:\Users\Sergio\AppData\Local\Temp

O43 - CFD: 23/07/2011 - 13:46:55 - [0] ----D C:\Users\Sergio\AppData\Local\Temporary Internet Files

O43 - CFD: 09/10/2011 - 22:19:50 - [0,044] ----D C:\Users\Sergio\AppData\Local\Thinstall

O43 - CFD: 16/03/2012 - 17:11:28 - [3,679] ----D C:\Users\Sergio\AppData\Local\Thunderbird

O43 - CFD: 01/09/2012 - 19:32:32 - [0,200] ----D C:\Users\Sergio\AppData\Local\Unity

O43 - CFD: 09/10/2011 - 22:20:02 - [-709,687] ----D C:\Users\Sergio\AppData\Local\VirtualStore

O43 - CFD: 05/08/2012 - 09:18:23 - [0,117] ----D C:\Users\Sergio\AppData\Local\Windows Live

O43 - CFD: 30/11/2011 - 13:45:07 - [0] ----D C:\Users\Sergio\AppData\Local\{039D0BA5-ABA5-46E4-B73C-19DE7BED255C}

O43 - CFD: 25/08/2012 - 23:16:21 - [0] ----D C:\Users\Sergio\AppData\Local\{05183429-84D0-4AE0-AA22-C2753DA38AB7}

O43 - CFD: 18/09/2011 - 15:10:49 - [0] ----D C:\Users\Sergio\AppData\Local\{07C6C355-B004-4E8B-ADE4-CE45722B6442}

O43 - CFD: 20/02/2012 - 17:09:37 - [0] ----D C:\Users\Sergio\AppData\Local\{0B57888D-BE6B-4C35-8BE8-DDD00EEE04C8}

O43 - CFD: 09/01/2012 - 16:54:38 - [0] ----D C:\Users\Sergio\AppData\Local\{0CDD589F-1CA7-4C6F-A6A7-2A6B2F8B20CC}

O43 - CFD: 09/07/2012 - 12:25:38 - [0] ----D C:\Users\Sergio\AppData\Local\{1270DC32-F3B3-444D-8B36-7003A49F14B1}

O43 - CFD: 05/01/2012 - 14:13:47 - [0] ----D C:\Users\Sergio\AppData\Local\{127D9365-2CE0-4852-995F-35286E80DB40}

O43 - CFD: 26/11/2011 - 17:21:30 - [0] ----D C:\Users\Sergio\AppData\Local\{15FB640D-F9C4-4BB8-B65E-3A31D4995AC7}

O43 - CFD: 03/05/2012 - 20:51:04 - [0] ----D C:\Users\Sergio\AppData\Local\{16C2FCAC-ED4B-40E8-9334-7F131C4AE6AB}

O43 - CFD: 08/07/2012 - 23:25:13 - [0] ----D C:\Users\Sergio\AppData\Local\{1BB361C0-6563-488A-B046-1769224B3E50}

O43 - CFD: 19/02/2012 - 20:10:29 - [0] ----D C:\Users\Sergio\AppData\Local\{213EEA16-B131-48E4-96C1-1729A4D90A47}

O43 - CFD: 29/10/2011 - 15:33:06 - [0] ----D C:\Users\Sergio\AppData\Local\{2146CE28-2336-4D4D-BCF2-66B382C57CA9}

O43 - CFD: 08/07/2012 - 23:53:00 - [0] ----D C:\Users\Sergio\AppData\Local\{2299D8B1-CDAD-4AC7-9126-71E4AD124F3A}

O43 - CFD: 09/07/2012 - 16:31:35 - [0] ----D C:\Users\Sergio\AppData\Local\{24A80BE5-D6FC-4B09-8299-DA8CD7A86541}

O43 - CFD: 08/01/2012 - 18:20:22 - [0] ----D C:\Users\Sergio\AppData\Local\{26762A23-6D96-47F3-8754-67F227C00DD0}

O43 - CFD: 20/02/2012 - 17:09:48 - [0] ----D C:\Users\Sergio\AppData\Local\{28732B64-08A5-4F09-A30C-BAAF42BE2B14}

O43 - CFD: 08/07/2012 - 01:37:14 - [0] ----D C:\Users\Sergio\AppData\Local\{2AD0ADC1-D881-4915-830D-7215A9A65B74}

O43 - CFD: 09/07/2012 - 13:55:25 - [0] ----D C:\Users\Sergio\AppData\Local\{2B641219-4FF0-4BB0-9417-950F15A8AA5F}

O43 - CFD: 09/07/2012 - 17:37:10 - [0] ----D C:\Users\Sergio\AppData\Local\{2CB60180-5906-4A2B-8987-0C7E3AD4662B}

O43 - CFD: 04/01/2012 - 17:09:26 - [0] ----D C:\Users\Sergio\AppData\Local\{2D88F5AD-5D2A-48E9-924F-2A43D202FD6C}

O43 - CFD: 05/01/2012 - 14:14:01 - [0] ----D C:\Users\Sergio\AppData\Local\{2F70A373-5D2C-462F-B2A3-62A1AD0D50DB}

O43 - CFD: 04/01/2012 - 17:09:38 - [0] ----D C:\Users\Sergio\AppData\Local\{3358D823-3B31-47A4-B7AB-EB998D21652A}

O43 - CFD: 08/07/2012 - 12:06:30 - [0] ----D C:\Users\Sergio\AppData\Local\{36455D7A-E8B8-4EBB-B0CA-DB623BBBC02A}

O43 - CFD: 22/02/2012 - 17:09:50 - [0] ----D C:\Users\Sergio\AppData\Local\{3FFF8A68-0128-4F3C-980E-64CB5509FE1A}

O43 - CFD: 07/07/2012 - 21:43:27 - [0] ----D C:\Users\Sergio\AppData\Local\{4492098C-E21D-49DC-9F47-9D4CFB4DD169}

O43 - CFD: 09/01/2012 - 16:54:24 - [0] ----D C:\Users\Sergio\AppData\Local\{46FB93A6-510B-484F-85BA-6F21B029E768}

O43 - CFD: 17/05/2012 - 22:01:35 - [0] ----D C:\Users\Sergio\AppData\Local\{4B53F910-C7A8-4453-B062-0AE645DD0354}

O43 - CFD: 22/07/2012 - 13:25:45 - [0] ----D C:\Users\Sergio\AppData\Local\{4BCE74EA-62F7-4ABE-B2A1-70CC7D3853D0}

O43 - CFD: 09/07/2012 - 20:12:12 - [0] ----D C:\Users\Sergio\AppData\Local\{4E7593FD-5863-4DFA-B136-1870636A3A3A}

O43 - CFD: 08/07/2012 - 22:06:59 - [0] ----D C:\Users\Sergio\AppData\Local\{500C9843-1296-4205-86B1-A9365D057CD6}

O43 - CFD: 08/07/2012 - 19:09:33 - [0] ----D C:\Users\Sergio\AppData\Local\{5285DF8F-14D4-49A8-A630-9D7387F1CC9E}

O43 - CFD: 08/07/2012 - 15:15:45 - [0] ----D C:\Users\Sergio\AppData\Local\{53F2B422-5241-43F4-A067-E8C47AB75A3B}

O43 - CFD: 09/07/2012 - 00:41:09 - [0] ----D C:\Users\Sergio\AppData\Local\{547D8FD6-4B41-4BB1-B6FB-8EAA8B71019F}

O43 - CFD: 17/05/2012 - 22:00:18 - [0] ----D C:\Users\Sergio\AppData\Local\{59288D89-A5E4-4845-AB1E-ADE2A42DA8D4}

O43 - CFD: 29/10/2011 - 17:27:51 - [0] ----D C:\Users\Sergio\AppData\Local\{5AF0BC5C-765F-41C4-AA5E-9FF1FDC6DD24}

O43 - CFD: 29/10/2011 - 17:41:46 - [0] ----D C:\Users\Sergio\AppData\Local\{6163B633-BDA1-4B27-8EAF-C4B9FE4CB7B3}

O43 - CFD: 03/05/2012 - 21:25:26 - [0] ----D C:\Users\Sergio\AppData\Local\{66F22B59-C1D7-456E-8672-3F8876FA9C79}

O43 - CFD: 07/07/2012 - 20:04:37 - [0] ----D C:\Users\Sergio\AppData\Local\{674AAA9F-4520-4279-86DA-95635F8B83B9}

O43 - CFD: 09/10/2011 - 13:58:15 - [0] ----D C:\Users\Sergio\AppData\Local\{6DEEF961-B207-4786-AC4F-EBFB5D11212A}

O43 - CFD: 09/07/2012 - 20:07:58 - [0] ----D C:\Users\Sergio\AppData\Local\{7259C14E-91E0-4D24-9493-D29CAA294D35}

O43 - CFD: 18/02/2012 - 22:49:55 - [0] ----D C:\Users\Sergio\AppData\Local\{72D03B99-8C8D-4A70-8B29-5F7513DFD897}

O43 - CFD: 25/11/2011 - 22:00:29 - [0] ----D C:\Users\Sergio\AppData\Local\{75AA2603-7E7A-4D56-97DD-789A3EF5CDC2}

O43 - CFD: 03/05/2012 - 21:25:57 - [0] ----D C:\Users\Sergio\AppData\Local\{78125CA9-6B3A-47D4-AE5D-7F7E6FED49DE}

O43 - CFD: 05/08/2012 - 09:18:22 - [0] ----D C:\Users\Sergio\AppData\Local\{78605791-0E62-4DC4-95A9-6B16D8DEB7E2}

O43 - CFD: 07/07/2012 - 21:44:10 - [0] ----D C:\Users\Sergio\AppData\Local\{78C6040C-1C58-4047-8CE5-D2E635EEE40D}

O43 - CFD: 13/08/2011 - 23:13:13 - [0] ----D C:\Users\Sergio\AppData\Local\{7B8DE4B5-82C2-4733-890E-6154DD1F2736}

O43 - CFD: 07/07/2012 - 23:29:21 - [0] ----D C:\Users\Sergio\AppData\Local\{83BA6102-7488-4E68-9968-356726884715}

O43 - CFD: 18/02/2012 - 22:49:43 - [0] ----D C:\Users\Sergio\AppData\Local\{8A17AE58-D70C-4232-8391-115AAD702D86}

O43 - CFD: 09/07/2012 - 20:07:48 - [0] ----D C:\Users\Sergio\AppData\Local\{8BF2737B-D2A8-4C13-ADBF-C6FCA27EC428}

O43 - CFD: 07/07/2012 - 22:12:43 - [0] ----D C:\Users\Sergio\AppData\Local\{909EAEBF-A2AF-48A4-B715-B58AEA8C894B}

O43 - CFD: 09/07/2012 - 12:50:23 - [0] ----D C:\Users\Sergio\AppData\Local\{91F2689B-B42F-4BD5-B170-271879E1F014}

O43 - CFD: 15/01/2012 - 19:31:43 - [0] ----D C:\Users\Sergio\AppData\Local\{96855890-C4B7-4EBE-B603-3B37F07E4BEA}

O43 - CFD: 08/07/2012 - 18:46:53 - [0] ----D C:\Users\Sergio\AppData\Local\{A0D26DF9-19B5-4442-81CD-891A55AF6B0D}

O43 - CFD: 07/07/2012 - 20:56:40 - [0] ----D C:\Users\Sergio\AppData\Local\{A1B7E284-5D35-43D5-A354-873BBB895DCF}

O43 - CFD: 04/01/2012 - 17:01:45 - [0] ----D C:\Users\Sergio\AppData\Local\{A8D40B58-3646-4E0B-B028-9973F6ACBF30}

O43 - CFD: 07/07/2012 - 23:29:22 - [0] ----D C:\Users\Sergio\AppData\Local\{AB943710-890F-4CAC-94F6-3926A3FA1CB6}

O43 - CFD: 03/05/2012 - 21:10:18 - [0] ----D C:\Users\Sergio\AppData\Local\{AF646883-B41E-432B-9704-17A4A7D06CC8}

O43 - CFD: 28/10/2011 - 17:59:56 - [0] ----D C:\Users\Sergio\AppData\Local\{B1C64905-E1A2-48B4-804F-B85D330C6263}

O43 - CFD: 08/07/2012 - 22:07:10 - [0] ----D C:\Users\Sergio\AppData\Local\{B1E24C8C-B9D3-495C-B719-62FB9E0BB218}

O43 - CFD: 09/07/2012 - 17:48:55 - [0] ----D C:\Users\Sergio\AppData\Local\{B22A97C0-8C6C-4DBF-9BE7-6A642D3B163C}

O43 - CFD: 27/08/2011 - 22:22:54 - [0] ----D C:\Users\Sergio\AppData\Local\{B2E1A061-1EB1-4DA2-B793-BBDD6B105F29}

O43 - CFD: 08/07/2012 - 12:37:41 - [0] ----D C:\Users\Sergio\AppData\Local\{B51C94E5-8364-4DC2-9A5C-8B8063542449}

O43 - CFD: 05/08/2012 - 09:18:10 - [0] ----D C:\Users\Sergio\AppData\Local\{B5C7E014-7F47-4BF8-B42E-51209BE9B955}

O43 - CFD: 08/07/2012 - 19:09:44 - [0] ----D C:\Users\Sergio\AppData\Local\{B7202785-3D17-45DD-83E5-C718648B7828}

O43 - CFD: 06/05/2012 - 21:31:28 - [0] ----D C:\Users\Sergio\AppData\Local\{B7D4A5A7-01F9-4983-A655-FA75A8AFCB85}

O43 - CFD: 02/01/2012 - 16:18:22 - [0] ----D C:\Users\Sergio\AppData\Local\{BE336543-A7E0-4BDD-BC9E-D722CF498427}

O43 - CFD: 02/09/2011 - 19:17:57 - [0] ----D C:\Users\Sergio\AppData\Local\{C69E3F4D-8E16-4CFC-9C41-CA19F1AE6000}

O43 - CFD: 17/01/2012 - 19:16:48 - [0] ----D C:\Users\Sergio\AppData\Local\{D11EDE27-15E8-4176-9852-AB196AFAC69D}

O43 - CFD: 09/07/2012 - 16:18:31 - [0] ----D C:\Users\Sergio\AppData\Local\{D8D8064F-7E6B-4E53-9A7C-EDF9581A8007}

O43 - CFD: 07/01/2012 - 19:50:02 - [0] ----D C:\Users\Sergio\AppData\Local\{D92C39C5-0F43-4E3B-96DB-5D510994C293}

O43 - CFD: 09/07/2012 - 18:34:16 - [0] ----D C:\Users\Sergio\AppData\Local\{E0D6FC06-2410-4925-883C-F7115639F64C}

O43 - CFD: 19/02/2012 - 20:10:40 - [0] ----D C:\Users\Sergio\AppData\Local\{E148BDC1-9639-4EE1-845D-64E89C765103}

O43 - CFD: 12/11/2011 - 13:51:15 - [0] ----D C:\Users\Sergio\AppData\Local\{E176ED12-A83B-4906-8CD0-E29A281BC115}

O43 - CFD: 22/07/2012 - 13:25:56 - [0] ----D C:\Users\Sergio\AppData\Local\{E53DFA98-37C7-4C84-87CA-B66E9B71029E}

O43 - CFD: 09/07/2012 - 17:37:22 - [0] ----D C:\Users\Sergio\AppData\Local\{E65813FE-5D8B-42FF-840E-7E3F3111CE88}

O43 - CFD: 09/07/2012 - 13:27:29 - [0] ----D C:\Users\Sergio\AppData\Local\{E86E685F-3EFA-4C2B-B5D6-B4876A13B7B1}

O43 - CFD: 09/07/2012 - 20:11:59 - [0] ----D C:\Users\Sergio\AppData\Local\{E9A31BAD-61EF-4169-A724-623EF834C0D0}

O43 - CFD: 07/01/2012 - 19:49:50 - [0] ----D C:\Users\Sergio\AppData\Local\{EE1300EC-5AA2-4898-B25C-945F781FF840}

O43 - CFD: 22/02/2012 - 17:10:02 - [0] ----D C:\Users\Sergio\AppData\Local\{F6AFAAF6-BF05-46FF-A02E-E02BFBB52B05}

O43 - CFD: 08/01/2012 - 18:20:34 - [0] ----D C:\Users\Sergio\AppData\Local\{F92ADEAD-4FF0-4B5E-9115-606C3AC6FEE2}

O43 - CFD: 15/01/2012 - 19:31:55 - [0] ----D C:\Users\Sergio\AppData\Local\{FC1B2AE9-ECBA-4FCC-9D36-CB0155E26BBF}

O43 - CFD: 14/07/2009 - 01:42:04 - [0,014] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

O43 - CFD: 18/07/2012 - 23:48:39 - [0,000] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

O43 - CFD: 23/07/2012 - 04:09:56 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar

O43 - CFD: 31/01/2012 - 21:57:11 - [0,006] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

O43 - CFD: 26/07/2012 - 00:21:29 - [0,004] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory

O43 - CFD: 14/04/2012 - 14:57:10 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

O43 - CFD: 19/03/2012 - 16:54:16 - [0] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

O43 - CFD: 14/07/2009 - 01:37:42 - [0,001] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

O43 - CFD: 16/03/2012 - 18:47:02 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2012

O43 - CFD: 12/11/2011 - 19:27:48 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\project64 1.6

O43 - CFD: 18/07/2012 - 23:48:39 - [0,000] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

O43 - CFD: 23/07/2011 - 23:03:31 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

~ Scan Program Folder in 00mn 11s

 

 

 

---\\ Last modified or created files under Windows and System32 (O44)

O44 - LFC:[MD5.FAC8C0E5DAD4ADF75658182AD7B6CDD9] - 04/09/2012 - 21:51:20 ---A- . (...) -- C:\Windows\WindowsUpdate.log [118792]

O44 - LFC:[MD5.AC849B99E032F4017BB1CE37934DD4AF] - 04/09/2012 - 21:38:34 ---A- . (...) -- C:\Windows\setupact.log [112]

O44 - LFC:[MD5.B6A80BD315A80460E303B5F876925C30] - 04/09/2012 - 21:38:33 -S-A- . (...) -- C:\Windows\bootstat.dat [67584]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 04/09/2012 - 21:24:03 ---A- . (...) -- C:\Windows\setuperr.log [0]

O44 - LFC:[MD5.AAC5824B728CA34BC3E41515649C605A] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI [5224]

O44 - LFC:[MD5.C430C5953026E71EF3A9A4681E6E4D3C] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\perfc009.dat [2655162]

O44 - LFC:[MD5.AFDC5E580D7CC3B1658A753F79CDDD0E] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\perfh009.dat [3284974]

O44 - LFC:[MD5.A0976433759206F13C81B66F4602281F] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [2676868]

O44 - LFC:[MD5.AA2BC5F2E17F4A503336D402BFA8E37E] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [3332770]

O44 - LFC:[MD5.9A5E23F24682E57F10F3F233EBF45BB2] - 03/09/2012 - 19:18:25 ----- . (...) -- C:\bootsqm.dat [3288]

O44 - LFC:[MD5.4B3426BE091633F0903EC2B1BCD27EA9] - 31/08/2012 - 20:39:28 ---A- . (...) -- C:\hpfr3420.log [137553]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 31/08/2012 - 20:39:27 ---A- . (...) -- C:\hpfr3420.xml [0]

O44 - LFC:[MD5.26E7593A3745BCFFAFDBB4481A16EF82] - 01/09/2012 - 20:04:43 ---A- . (.Macromedia, Inc. - Macromedia Flash Player 6.0 r23.) -- C:\flash.exe [819301]

O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 01/09/2012 - 19:38:46 ---A- . (...) -- C:\Windows\System32\config.nt [2577]

O44 - LFC:[MD5.DFE9152ABFA89BB8CFDC057409B2D4DA] - 21/08/2012 - 06:13:15 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\Windows\System32\Drivers\aswTdi.sys [54232]

O44 - LFC:[MD5.30E45AF8B4D83176CA850FC9699E860B] - 21/08/2012 - 06:13:15 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\Windows\System32\Drivers\aswSnx.sys [729752]

O44 - LFC:[MD5.F04BDBCB965C05C51F4A7DE7B62063D6] - 21/08/2012 - 06:13:15 ---A- . (.AVAST Software - avast! self protection module.) -- C:\Windows\System32\Drivers\aswSP.sys [355632]

O44 - LFC:[MD5.F76E51561562AC4105DBBE53FC99BC10] - 21/08/2012 - 06:13:14 ---A- . (.AVAST Software - avast! File System Minifilter for Windows 2.) -- C:\Windows\System32\Drivers\aswMonFlt.sys [58680]

O44 - LFC:[MD5.924819669AFD0EDF5C067193D371FAB0] - 21/08/2012 - 06:13:14 ---A- . (.AVAST Software - avast! WFP Redirect Driver.) -- C:\Windows\System32\Drivers\aswRdr2.sys [44784]

O44 - LFC:[MD5.F5DC168BF77572D51BE28BA261B30CB4] - 21/08/2012 - 06:13:13 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\Windows\System32\Drivers\aswFsBlk.sys [21256]

O44 - LFC:[MD5.B6A0320DFEFE916346CB900938661DAD] - 21/08/2012 - 06:12:33 ---A- . (.AVAST Software - avast! Screen Saver stub.) -- C:\Windows\avastSS.scr [41224]

O44 - LFC:[MD5.CCB414FEE0E81E1B7F64AEEA63BC2649] - 21/08/2012 - 06:12:23 ---A- . (.AVAST Software - avast! start-up scanner.) -- C:\Windows\System32\aswBoot.exe [227648]

O44 - LFC:[MD5.818D091A1F48400062F33AEB194949C4] - 18/08/2012 - 16:02:50 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\Windows\System32\FlashPlayerApp.exe [426184]

O44 - LFC:[MD5.4154A3678BCF729F6C6AB2297A92F939] - 18/08/2012 - 16:02:50 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [70344]

O44 - LFC:[MD5.CE2C07A332325EA2C887A52055445A1E] - 18/08/2012 - 15:52:34 ---A- . (...) -- C:\Windows\System32\FNTCACHE.DAT [289848]

O44 - LFC:[MD5.7B426B8E809EDF081D771EF429345528] - 21/06/2011 - 11:24:06 ---A- . (...) -- C:\Windows\System32\Drivers\sp_rsdrv2.sys [32768]

~ Scan Files in 00mn 07s

 

 

 

---\\ Local Security Authority-LSA Deny (O48)

O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll

O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Mecanismo cliente do 'Editor de configuração de segurança Windows'.) -- C:\Windows\System32\scecli.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Pacote de Segurança Kerberos.) -- C:\Windows\System32\kerberos.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\Windows\System32\schannel.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Digest Access.) -- C:\Windows\System32\wdigest.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Web Service Security Package.) -- C:\Windows\System32\tspkg.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Pku2u Security Package.) -- C:\Windows\System32\pku2u.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corp. - LiveSSP.) -- C:\Windows\System32\livessp.dll

~ Scan Keys in 00mn 00s

 

 

 

---\\ Safe Boot Control (O49)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\Windows\System32\Drivers\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\Windows\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\Windows\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\Windows\System32\Drivers\volmgr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\Windows\System32\Drivers\volmgrx.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\Windows\System32\Drivers\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\nsiproxy.sys . (.Microsoft Corporation - NSI Proxy.) -- C:\Windows\System32\Drivers\nsiproxy.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpencdd.sys . (.Microsoft Corporation - RDP Encoder Miniport.) -- C:\Windows\System32\Drivers\rdpencdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\Windows\System32\Drivers\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\Windows\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\Windows\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\Windows\System32\Drivers\volmgr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\Windows\System32\Drivers\volmgrx.sys

~ Scan CSB in 00mn 00s

 

 

 

---\\ MountPoints2 Shell Key (MPKS) (O51)

O51 - MPSK:{1b84cd26-3596-11e1-95c1-1078d2b3eade}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)

O51 - MPSK:{5ac63608-366d-11e1-8424-1078d2b3eade}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)

~ Scan Keys in 00mn 00s

 

 

 

---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52)

O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\Windows\System32\iccvid.dll

O52 - TDSD: \Drivers32\"vidc.VP60"="C:\Windows\system32\vp6vfw.dll" . (.On2.com - VP6 VIDEO FOR WINDOWS CODEC.) -- C:\Windows\system32\vp6vfw.dll

O52 - TDSD: \Drivers32\"vidc.VP61"="C:\Windows\system32\vp6vfw.dll" . (.On2.com - VP6 VIDEO FOR WINDOWS CODEC.) -- C:\Windows\system32\vp6vfw.dll

O52 - TDSD: \Drivers32\"VIDC.DIVX"="divx.dll" . (.DivX, Inc. - DivX.) -- C:\Windows\System32\divx.dll

O52 - TDSD: \Drivers32\"VIDC.XVID"="xvidvfw.dll" . (...) -- C:\Windows\System32\xvidvfw.dll

O52 - TDSD: \Drivers32\"VIDC.YV12"="yv12vfw.dll" . (.www.helixcommunity.org - Helix YV12 YUV Codec.) -- C:\Windows\System32\yv12vfw.dll

O52 - TDSD: \Drivers32\"msacm.ac3acm"="ac3acm.acm" . (.fccHandler - AC-3 ACM Codec.) -- C:\Windows\System32\ac3acm.acm

O52 - TDSD: \Drivers32\"msacm.lameacm"="lameACM.acm" . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\Windows\System32\lameACM.acm

O52 - TDSD: \Drivers32\"VIDC.FFDS"="ff_vfw.dll" . (...) -- C:\Windows\System32\ff_vfw.dll

O52 - TDSD: \Drivers32\"VIDC.FMVC"="fmcodec.dll" . (.Fox Magic Software - FM Screen Capture Codec (VFW).) -- C:\Windows\System32\fmcodec.dll

O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

O52 - TDSD: \drivers.desc\"vp6vfw.dll"="EA VP6 Codec" . (.On2.com - VP6 VIDEO FOR WINDOWS CODEC.) -- C:\Windows\System32\vp6vfw.dll

O52 - TDSD: \drivers.desc\"ac3acm.acm"="AC-3 ACM Codec" . (.fccHandler - AC-3 ACM Codec.) -- C:\Windows\System32\ac3acm.acm

O52 - TDSD: \drivers.desc\"ff_vfw.dll"="ffdshow video encoder" . (...) -- C:\Windows\System32\ff_vfw.dll

~ Scan Keys in 00mn 00s

 

 

 

---\\ ShareTools MSconfig StartupReg (SMSR) (O53)

O53 - SMSR:HKLM\...\startupreg\PAC7302_Monitor [Key] . (.PixArt Imaging Incorporation - Registry Monitor.) -- c:\windows\pixart\pac7302\monitor.exe

O53 - SMSR:HKLM\...\startupreg\SweetIM [Key] . (...) -- c:\program files\sweetim\messenger\sweetim.exe (.not file.)

O53 - SMSR:HKLM\...\startupreg\Sweetpacks Communicator [Key] . (.SweetIM Technologies Ltd. - Update Manager for SweetPacks.) -- c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe

~ Scan SMSR Keys in 00mn 00s

 

 

 

---\\ Microsoft Control Security Providers (MCSP) (O54)

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\System32\credssp.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\System32\credssp.dll

~ Scan Keys in 00mn 00s

 

 

 

---\\ Microsoft Windows Policies System (MWPS) (O55)

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3

O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0

O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1

O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1

O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0

O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0

O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0

O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0

~ Scan Keys in 00mn 00s

 

 

 

---\\ Microsoft Windows Policies Explorer (MWPE) (O56)

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=145

~ Scan Keys in 00mn 00s

 

 

 

---\\ System Drivers List (SDL) (O58)

O58 - SDL:[MD5.21E785EBD7DC90A06391141AAC7892FB] - 13/07/2009 - 22:26:15 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422976]

O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 18:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]

~ Scan Drivers in 00mn 00s

 

 

 

---\\ List all tools cleaner (LATC) (O63)

O63 - Logiciel: ZHPDiag 1.31 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1

~ Scan ADS in 00mn 00s

 

 

 

---\\ List all legacy services(LALS) (O64)

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswFsBlk.sys (aswFsBlk) .(.AVAST Software - avast! File System Access Blocking Driver.) - LEGACY_ASWFSBLK

O64 - Services: CurCS - 21/08/2012 - C:\Windows\system32\drivers\aswMonFlt.sys (aswMonFlt) .(.AVAST Software - avast! File System Minifilter for Windows 2.) - LEGACY_ASWMONFLT

O64 - Services: CurCS - 21/08/2012 - C:\Windows\system32\Drivers\aswrdr2.sys (aswRdr) .(.AVAST Software - avast! WFP Redirect Driver.) - LEGACY_ASWRDR

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswSnx.sys (aswSnx) .(.AVAST Software - avast! Virtualization Driver.) - LEGACY_ASWSNX

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswSP.sys (aswSP) .(.AVAST Software - avast! self protection module.) - LEGACY_ASWSP

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswTdi.sys (aswTdi) .(.AVAST Software - avast! TDI Filter Driver.) - LEGACY_ASWTDI

O64 - Services: CurCS - 05/01/2012 - C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys (FileMonitor) .(.IObit - IMF File MiniFilter Driver.) - LEGACY_FILEMONITOR

O64 - Services: CurCS - 05/07/2012 - C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys (RegFilter) .(.IObit.com - Registry Filter.) - LEGACY_REGFILTER

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV

O64 - Services: CurCS - 05/07/2012 - C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys (UrlFilter) .(.IObit.com - URL Filter.) - LEGACY_URLFILTER

~ Scan Services in 00mn 00s

 

 

 

---\\ File Associations Shell Spawning (O67)

O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe

O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Iniciador do snap-in de 'Visualizar eventos'.) -- C:\Windows\System32\eventvwr.exe

O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe

O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Editor do Registro.) -- C:\Windows\regedit.exe

O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe

O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.evt> <evtfile>[HKCR\..\open\Command] (.Microsoft Corporation - Iniciador do snap-in de 'Visualizar eventos'.) -- C:\Windows\System32\eventvwr.exe

O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <ChromeHTML>[HKCR\..\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Editor do Registro.) -- C:\Windows\regedit.exe

~ Scan Keys in 00mn 00s

 

 

 

---\\ Start Menu Internet (SMI) (O68)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe

O68 - StartMenuInternet: <Opera> <Opera>[HKLM\..\Shell\open\Command] (.Not Key.)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe (.not file.)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe (.not file.)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe (.not file.)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

~ Scan Keys in 00mn 00s

 

 

 

---\\ Search Browser Infection (SBI) (O69)

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.newtab.url", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf0000000000000000000'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf0000000000000000000[...]

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.search.order.1", "Search the web (Babylon)");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.admin", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.aflt", "babsst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.babExt", "");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=2912_4");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.bbDpng", 24);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.dfltSrch", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.hmpg", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.id", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.instlDay", "15544");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.instlRef", "sst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.lastDP", 24);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.newTab", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.newTabUrl", "http://search.babylon.com/?babsrc=NT_bb"'>http://search.babylon.com/?babsrc=NT_bb");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.noFFXTlbr", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.propectorlck", 81662174);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prtkDS", 1);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.ptch_0717", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.smplGrp", "none");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.srcExt", "ss");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.tlbrId", "base");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.babExt", "");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=2912_4");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.hardId", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.id", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.instlDay", "15544");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.newTab", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf[...]

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("keyword.URL", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=KW_ss&mntrId=14e5addf000000000000000000000000&q'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=KW_ss&mntrId=14e5addf000000000000000000000000&q[...]

O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} [DefaultScope] - (Search the web (Babylon)) - http://search.babylon.com

O69 - SBI: SearchScopes [HKCU] {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} - (Search The Web) - http://www.google.com

O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Goo) - http://www.google.com

O69 - SBI: SearchScopes [HKCU] {96F94A0A-0F78-4839-98BF-54F4C08F6734} - (Google) - http://www.google.com

~ Scan Keys in 00mn 00s

 

 

 

---\\ Search Svchost Services (SSS) (O83)

O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Serviço de Experiência com Aplicativo.) -- C:\Windows\System32\aelupsvc.dll [62464]

O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\Windows\System32\certprop.dll [67584]

O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\Windows\System32\certprop.dll [67584]

O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - DLL de Serviço do Servidor.) -- C:\Windows\System32\srvsvc.dll [168960]

O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Cliente da Diretiva de Grupo.) -- C:\Windows\System32\gpsvc.dll [593408]

O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - Extensão IKE.) -- C:\Windows\System32\ikeext.dll [674304]

O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Serviço de Áudio do Windows.) -- C:\Windows\System32\Audiosrv.dll [473600]

O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Gerenciador de Discagem Automática de Acesso Remoto.) -- C:\Windows\System32\rasauto.dll [90624]

O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Gerenciador de conexão de acesso remoto.) -- C:\Windows\System32\rasmans.dll [286208]

O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Gerenciador de Interface Dinâmica.) -- C:\Windows\System32\mprdim.dll [75264]

O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - Serviço de Notificação de Eventos do Sistema (SENS).) -- C:\Windows\System32\sens.dll [49664]

O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Componentes do Microsoft NAT Helper.) -- C:\Windows\System32\ipnathlp.dll [300544]

O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Servidor de telefonia do Microsoft® Windows.) -- C:\Windows\System32\tapisrv.dll [242176]

O83 - Search Svchost Services: TermService (TermService) . (.Microsoft Corporation - Gerenciador de Conexões Remotas do Servidor Host da Sessão da Área de.) -- C:\Windows\System32\termsrv.dll [521216]

O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\System32\wuaueng.dll [1933848]

O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Serviço de transferência inteligente de plano de fundo.) -- C:\Windows\System32\qmgr.dll [585728]

O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - DLL de serviços do Shell do Windows.) -- C:\Windows\System32\shsvcs.dll [328192]

O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Serviço que oferece conectividade IPv6 em uma rede IPv4..) -- C:\Windows\System32\iphlpsvc.dll [499712]

O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - DLL de serviço de logon secundário.) -- C:\Windows\system32\seclogon.dll [21504]

O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Serviço de Informações de Aplicativos.) -- C:\Windows\System32\appinfo.dll [47104]

O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - Serviço de Descoberta iSCSI.) -- C:\Windows\System32\iscsiexe.dll [114688]

O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Serviço Agendador de Classes de Multimídia.) -- C:\Windows\System32\mmcss.dll [49664]

O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Relatórios de Problemas e Soluções.) -- C:\Windows\System32\wercplsupport.dll [61440]

O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Serviço Microsoft EAPHost.) -- C:\Windows\System32\eapsvc.dll [98304]

O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\System32\profsvc.dll [164352]

O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Serviço Agendador de Tarefas.) -- C:\Windows\System32\schedsvc.dll [750592]

O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Serviço de Gerenciamento de Chaves.) -- C:\Windows\System32\kmsvc.dll [71168]

O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Serviço de Configuração da Área de Trabalho Remota.) -- C:\Windows\System32\sessenv.dll [113664]

O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\System32\wbem\WMIsvc.dll [168960]

O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - DLL de Serviço Pesquisador de Computadores.) -- C:\Windows\System32\browser.dll [102912]

O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - DLL do Serviço de Tema do Shell do Windows.) -- C:\Windows\System32\themeservice.dll [37376]

O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - Serviço BDE.) -- C:\Windows\System32\bdesvc.dll [76800]

~ Scan Services in 00mn 00s

 

 

 

---\\ Search Particular Root Folder (SPRF) (O84)

[MD5.6D9E5361414A404F62DC249F2AADC327] [sPRF][31/01/2008] (.Unknown owner - 7-zip32.) -- C:\Users\Sergio\AppData\Local\Temp\7-zip32.dll [506880]

[MD5.4668C9C20FA1EA6D22D1ADE71CF89165] [sPRF][04/09/2012] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\Sergio\Desktop\ZHPDiag2.exe [3544694]

~ Scan Files in 00mn 00s

 

 

 

---\\ Firewall Active Exception List (FirewallRules) (O87)

O87 - FAEL: "{2632C74A-804A-49D4-88B9-07E7D29DB442}" | In - None - P6 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe

O87 - FAEL: "TCP Query User{834D63C8-866F-4417-8D2E-74CA55D718E7}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe" | In - Public - P6 - TRUE | .(.Google Inc..) -- C:\users\sergio\appdata\local\google\chrome\application\chrome.exe

O87 - FAEL: "UDP Query User{59D563AC-EEF8-4137-80EB-ECE659CA0A73}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe" | In - Public - P17 - TRUE | .(.Google Inc..) -- C:\users\sergio\appdata\local\google\chrome\application\chrome.exe

O87 - FAEL: "TCP Query User{C211A00F-4024-4C8F-9FF1-AE20B79A4840}C:\program files\ea sports\fifa 11\game\fifa.exe" | In - Public - P6 - TRUE | .(.Electronic Arts - FIFA 11.) -- C:\program files\ea sports\fifa 11\game\fifa.exe

O87 - FAEL: "UDP Query User{1FEBB3C7-DEB2-4AFE-BF14-F8E2E17CF9BA}C:\program files\ea sports\fifa 11\game\fifa.exe" | In - Public - P17 - TRUE | .(.Electronic Arts - FIFA 11.) -- C:\program files\ea sports\fifa 11\game\fifa.exe

O87 - FAEL: "TCP Query User{9B833D61-0C19-4B09-88CD-1019E9962B80}C:\program files\java\jre6\bin\javaw.exe" | In - Public - P6 - TRUE | .(.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\program files\java\jre6\bin\javaw.exe

O87 - FAEL: "UDP Query User{A030C684-D2ED-407A-8F82-F3CE61A9C4B4}C:\program files\java\jre6\bin\javaw.exe" | In - Public - P17 - TRUE | .(.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\program files\java\jre6\bin\javaw.exe

O87 - FAEL: "TCP Query User{55CCDBC7-3ECF-455F-AF68-5B6871C93A93}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" | In - Public - P6 - TRUE | .(.DsNET.) -- C:\program files\dsnet corp\atube catcher 2.0\yct.exe

O87 - FAEL: "UDP Query User{FA88821C-9371-490E-8663-C8B8ADF500D7}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" | In - Public - P17 - TRUE | .(.DsNET.) -- C:\program files\dsnet corp\atube catcher 2.0\yct.exe

O87 - FAEL: "{A478EFAD-1389-4DEB-9BC9-20BF7FA1238C}" | In - Public - P6 - TRUE | .(.SweetIM Technologies Ltd. - Update Manager for SweetPacks.) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe

O87 - FAEL: "{36BE1240-3E4F-41BB-B9A0-060F51E1789B}" | In - Public - P17 - TRUE | .(.SweetIM Technologies Ltd. - Update Manager for SweetPacks.) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe

~ Scan Firewall in 00mn 00s

 

 

 

---\\ Additionnal Scan (O88)

Database Version : 9183 - (04/09/2012)

Clés trouvées (Keys found) : 28

Valeurs trouvées (Values found) : 0

Dossiers trouvés (Folders found) : 7

Fichiers trouvés (Files found) : 1

 

[HKLM\Software\Classes\sweetie.ietoolbar] =>Toolbar.SweetIM

[HKLM\Software\Classes\sweetie.ietoolbar.1] =>Toolbar.SweetIM

[HKLM\Software\Classes\sweetim_urlsearchhook.toolbarurlsearchhook] =>Toolbar.SweetIM

[HKLM\Software\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1] =>Toolbar.SweetIM

[HKLM\Software\Classes\Toolbar3.sweetie] =>Toolbar.SweetIM

[HKLM\Software\Classes\Toolbar3.sweetie.1] =>Toolbar.SweetIM

[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Adware.Agent

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Adware.MyWebSearch

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}] =>Adware.IMBooster

[HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon

[HKLM\Software\Classes\Interface\{eee6c358-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\Interface\{eee6c35a-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{eee6c35b-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{eee6c35b-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Classes\CLSID\{eee6c35b-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\TypeLib\{eee6c35e-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Classes\TypeLib\{eee6c35f-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}] =>Toolbar.SweetIM

[HKCU\Software\SweetIM] =>Toolbar.SweetIM

[HKLM\Software\SweetIM] =>Toolbar.SweetIM

[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM] =>Toolbar.SweetIM

[HKLM\Software\aTube Catcher\OpenCandy] =>Adware.OpenCandy

C:\Program Files\DealPly =>PUP.DealPly

C:\Program Files\SweetIM =>Toolbar.SweetIM

C:\ProgramData\Babylon =>Toolbar.Babylon

C:\Users\Sergio\AppData\Roaming\Babylon =>Toolbar.Babylon

C:\Users\Sergio\AppData\Roaming\pdfforge =>PUP.Dealio

C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\SearchPlugins\sweetim.xml =>Toolbar.SweetIM

~ Scan Additionnel in 00mn 03s

 

 

 

---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)

SR - | Auto 27/07/2012 63960 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

SS - | Demand 18/08/2012 250056 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

SR - | Auto 10/11/2011 490840 | (AdvancedSystemCareService5) . (.IObit.) - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

SR - | Auto 21/08/2012 44808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

SS - | Auto 23/07/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe

SS - | Demand 23/07/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe

SS - | Demand 09/05/2011 136120 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

SR - | Auto 09/01/2012 821592 | (IMFservice) . (.IObit.) - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

SR - | Auto 20/12/2010 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

SS - | Demand 25/05/2012 129976 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

SS - | Demand 13/04/2007 792112 | (NBService) . (.Nero AG.) - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

SS - | Demand 08/05/2007 271920 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

SR - | Auto 11/09/2010 600680 | (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\System32\nvvsvc.exe

SR - | Auto 167936 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

SS - | Auto 07/06/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe

SR - | Auto 10/09/2010 369256 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

SR - | Auto 20/12/2010 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

SR - | Auto 14/12/2010 27760 | (VIAKaraokeService) . (.VIA Technologies, Inc..) - C:\Windows\System32\viakaraokesrv.exe

SR - | Auto 13/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 13/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Scan Services in 00mn 04s

 

 

 

End of the scan (1310 lines in 00mn 56s)(0)

 

Rapport de ZHPDiag v1.31.16 par Nicolas Coolman, Update du 04/09/2012

Run by Sergio at 04/09/2012 21:50:57

Web site : http://nicolascoolman.skyrock.com/

State : Error during network connexion

 

 

---\\ Web Browser

MSIE: Internet Explorer v9.0.8112.16421

MFIE: Mozilla Firefox 12.0 v12.0

GCIE: Google Chrome v21.0.1180.83 (Defaut)

 

---\\ Windows Product Information

~ Langage: Anglais

Windows 7 Home Basic Edition, 32-bit Service Pack 1 (Build 7601)

Windows Server License Manager Script : OK

Software Protection Service (Protection logicielle) : OK

Windows Automatic Updates : OK

Windows Activation Technologies : OK

 

---\\ System Information

~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel

~ Operating System: 32 Bits

Boot mode: Normal (Normal boot)

Total RAM: 3062 MB (65% free)

System Restore: Activé (Enable)

System drive C: has 324 GB (69%) free of 466 GB

 

---\\ Logged in mode

~ Computer Name: SERGIO-ORO01

~ User Name: Sergio

~ All Users Names: Sergio, Convidado, Administrador,

~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89

Logged in as Administrator

 

---\\ Environnement Variables

~ System Unit : C:\

~ %AppData% : C:\Users\Sergio\AppData\Roaming\

~ %Desktop% : C:\Users\Sergio\Desktop\

~ %Favorites% : C:\Users\Sergio\Favorites\

~ %LocalAppData% : C:\Users\Sergio\AppData\Local\

~ %StartMenu% : C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\

~ %Windir% : C:\Windows\

~ %System% : C:\Windows\System32\

 

---\\ DOS/Devices

C:\ Hard drive, Flash drive, Thumb drive (Free 324 Go of 466 Go)

D:\ CD-ROM drive (Free 0 Go of 6 Go)

 

 

 

---\\ Security Center & Tools Informations

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK

[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK

~ Scan Security Center in 00mn 00s

 

 

 

---\\ Search Generic System Files

[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Windows Explorer.) (.16/03/2012 - 17:15:33.) -- C:\Windows\Explorer.exe [2616320]

[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:14:45.) -- C:\Windows\System32\Wininit.exe [96256]

[MD5.75A97A2C060E72AB49E071E08C7DD2BA] - (.Microsoft Corporation - Internet Extensions para Win32.) (.28/06/2012 - 21:09:01.) -- C:\Windows\System32\wininet.dll [1129472]

[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 18:29:06.) -- C:\Windows\System32\Winlogon.exe [286720]

[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 18:29:24.) -- C:\Windows\System32\sppcomapi.dll [193536]

[MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.01/05/2012 - 19:53:48.) -- C:\Windows\system32\Drivers\AFD.sys [338944]

[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]

[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]

[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 18:29:03.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]

[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 18:29:07.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]

[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 18:29:03.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]

[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]

[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 20:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]

[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.14/05/2012 - 20:04:16.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]

[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 18:29:08.) -- C:\Windows\system32\Drivers\netBT.sys [187904]

[MD5.81189C3D7763838E55C397759D49007A] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.09/05/2012 - 21:22:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1211264]

[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 20:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]

[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 20:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]

[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 20:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]

[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 18:29:07.) -- C:\Windows\system32\Drivers\tdx.sys [74752]

[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 18:29:03.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]

~ Scan Generic Processes in 00mn 00s

 

 

 

---\\ Hidden files state (Hidden/Total)

~ Mes images (My Pictures) : 3/220

~ Mes musiques (My Musics) : 5/30

~ Mes Videos (My Videos) : 1/47

~ Mes Favoris (My Favorites) : 1/22

~ Mes Documents (My Documents) : 2/1341

~ Mon Bureau (My Desktop) : 2/28701

~ Menu demarrer (Programs) : 1/41

~ Scan Hidden Files in 00mn 16s

 

 

 

---\\ Running Processes

[MD5.BAD0D303EF0A519409C625738F3E10A3] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4282728] [PID.2892]

[MD5.9C2692541D9C828A51B42EB83ED10CE8] - (.IObit - Advanced SystemCare 5 Tray.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe [1647448] [PID.2904]

[MD5.2339760B238226DAD9ED03F939D92323] - (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe [1229848] [PID.3920]

[MD5.1007F26082E382C0196D6756902D7B10] - (...) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [3762688] [PID.3464]

~ Scan Processes Running in 00mn 00s

 

 

 

---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)

C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Preferences

G1 - GCS: Preference [user Data\Default] None

~ Scan Google Browser in 00mn 00s

 

 

 

---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)

C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\prefs.js

C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\user.js

M3 - MFPP: Plugins - [sergio] -- C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\searchplugins\sweetim.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\babylon.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\buscape.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\mercadolivre.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\mystartggtb.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\twitter.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-br.xml

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-br.xml

M0 - MFSP: prefs.js [sergio - hscznr7j.default] about:blank

M0 - MFSP: user.js [sergio - hscznr7j.default] about:home

M2 - MFEP: prefs.js [sergio - hscznr7j.default\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}] [] Memory Fox v7.4 (.IDEVFH.)

P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll

P2 - FPN: [HKLM] [@adobe.com/ShockwavePlayer] - (.Adobe Systems, Inc. - Adobe Shockwave for Director Netscape plug-in, version 11.6.) -- C:\Windows\system32\Adobe\Director\np32dsw.dll

P2 - FPN: [HKLM] [@Google.com/GoogleEarthPlugin] - (.Google - GEPlugin.) -- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

P2 - FPN: [HKLM] [@google.com/npPicasa3,version=3.0.0] - (.Google, Inc. - Picasa plugin.) -- C:\Program Files\Google\Picasa3\npPicasa3.dll

P2 - FPN: [HKLM] [@java.com/DTPlugin,version=10.5.1] - (.Oracle Corporation - NPRuntime Script Plug-in Library for Java Deploy.) -- C:\Windows\system32\npDeployJava1.dll

P2 - FPN: [HKLM] [@java.com/JavaPlugin,version=10.5.1] - (.Oracle Corporation - Next Generation Java Plug-in 10.5.1 for Mozilla browsers.) -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 5.1.10411.0.) -- C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3502.0922] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3538.0513] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3555.0308] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@mytalkpal.com/ffplugin] - (.Shanghai Qitai Tech. Co., Ltd. - Talkpal ASR Scriptable Plugin for Mozilla.) -- C:\Program Files\Talkpal\Speech Plugin For EF\npTalkpalPlugin.dll

P2 - FPN: [HKLM] [@nvidia.com/3DVision] - (.NVIDIA Corporation - NVIDIA 3D Vision plugin for Mozilla browsers.) -- C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

P2 - FPN: [HKLM] [@nvidia.com/3DVisionStreaming] - (.NVIDIA Corporation - NVIDIA 3D Vision Streaming plugin for Mozilla browsers.) -- C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

P2 - FPN: [HKLM] [@real.com/nppl3260;version=6.0.12.450] - (.RealNetworks, Inc. - RealPlayer LiveConnect-Enabled Plug-In.) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

P2 - FPN: [HKLM] [@real.com/nprpjplug;version=6.0.12.448] - (.RealNetworks, Inc. - 6.0.12.448.) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKLM] [Adobe Reader] - (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 10.1.4.) -- C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Users\Sergio\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Users\Sergio\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

P2 - FPN: [HKCU] [@unity3d.com/UnityPlayer,version=1.0] - (.Unity Technologies ApS - Unity Player 3.4.0f5.) -- C:\Users\Sergio\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

~ Scan Firefox Browser in 00mn 00s

 

 

 

---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)

R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com

R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Unity Technologies ApS - Unity Player 3.4.0f5.) (No version) -- (.not file.)

R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1

~ Scan IE Browser in 00mn 00s

 

 

 

---\\ Internet Explorer, Proxy Management (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

~ Scan Proxy management in 00mn 00s

 

 

 

---\\ Changed inifile Value, Mapped to Registry (F2)

F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,

F2 - REG:system.ini: Shell=C:\Windows\explorer.exe

F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe

~ Scan Keys in 00mn 00s

 

 

 

---\\ Hosts file redirection (O1)

~ Le fichier hosts est sain (The hosts file is clean).

~ Scan Hosts File in 00mn 00s

~ Nombre de lignes (Lines number): 21

 

 

 

---\\ Browser Helper Objects (O2)

O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} Orphean Key

O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Orphean Key

O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} Orphean Key

O2 - BHO: (no name) - {EEE6C35C-6118-11DC-9C72-001320C79847} Orphean Key

~ Scan BHO in 00mn 00s

 

 

 

---\\ Internet Explorer toolbars (O3)

O3 - Toolbar: (no name) - [HKLM]{EEE6C35B-6118-11DC-9C72-001320C79847} . (...) -- (.not file.)

O3 - Toolbar: (no name) - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (...) -- (.not file.)

~ Scan Toolbar in 00mn 00s

 

 

 

---\\ Auto loading programs from Registry and folders (O4)

O4 - HKLM\..\Run: [iObit Malware Fighter] . (.IObit - IObit Malware Fighter.) -- C:\Program Files\IObit\IObit Malware Fighter\IMF.exe

O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe

O4 - HKCU\..\Run: [Advanced SystemCare 5] . (.IObit - Advanced SystemCare 5 Tray.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe

O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe

O4 - HKUS\S-1-5-21-233118252-3700368971-1040465616-1000\..\Run: [Advanced SystemCare 5] . (.IObit - Advanced SystemCare 5 Tray.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe

~ Scan Application in 00mn 00s

 

 

 

---\\ Other User Links (O4)

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Angr Birds.lnk . (...) -- C:\Users\Sergio\Documents\Thales\Angry Birds Pc Game

O4 - Global Startup: C:\Users\Sergio\Desktop\ASC - Atalho.lnk . (.IObit.) -- C:\Program Files\IObit\Advanced SystemCare 5\ASC.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\CHROME.lnk . (.Google Inc..) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Computador.lnk - Orphean Key

O4 - Global Startup: C:\Users\Sergio\Desktop\FIFA 11.lnk . (.Electronic Arts.) -- C:\Program Files\EA Sports\FIFA 11\Game\fifa.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Format Factory.lnk . (.Free Time.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\HijackThis - Atalho.lnk . (.Trend Micro Inc..) -- C:\Users\Sergio\Desktop\Downloads\HijackThis.exe

O4 - Global Startup: C:\Users\Sergio\Desktop\Painel de Controle - Atalho.lnk - Orphean Key

O4 - Global Startup: C:\Users\Sergio\Desktop\SC - Atalho.lnk - Orphean Key

O4 - Global Startup: C:\Users\Sergio\Desktop\The Sims 3.lnk . (.Electronic Arts, Inc..) -- C:\Program Files\Electronic Arts\The Sims 3\Game\Bin\TS3.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\aTube Catcher.lnk . (.DsNET.) -- C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Fotosizer.lnk . (.Fotosizer.com.) -- C:\Program Files\Fotosizer\Fotosizer.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe

O4 - Global Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk . (.Google Inc..) -- C:\Program Files\Google\Picasa3\Picasa3.exe

~ Scan Global Startup in 00mn 00s

 

 

 

---\\ IE Options icon not visible in Control Panel (O5)

O5 - control.ini: [HKLM\..\Control Panel] inetcpl.cpl=no

~ Scan IE Control Panel in 00mn 00s

 

 

 

---\\ Winsock hijacker (Layered Service Provider) (O10)

O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll

O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Provedor de Correção de Nomeação de Emails.) -- C:\Windows\system32\napinsp.dll

O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\Windows\system32\pnrpnsp.dll

O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\Windows\system32\pnrpnsp.dll

O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Provedor de serviços do Microsoft Windows Sockets 2.0.) -- C:\Windows\system32\mswsock.dll

O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll

O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.dll

O10 - WLSP:\000000000008\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.dll

~ Scan Winsock in 00mn 00s

 

 

 

---\\ Extra protocols (O18)

O18 - Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} . (.Microsoft Corporation - Controle ActiveX para streaming de vídeo.) -- C:\Windows\System32\msvidctl.dll

O18 - Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\System32\itss.dll

O18 - Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\Program Files\Windows Live\Messenger\msgrapp.dll

O18 - Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\Windows\system32\inetcomm.dll

O18 - Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\Windows\system32\urlmon.dll

O18 - Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\System32\itss.dll

O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\Program Files\Windows Live\Messenger\msgrapp.dll

O18 - Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} . (.Skype Technologies S.A. - Skype Click to Call for Internet Explorer.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\Program Files\Common Files\Skype\Skype4COM.dll

O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} . (.Microsoft Corporation - Controle ActiveX para streaming de vídeo.) -- C:\Windows\System32\msvidctl.dll

O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll

O18 - Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll

O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll

~ Scan Protocole Additionnel in 00mn 00s

 

 

 

---\\ AppInit_DLLs Registry value Autorun (O20)

O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll

~ Scan Winlogon in 00mn 00s

 

 

 

---\\ ShellServiceObjectDelayLoad (O21)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

~ Scan SSODL in 00mn 00s

 

 

 

---\\ non Microsoft non disabled Windows XP/NT/2000 Services (O23)

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) . (.IObit - Advanced SystemCare Service.) - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

O23 - Service: avast! Antivirus (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Google Update Service (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: IMF Service (IMFservice) . (.IObit - IObit Malware Fighter Service.) - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

O23 - Service: Intel® Management and Security Applica (LMS) . (.Intel Corporation - Local Manageability Service.) - C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 260.6.) - C:\Windows\System32\nvvsvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) . (.Unknown owner - RichVideo Module.) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) . (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: Intel® Management and Security Applica (UNS) . (.Intel Corporation - User Notification Service.) - C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: VIA Karaoke digital mixer Service (VIAKaraokeService) . (.VIA Technologies, Inc. - Service binary.) - C:\Windows\System32\viakaraokesrv.exe

~ Scan Services in 00mn 00s

 

 

 

---\\ Windows Active Desktop & MHTML Editor (O24)

O24 - Default MHTML Editor: Last - .(...) - (.not file.)

~ Scan Desktop Component in 00mn 00s

 

 

 

---\\

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

~ Scan Keys in 00mn 00s

 

 

 

---\\ Task Planned Automatically(039)

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Adobe Flash Player Updater.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\AWC Startup.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000Core.job

O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000UA.job

[MD5.A9D3B95E8466BD58EEB8A1154654E162] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

[MD5.B174DE0DE6C9AA8AFFD3B926653E625F] [APT] [avast! Emergency Update] (.AVAST Software.) -- C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe

[MD5.00000000000000000000000000000000] [APT] [AWC Startup] (...) -- C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (.not file.)

[MD5.6E8A4256CEC328029C0D923EADA47F04] [APT] [CCleanerSkipUAC] (.Piriform Ltd.) -- C:\Program Files\CCleaner\CCleaner.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000Core] (.Google Inc..) -- C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskUserS-1-5-21-233118252-3700368971-1040465616-1000UA] (.Google Inc..) -- C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

[MD5.00000000000000000000000000000000] [APT] [Your File Updater] (...) -- C:\Program Files\YourFileDownloader\YourFileUpdater.exe (.not file.)

[MD5.92B476DD52794881A4B91A5529C2706B] [APT] [{06813D29-5971-421C-9BB7-F11B97330C4D}] (...) -- C:\Program Files\AVAST Software\Avast\aswRundll.exe

[MD5.2339760B238226DAD9ED03F939D92323] [APT] [{0A863E78-F2F5-48AD-91F3-089BA4C4FF87}] (.Google Inc..) -- c:\users\Sergio\appdata\local\google\chrome\application\chrome.exe

[MD5.00000000000000000000000000000000] [APT] [{23871746-E748-4EAB-8F71-56D591FE1CCA}] (...) -- D:\SETUP.exe (.not file.)

[MD5.00000000000000000000000000000000] [APT] [{AB3101C9-BCDC-46F3-A8F0-022C19D1F841}] (...) -- D:\SETUP.exe (.not file.)

~ Scan Scheduled Task in 00mn 01s

 

 

 

---\\ ActiveSetup Installed Components (O40)

O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\Windows\System32\wmploc.dll

O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe

O40 - ASIC: Browser Customizations - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} . (.Microsoft Corporation - Identidade visual IEAK.) -- C:\Windows\System32\iedkcs32.dll

O40 - ASIC: Microsoft Windows Media Player 12.0 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\Windows\System32\wmpdxm.dll

O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API de tema do Windows.) -- C:\Windows\System32\themeui.dll

O40 - ASIC: Microsoft Windows - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe

O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extensão shell da pasta FTP do Microsoft Internet Explorer.) -- C:\Windows\System32\msieftp.dll

O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\Windows\System32\wmploc.dll

O40 - ASIC: Windows Desktop Update - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL comum do Shell do Windows.) -- C:\Windows\System32\shell32.dll

O40 - ASIC: Web Platform Customizations - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe

O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\Windows\system32\mscories.dll

~ Scan Active Setup in 00mn 00s

 

 

 

---\\ Drivers launched at startup (O41)

O41 - Driver: C:\Windows\System32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys

O41 - Driver: (aswRdr) . (.AVAST Software - avast! WFP Redirect Driver.) - C:\Windows\system32\Drivers\aswrdr2.sys

O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\system32\drivers\blbdrive.sys

O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys

O41 - Driver: C:\Windows\System32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys

O41 - Driver: C:\Windows\System32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys

O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\system32\drivers\mssmbios.sys

O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys

O41 - Driver: C:\Windows\System32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys

O41 - Driver: C:\Windows\System32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys

O41 - Driver: C:\Windows\System32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Agendador de pacotes de serviço.) - C:\Windows\System32\DRIVERS\pacer.sys

O41 - Driver: C:\Windows\System32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Driver do Subsistema de Buffer da Unidade R.) - C:\Windows\System32\DRIVERS\rdbss.sys

O41 - Driver: C:\Windows\System32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys

O41 - Driver: C:\Windows\System32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys

O41 - Driver: C:\Windows\System32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys

O41 - Driver: C:\Windows\System32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys

O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\system32\drivers\termdd.sys

O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys

O41 - Driver: C:\Windows\System32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys

O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys

~ Scan Drivers in 00mn 00s

 

 

 

---\\ Software installed (O42)

O42 - Logiciel: Adobe Flash Player 11 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX

O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin

O42 - Logiciel: Adobe Reader X (10.1.4) - Português - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1046-7B44-AA1000000001}

O42 - Logiciel: Adobe Shockwave Player 11.6 - (.Adobe Systems, Inc..) [HKLM] -- Adobe Shockwave Player

O42 - Logiciel: Advanced SystemCare 5 - (.IObit.) [HKLM] -- Advanced SystemCare 5_is1

O42 - Logiciel: BrOffice 3.3 - (.LibreOffice.) [HKLM] -- {3D33A4EB-957B-4212-BF0D-7F7FB02F1BE3}

O42 - Logiciel: BrOffice 3.3 Help Pack (Portuguese (Brazil)) - (.LibreOffice.) [HKLM] -- {8519EEBE-0090-4C86-8AF6-FDCABBB26E96}

O42 - Logiciel: Brothers In Arms - (.Ubisoft.) [HKLM] -- BrothersInArms

O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner

O42 - Logiciel: Controle ActiveX do Windows Live Mesh para Conexões Remotas - (.Microsoft Corporation.) [HKLM] -- {39B3184E-0BFB-40FA-ADDC-E7E2D535CDA9}

O42 - Logiciel: D3DX10 - (.Microsoft.) [HKLM] -- {E09C4DB7-630C-4F06-A631-8EA7239923AF}

O42 - Logiciel: DVD Suite - (.CyberLink Corporation.) [HKLM] -- {1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}

O42 - Logiciel: EF Englishtown Advanced Speech Recognition versão 4.6.449.1 - (.Shanghai Kingtas Technology Co., Ltd..) [HKLM] -- EF Englishtown Advanced Speech Recognition_is1

O42 - Logiciel: FIFA 11 - (.Electronic Arts.) [HKLM] -- {3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}

O42 - Logiciel: FM Screen Capture Codec (Remove Only) - (.Unknown owner.) [HKLM] -- FMCODEC

O42 - Logiciel: FormatFactory 2.90 - (.Free Time.) [HKLM] -- FormatFactory

O42 - Logiciel: Fotosizer 1.32 - (.Fotosizer.com.) [HKLM] -- Fotosizer

O42 - Logiciel: GetDataBack for NTFS - (.Runtime Software.) [HKLM] -- {56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}

O42 - Logiciel: Google Chrome - (.Google Inc..) [HKCU] -- Google Chrome

O42 - Logiciel: Google Earth Plug-in - (.Google.) [HKLM] -- {33286280-8617-11E1-8FF6-B8AC6F97B88E}

O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

O42 - Logiciel: IObit Malware Fighter - (.IObit.) [HKLM] -- IObit Malware Fighter_is1

O42 - Logiciel: Intel® Management Engine Components - (.Intel Corporation.) [HKLM] -- {65153EA5-8B6E-43B6-857B-C6E4FC25798A}

O42 - Logiciel: Internet Explorer Toolbar 4.6 by SweetPacks - (.SweetIM Technologies Ltd..) [HKLM] -- {C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}

O42 - Logiciel: Java 7 Update 5 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83217005FF}

O42 - Logiciel: JavaFX 2.1.1 - (.Oracle Corporation.) [HKLM] -- {1111706F-666A-4037-7777-211328764D10}

O42 - Logiciel: K-Lite Mega Codec Pack 5.5.1 - (.Unknown owner.) [HKLM] -- KLiteCodecPack_is1

O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}

O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile PTB Language Pack - (.Microsoft Corporation.) [HKLM] -- {20A15757-4AE4-3C82-9711-863C84AFE6AA}

O42 - Logiciel: Microsoft Office Word Viewer 2003 - (.Microsoft Corporation.) [HKLM] -- {90850409-6000-11D3-8CFE-0150048383C9}

O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}

O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - (.Microsoft Corporation.) [HKLM] -- {9BE518E6-ECC6-35A9-88E4-87755C07200F}

O42 - Logiciel: Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 - (.Microsoft Corporation.) [HKLM] -- {196BB40D-1578-3D01-B289-BEFC77A11A1E}

O42 - Logiciel: Microsoft WSE 3.0 Runtime - (.Microsoft Corp..) [HKLM] -- {E3E71D07-CD27-46CB-8448-16D4FB29AA13}

O42 - Logiciel: MiniTool Power Data Recovery - (.MiniTool Solution Ltd..) [HKLM] -- MiniTool Power Data Recovery_is1

O42 - Logiciel: Mozilla Firefox 12.0 (x86 pt-BR) - (.Mozilla.) [HKLM] -- Mozilla Firefox 12.0 (x86 pt-BR)

O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM] -- MozillaMaintenanceService

O42 - Logiciel: NVIDIA Driver de gráficos 260.63 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver

O42 - Logiciel: NVIDIA Driver de áudio HD 1.1.9.0 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver

O42 - Logiciel: NVIDIA Driver do 3D Vision 260.63 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision

O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM] -- {B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}

O42 - Logiciel: NVIDIA Software do sistema PhysX 9.10.0514 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX

O42 - Logiciel: NVIDIA Stereoscopic 3D Driver - (.NVIDIA Corporation.) [HKLM] -- NVIDIAStereo

O42 - Logiciel: Nero 7 Essentials - (.Nero AG.) [HKLM] -- {9B4E6CB9-E54D-47F7-A414-E2D5740E1046}

O42 - Logiciel: PC Camera - (.PixArt.) [HKLM] -- {B2920232-19DA-44FC-835F-68E427EAE2CE}

O42 - Logiciel: Pacote de Idiomas do Microsoft .NET Framework 4 Client Profile - Português - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile PTB Language Pack

O42 - Logiciel: Picasa 3 - (.Google, Inc..) [HKLM] -- Picasa 3

O42 - Logiciel: PowerDVD - (.CyberLink Corporation.) [HKLM] -- {6811CAA0-BF12-11D4-9EA1-0050BAE317E1}

O42 - Logiciel: Project64 1.6 - (.Project64.) [HKLM] -- {9559F7CA-5E34-4237-A2D9-D856464AD727}

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2604121

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656351

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656368v2

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656405

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2686827

O42 - Logiciel: Skype Click to Call - (.Skype Technologies S.A..) [HKLM] -- {B6CF2967-C81E-40C0-9815-C05774FEF120}

O42 - Logiciel: Skype™ 5.10 - (.Skype Technologies S.A..) [HKLM] -- {EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}

O42 - Logiciel: Speccy - (.Piriform.) [HKLM] -- Speccy

O42 - Logiciel: The Sims™ 3 - (.Electronic Arts.) [HKLM] -- {C05D8CDB-417D-4335-A38C-A0659EDFD6B8}

O42 - Logiciel: Unity Web Player - (.Unity Technologies ApS.) [HKCU] -- UnityWebPlayer

O42 - Logiciel: Update Manager for SweetPacks 1.1 - (.SweetIM Technologies Ltd..) [HKLM] -- {EA8FA6BE-29BE-4AF2-9352-841F83215EB0}

O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2468871) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871

O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2533523) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523

O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2600217) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217

O42 - Logiciel: VIA Gerenciador de dispositivo de plataforma - (.VIA Technologies, Inc..) [HKLM] -- InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}

O42 - Logiciel: WinRAR 4.01 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver

O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {D45240D3-B6B3-4FF9-B243-54ECE3E10066}

O42 - Logiciel: Windows Live Essentials - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite

O42 - Logiciel: Windows Live Essentials - (.Microsoft Corporation.) [HKLM] -- {43B43577-2514-4CE0-B14A-7E85C17C0453}

O42 - Logiciel: Windows Live Family Safety - (.Microsoft Corporation.) [HKLM] -- {2922DB34-682F-4A9C-BE18-6E579DBD1420}

O42 - Logiciel: Windows Live Family Safety - (.Microsoft Corporation.) [HKLM] -- {2D6E3D97-1FDF-4993-AC75-72F59EC445C5}

O42 - Logiciel: Windows Live Galeria de Fotos - (.Microsoft Corporation.) [HKLM] -- {F7A46527-DF1F-4B0F-9637-98547E189442}

O42 - Logiciel: Windows Live ID Sign-in Assistant - (.Microsoft Corporation.) [HKLM] -- {C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}

O42 - Logiciel: Windows Live Installer - (.Microsoft Corporation.) [HKLM] -- {0B0F231F-CE6A-483D-AA23-77B364F75917}

O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {C9E1343D-E21E-4508-A1BE-04A089EC137D}

O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {E5B21F11-6933-4E0B-A25C-7963E3C07D11}

O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {92EA4134-10D1-418A-91E1-5A0453131A38}

O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}

O42 - Logiciel: Windows Live PIMT Platform - (.Microsoft Corporation.) [HKLM] -- {83C292B7-38A5-440B-A731-07070E81A64F}

O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM] -- {A9BDCA6B-3653-467B-AC83-94367DA3BFE3}

O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM] -- {B33B61FE-701F-425F-98AB-2B85725CBF68}

O42 - Logiciel: Windows Live Photo Gallery - (.Microsoft Corporation.) [HKLM] -- {3336F667-9049-4D46-98B6-4C743EEBC5B1}

O42 - Logiciel: Windows Live SOXE - (.Microsoft Corporation.) [HKLM] -- {682B3E4F-696A-42DE-A41C-4C07EA1678B4}

O42 - Logiciel: Windows Live SOXE Definitions - (.Microsoft Corporation.) [HKLM] -- {200FEC62-3C34-4D60-9CE8-EC372E01C08F}

O42 - Logiciel: Windows Live UX Platform - (.Microsoft Corporation.) [HKLM] -- {CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}

O42 - Logiciel: Windows Live UX Platform Language Pack - (.Microsoft Corporation.) [HKLM] -- {DF71ABBB-B834-41C0-BB58-80B0545D754C}

O42 - Logiciel: Windows Media Player Firefox Plugin - (.Microsoft Corp.) [HKLM] -- {69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

O42 - Logiciel: aTube Catcher - (.DsNET Corp.) [HKLM] -- aTube Catcher

O42 - Logiciel: avast! Free Antivirus v7.0.1466.0 - (.AVAST Software.) [HKLM] -- avast

O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}

O42 - Logiciel: swMSM - (.Adobe Systems, Inc.) [HKLM] -- {612C34C7-5E90-47D8-9B5C-0F717DD82726}

O42 - Logiciel: upapp - (.Hewlett-Packard.) [HKLM] -- {4EF69D40-4DC9-485E-95D3-B1C22F218FC8}

 

---\\ HKCU & HKLM Software Keys

[HKCU\Software\AVAST Software]

[HKCU\Software\Adobe]

[HKCU\Software\Afom]

[HKCU\Software\Ahead]

[HKCU\Software\AppDataLow\Software\Adobe]

[HKCU\Software\AppDataLow\Software\Microsoft]

[HKCU\Software\AppDataLow\Software\Smartbar]

[HKCU\Software\AppDataLow\Software\Unity]

[HKCU\Software\AppDataLow\Software\fastestd]

[HKCU\Software\AppDataLow\Software]

[HKCU\Software\AppDataLow]

[HKCU\Software\Bugsplat]

[HKCU\Software\Classes]

[HKCU\Software\Clients]

[HKCU\Software\Conduit]

[HKCU\Software\Convar]

[HKCU\Software\CyberLink]

[HKCU\Software\DivXNetworks]

[HKCU\Software\DsNET Corp.]

[HKCU\Software\EA Sports]

[HKCU\Software\Electronic Arts]

[HKCU\Software\Fastest Free YouTube Downloader]

[HKCU\Software\Fotosizer]

[HKCU\Software\FreeTime]

[HKCU\Software\GNU]

[HKCU\Software\GSpot Appliance Corp]

[HKCU\Software\Gabest]

[HKCU\Software\Google]

[HKCU\Software\Haali]

[HKCU\Software\IM Providers]

[HKCU\Software\INCAInternet]

[HKCU\Software\JaboSoft]

[HKCU\Software\JavaSoft]

[HKCU\Software\Leadertech]

[HKCU\Software\LibreOffice]

[HKCU\Software\Local AppWizard-Generated Applications]

[HKCU\Software\MONOGRAM]

[HKCU\Software\Macromedia]

[HKCU\Software\MediaInfo]

[HKCU\Software\MozillaPlugins]

[HKCU\Software\N64 Emulation]

[HKCU\Software\NVIDIA Corporation]

[HKCU\Software\Netscape]

[HKCU\Software\Opera Software]

[HKCU\Software\PS2Eplugin]

[HKCU\Software\Piriform]

[HKCU\Software\Policies]

[HKCU\Software\RealNetworks]

[HKCU\Software\SecuROM]

[HKCU\Software\SkypeRS]

[HKCU\Software\Skype]

[HKCU\Software\SweetIM]

[HKCU\Software\Trolltech]

[HKCU\Software\Ubisoft]

[HKCU\Software\Unity]

[HKCU\Software\VB and VBA Program Settings]

[HKCU\Software\Valve]

[HKCU\Software\WinRAR SFX]

[HKCU\Software\WinRAR]

[HKCU\Software\YourFileDownloader]

[HKCU\Software\eBook Maestro Books]

[HKCU\Software\madFlac]

[HKLM\Software\685D6D1C-D73A-4F37-B7E5E53660311DDB]

[HKLM\Software\AGEIA Technologies]

[HKLM\Software\ATI Technologies]

[HKLM\Software\AVAST Software]

[HKLM\Software\Adobe]

[HKLM\Software\Ahead]

[HKLM\Software\AppDataLow]

[HKLM\Software\AviSynth]

[HKLM\Software\Babylon]

[HKLM\Software\CBSTEST]

[HKLM\Software\Classes]

[HKLM\Software\Clients]

[HKLM\Software\Codec Tweak Tool]

[HKLM\Software\CyberLink]

[HKLM\Software\DivXNetworks]

[HKLM\Software\EA Sports]

[HKLM\Software\Electronic Arts]

[HKLM\Software\GNU]

[HKLM\Software\Google]

[HKLM\Software\HaaliMkx]

[HKLM\Software\Hewlett-Packard]

[HKLM\Software\Huawei technologies]

[HKLM\Software\IObit]

[HKLM\Software\InstallShield]

[HKLM\Software\Intel]

[HKLM\Software\JavaSoft]

[HKLM\Software\JreMetrics]

[HKLM\Software\KLCodecPack]

[HKLM\Software\Khronos]

[HKLM\Software\Lake]

[HKLM\Software\LexmarkLaser]

[HKLM\Software\LibreOffice]

[HKLM\Software\Licenses]

[HKLM\Software\LightComm]

[HKLM\Software\Macromedia]

[HKLM\Software\MozillaPlugins]

[HKLM\Software\Mozilla]

[HKLM\Software\NVIDIA Corporation]

[HKLM\Software\Nero]

[HKLM\Software\ODBC]

[HKLM\Software\Oracle]

[HKLM\Software\Piriform]

[HKLM\Software\PixArt]

[HKLM\Software\Policies]

[HKLM\Software\QSound Labs, Inc.]

[HKLM\Software\RTS]

[HKLM\Software\RealNetworks]

[HKLM\Software\RegisteredApplications]

[HKLM\Software\Runtime Software]

[HKLM\Software\S3R521]

[HKLM\Software\Sims]

[HKLM\Software\Skype]

[HKLM\Software\Software]

[HKLM\Software\SweetIM]

[HKLM\Software\Systweak]

[HKLM\Software\TrendMicro]

[HKLM\Software\Ubisoft]

[HKLM\Software\Uniblue]

[HKLM\Software\VIA Technologies, Inc]

[HKLM\Software\WOW6432Node]

[HKLM\Software\WinRAR]

[HKLM\Software\YourFileDownloader]

[HKLM\Software\mozilla.org]

[HKLM\Software\v9magic]

~ Scan Softwares in 00mn 00s

 

 

 

---\\ Contents of the Common Files folders (O43)

O43 - CFD: 25/07/2011 - 10:51:41 - [111,709] ----D C:\Program Files\Adobe

O43 - CFD: 23/07/2011 - 13:46:33 - [0] R---D C:\Program Files\Arquivos Comuns

O43 - CFD: 01/09/2012 - 19:38:24 - [245,643] ----D C:\Program Files\AVAST Software

O43 - CFD: 14/04/2012 - 14:53:53 - [-1245,451] ----D C:\Program Files\BrothersInArms

O43 - CFD: 26/08/2012 - 17:50:50 - [4,684] ----D C:\Program Files\CCleaner

O43 - CFD: 23/07/2012 - 01:49:36 - [198,470] ----D C:\Program Files\Common Files

O43 - CFD: 05/04/2012 - 17:30:23 - [2,699] ----D C:\Program Files\Convar

O43 - CFD: 04/07/2011 - 17:21:03 - [96,490] ----D C:\Program Files\CyberLink

O43 - CFD: 14/04/2012 - 14:43:52 - [0] ----D C:\Program Files\DealPly

O43 - CFD: 26/07/2012 - 17:49:25 - [37,418] ----D C:\Program Files\DsNET Corp

O43 - CFD: 20/11/2010 - 23:33:04 - [3,997] ----D C:\Program Files\DVD Maker

O43 - CFD: 27/12/2011 - 19:30:52 - [-1940,999] ----D C:\Program Files\EA Sports

O43 - CFD: 24/07/2011 - 19:51:33 - [1517,861] ----D C:\Program Files\Electronic Arts

O43 - CFD: 26/07/2012 - 00:13:19 - [25,815] ----D C:\Program Files\FormatFactory

O43 - CFD: 31/08/2011 - 22:31:08 - [4,091] ----D C:\Program Files\Fotosizer

O43 - CFD: 23/07/2011 - 23:09:47 - [111,406] ----D C:\Program Files\FreeTime

O43 - CFD: 02/08/2012 - 22:56:13 - [146,877] ----D C:\Program Files\Google

O43 - CFD: 13/08/2011 - 23:00:59 - [1,287] ----D C:\Program Files\Hewlett-Packard

O43 - CFD: 27/12/2011 - 10:25:51 - [1,021] ----D C:\Program Files\hp deskjet 3420 series

O43 - CFD: 26/08/2012 - 17:58:41 - [1,469] --H-D C:\Program Files\InstallJammer Registry

O43 - CFD: 23/07/2012 - 00:54:28 - [19,068] --H-D C:\Program Files\InstallShield Installation Information

O43 - CFD: 04/07/2011 - 16:47:30 - [10,574] ----D C:\Program Files\Intel

O43 - CFD: 01/09/2012 - 19:32:44 - [4,929] ----D C:\Program Files\Internet Explorer

O43 - CFD: 30/06/2012 - 17:56:17 - [248,585] ----D C:\Program Files\IObit

O43 - CFD: 23/07/2012 - 01:45:44 - [176,542] ----D C:\Program Files\Java

O43 - CFD: 24/07/2011 - 19:44:21 - [63,447] ----D C:\Program Files\K-Lite Codec Pack

O43 - CFD: 06/03/2012 - 10:58:50 - [0,075] ----D C:\Program Files\Lexmark

O43 - CFD: 27/07/2011 - 12:39:37 - [462,377] ----D C:\Program Files\LibreOffice 3

O43 - CFD: 14/07/2009 - 01:52:30 - [44,793] ----D C:\Program Files\Microsoft Games

O43 - CFD: 24/07/2011 - 00:56:42 - [11,281] ----D C:\Program Files\Microsoft Office

O43 - CFD: 18/05/2012 - 12:41:09 - [40,838] ----D C:\Program Files\Microsoft Silverlight

O43 - CFD: 04/07/2011 - 15:20:48 - [1,745] ----D C:\Program Files\Microsoft SQL Server Compact Edition

O43 - CFD: 24/07/2011 - 20:20:47 - [0,934] ----D C:\Program Files\Microsoft WSE

O43 - CFD: 10/07/2012 - 09:44:18 - [0,015] ----D C:\Program Files\Microsoft.NET

O43 - CFD: 25/05/2012 - 15:22:30 - [40,391] ----D C:\Program Files\Mozilla Firefox

O43 - CFD: 25/05/2012 - 15:22:33 - [0,210] ----D C:\Program Files\Mozilla Maintenance Service

O43 - CFD: 16/03/2012 - 17:11:29 - [0,224] ----D C:\Program Files\Mozilla Thunderbird

O43 - CFD: 14/07/2009 - 01:52:30 - [0,025] ----D C:\Program Files\MSBuild

O43 - CFD: 24/07/2011 - 00:56:26 - [25,894] ----D C:\Program Files\MSECache

O43 - CFD: 14/05/2012 - 20:00:19 - [0] ----D C:\Program Files\MSXML 4.0

O43 - CFD: 04/07/2011 - 17:23:18 - [179,641] ----D C:\Program Files\Nero

O43 - CFD: 23/07/2011 - 13:58:51 - [297,892] ----D C:\Program Files\NVIDIA Corporation

O43 - CFD: 05/05/2012 - 19:07:10 - [0,000] ----D C:\Program Files\Opera

O43 - CFD: 23/07/2012 - 01:46:55 - [33,207] ----D C:\Program Files\Oracle

O43 - CFD: 04/06/2012 - 23:39:11 - [0] ----D C:\Program Files\Pando Networks

O43 - CFD: 23/07/2012 - 04:09:56 - [6,869] ----D C:\Program Files\PC Inspector File Recovery

O43 - CFD: 17/03/2012 - 23:35:24 - [0,086] ----D C:\Program Files\PDF Printer Pilot Pro

O43 - CFD: 17/03/2012 - 23:47:08 - [8,929] ----D C:\Program Files\PDFCreator

O43 - CFD: 02/07/2012 - 16:12:05 - [0,003] ----D C:\Program Files\PhotoScape

O43 - CFD: 31/07/2011 - 22:27:09 - [0,152] ----D C:\Program Files\PixArt

O43 - CFD: 24/07/2012 - 00:07:38 - [16,381] ----D C:\Program Files\PowerDataRecovery

O43 - CFD: 12/11/2011 - 19:26:02 - [3,364] ----D C:\Program Files\Project64 1.6

O43 - CFD: 22/07/2012 - 21:05:06 - [9,208] ----D C:\Program Files\PSafe

O43 - CFD: 14/07/2009 - 01:52:30 - [37,262] ----D C:\Program Files\Reference Assemblies

O43 - CFD: 23/07/2012 - 04:09:40 - [4,388] ----D C:\Program Files\Runtime Software

O43 - CFD: 22/07/2012 - 21:05:07 - [33,200] R---D C:\Program Files\Skype

O43 - CFD: 05/04/2012 - 20:02:51 - [0,444] ----D C:\Program Files\Sony

O43 - CFD: 25/07/2011 - 20:36:18 - [4,347] ----D C:\Program Files\Speccy

O43 - CFD: 01/09/2012 - 19:32:41 - [0] ----D C:\Program Files\Spyware Terminator

O43 - CFD: 01/10/2011 - 22:53:53 - [0,000] ----D C:\Program Files\Stellar Phoenix Photo Recovery

O43 - CFD: 04/09/2012 - 20:56:31 - [6,634] ----D C:\Program Files\SweetIM

O43 - CFD: 21/03/2012 - 22:49:16 - [12,875] ----D C:\Program Files\Talkpal

O43 - CFD: 14/07/2009 - 01:53:23 - [0] --H-D C:\Program Files\Uninstall Information

O43 - CFD: 01/09/2012 - 19:32:42 - [0,779] ----D C:\Program Files\v9Soft

O43 - CFD: 04/07/2011 - 17:02:42 - [24,170] ----D C:\Program Files\VIA

O43 - CFD: 27/02/2012 - 09:08:20 - [0,010] ----D C:\Program Files\VSLogonScreenCustomizer

O43 - CFD: 20/11/2010 - 23:33:03 - [2,897] ----D C:\Program Files\Windows Defender

O43 - CFD: 09/07/2012 - 20:10:17 - [119,631] ----D C:\Program Files\Windows Live

O43 - CFD: 06/03/2012 - 10:58:56 - [5,870] ----D C:\Program Files\Windows Mail

O43 - CFD: 17/03/2012 - 23:47:08 - [6,286] ----D C:\Program Files\Windows Media Player

O43 - CFD: 23/07/2011 - 13:46:33 - [11,630] ----D C:\Program Files\Windows NT

O43 - CFD: 20/11/2010 - 23:33:04 - [4,210] ----D C:\Program Files\Windows Photo Viewer

O43 - CFD: 20/11/2010 - 18:33:48 - [0,181] ----D C:\Program Files\Windows Portable Devices

O43 - CFD: 06/03/2012 - 10:58:50 - [5,900] ----D C:\Program Files\Windows Sidebar

O43 - CFD: 23/07/2011 - 23:03:31 - [5,206] ----D C:\Program Files\WinRAR

O43 - CFD: 04/09/2012 - 21:51:23 - [10,038] ----D C:\Program Files\ZHPDiag

O43 - CFD: 25/07/2011 - 10:51:46 - [3,721] ----D C:\Program Files\Common Files\Adobe

O43 - CFD: 04/07/2011 - 17:25:15 - [83,324] ----D C:\Program Files\Common Files\Ahead

O43 - CFD: 04/07/2011 - 17:20:40 - [4,657] ----D C:\Program Files\Common Files\InstallShield

O43 - CFD: 23/07/2012 - 01:49:36 - [1,181] ----D C:\Program Files\Common Files\Java

O43 - CFD: 17/03/2012 - 23:47:08 - [38,431] ----D C:\Program Files\Common Files\microsoft shared

O43 - CFD: 17/03/2012 - 23:47:08 - [15,994] ----D C:\Program Files\Common Files\PAC7302

O43 - CFD: 04/07/2011 - 16:47:34 - [0,155] ----D C:\Program Files\Common Files\postureAgent

O43 - CFD: 13/07/2009 - 23:37:05 - [0,003] ----D C:\Program Files\Common Files\Services

O43 - CFD: 23/07/2011 - 13:46:33 - [0] ----D C:\Program Files\Common Files\Sistema

O43 - CFD: 22/07/2012 - 21:05:07 - [2,056] ----D C:\Program Files\Common Files\Skype

O43 - CFD: 13/07/2009 - 23:37:05 - [39,200] ----D C:\Program Files\Common Files\SpeechEngines

O43 - CFD: 09/05/2012 - 23:50:26 - [9,748] ----D C:\Program Files\Common Files\System

O43 - CFD: 04/07/2011 - 15:18:39 - [0] ----D C:\Program Files\Common Files\Windows Live

O43 - CFD: 08/10/2011 - 12:00:12 - [168,998] ----D C:\ProgramData\Adobe

O43 - CFD: 04/07/2011 - 17:25:20 - [0,000] ----D C:\ProgramData\Ahead

O43 - CFD: 06/03/2012 - 10:57:48 - [4,056] ----D C:\ProgramData\AlawarWrapper

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Application Data

O43 - CFD: 26/07/2012 - 17:48:11 - [3,966] ----D C:\ProgramData\Ask

O43 - CFD: 01/09/2012 - 19:38:24 - [2,044] ----D C:\ProgramData\AVAST Software

O43 - CFD: 05/04/2012 - 17:24:17 - [0] ----D C:\ProgramData\Babylon

O43 - CFD: 17/02/2012 - 21:50:46 - [0] ----D C:\ProgramData\CasualForge

O43 - CFD: 23/07/2011 - 23:30:30 - [0,023] ----D C:\ProgramData\CyberLink

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Dados de aplicativos

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Desktop

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Documentos

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Documents

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Favorites

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Favoritos

O43 - CFD: 04/07/2011 - 17:04:28 - [0,001] ----D C:\ProgramData\Intel

O43 - CFD: 01/09/2012 - 19:32:42 - [0,000] ----D C:\ProgramData\IObit

O43 - CFD: 03/01/2012 - 11:36:56 - [0,037] ----D C:\ProgramData\lightcomm

O43 - CFD: 25/07/2011 - 09:49:56 - [0] ----D C:\ProgramData\McAfee

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Menu Iniciar

O43 - CFD: 06/03/2012 - 10:57:49 - [499,610] -S--D C:\ProgramData\Microsoft

O43 - CFD: 23/07/2011 - 13:46:33 - [0] --H-D C:\ProgramData\Modelos

O43 - CFD: 25/05/2012 - 15:22:32 - [0,000] ----D C:\ProgramData\Mozilla

O43 - CFD: 17/01/2012 - 08:24:03 - [0,014] ----D C:\ProgramData\NCH Swift Sound

O43 - CFD: 04/07/2011 - 17:23:18 - [4,715] ----D C:\ProgramData\Nero

O43 - CFD: 04/09/2012 - 21:38:48 - [1,929] ----D C:\ProgramData\NVIDIA

O43 - CFD: 23/07/2011 - 13:56:16 - [0,512] ----D C:\ProgramData\NVIDIA Corporation

O43 - CFD: 03/01/2012 - 11:36:56 - [0,075] ----D C:\ProgramData\OI

O43 - CFD: 22/07/2012 - 19:44:01 - [24,665] ----D C:\ProgramData\PSafe

O43 - CFD: 08/10/2011 - 12:00:12 - [0,002] ----D C:\ProgramData\regid.1986-12.com.adobe

O43 - CFD: 26/07/2012 - 15:59:48 - [50,058] ----D C:\ProgramData\Skype

O43 - CFD: 01/09/2012 - 19:32:41 - [0] ----D C:\ProgramData\Spyware Terminator

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Start Menu

O43 - CFD: 06/03/2012 - 22:58:56 - [0,000] ----D C:\ProgramData\Sun

O43 - CFD: 01/10/2011 - 00:39:16 - [0] ---AD C:\ProgramData\TEMP

O43 - CFD: 14/07/2009 - 01:53:55 - [0] --H-D C:\ProgramData\Templates

O43 - CFD: 18/11/2011 - 14:28:19 - [0] ----D C:\ProgramData\Web Installer

O43 - CFD: 17/03/2012 - 23:41:09 - [0] ----D C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

O43 - CFD: 08/10/2011 - 12:00:23 - [5,099] ----D C:\Users\Sergio\AppData\Roaming\Adobe

O43 - CFD: 20/08/2011 - 15:16:02 - [0,044] ----D C:\Users\Sergio\AppData\Roaming\Ahead

O43 - CFD: 31/01/2012 - 21:57:11 - [0,006] ----D C:\Users\Sergio\AppData\Roaming\Audacity

O43 - CFD: 05/04/2012 - 17:24:17 - [0,019] ----D C:\Users\Sergio\AppData\Roaming\Babylon

O43 - CFD: 17/02/2012 - 21:50:46 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\CasualForge

O43 - CFD: 23/07/2011 - 23:30:09 - [0,006] ----D C:\Users\Sergio\AppData\Roaming\CyberLink

O43 - CFD: 14/04/2012 - 12:21:29 - [0,055] ----D C:\Users\Sergio\AppData\Roaming\Gearbox Software

O43 - CFD: 18/11/2011 - 14:52:08 - [0] ----D C:\Users\Sergio\AppData\Roaming\GetRightToGo

O43 - CFD: 20/11/2010 - 17:57:14 - [0] ----D C:\Users\Sergio\AppData\Roaming\Identities

O43 - CFD: 30/06/2012 - 23:37:25 - [10,676] ----D C:\Users\Sergio\AppData\Roaming\IObit

O43 - CFD: 27/12/2011 - 19:44:37 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Leadertech

O43 - CFD: 27/07/2011 - 12:37:17 - [22,836] ----D C:\Users\Sergio\AppData\Roaming\LibreOffice

O43 - CFD: 20/02/2012 - 19:59:11 - [0] ----D C:\Users\Sergio\AppData\Roaming\LOKIBIT.COM

O43 - CFD: 23/07/2011 - 23:40:53 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Macromedia

O43 - CFD: 01/09/2012 - 20:09:34 - [0] ----D C:\Users\Sergio\AppData\Roaming\Media Player Classic

O43 - CFD: 16/03/2012 - 16:49:41 - [4,700] -S--D C:\Users\Sergio\AppData\Roaming\Microsoft

O43 - CFD: 14/04/2012 - 23:24:55 - [4,942] ----D C:\Users\Sergio\AppData\Roaming\Mozilla

O43 - CFD: 22/07/2012 - 23:27:34 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\OfficeRecovery

O43 - CFD: 05/05/2012 - 19:07:08 - [0] ----D C:\Users\Sergio\AppData\Roaming\Opera

O43 - CFD: 26/07/2012 - 00:37:52 - [0] ----D C:\Users\Sergio\AppData\Roaming\OxelonMC

O43 - CFD: 14/03/2012 - 22:41:41 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\pdfforge

O43 - CFD: 02/07/2012 - 15:34:59 - [0,040] ----D C:\Users\Sergio\AppData\Roaming\PhotoScape

O43 - CFD: 29/12/2011 - 11:58:06 - [0] ----D C:\Users\Sergio\AppData\Roaming\Real

O43 - CFD: 17/09/2011 - 21:47:10 - [0,014] ----D C:\Users\Sergio\AppData\Roaming\Rovio

O43 - CFD: 02/09/2012 - 15:47:56 - [16,124] ----D C:\Users\Sergio\AppData\Roaming\Skype

O43 - CFD: 09/10/2011 - 22:19:51 - [9,534] ----D C:\Users\Sergio\AppData\Roaming\Thinstall

O43 - CFD: 25/07/2011 - 00:50:16 - [0,426] ----D C:\Users\Sergio\AppData\Roaming\Thunderbird

O43 - CFD: 22/10/2011 - 19:54:19 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Unity

O43 - CFD: 20/07/2012 - 15:27:40 - [1,383] ----D C:\Users\Sergio\AppData\Roaming\uTorrent

O43 - CFD: 23/07/2011 - 23:09:35 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\WinRAR

O43 - CFD: 22/07/2012 - 23:15:20 - [0] ----D C:\Users\Sergio\AppData\Roaming\YourFileDownloader

O43 - CFD: 03/01/2012 - 12:15:13 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Youtube Downloader HD

O43 - CFD: 08/10/2011 - 12:00:30 - [14,826] ----D C:\Users\Sergio\AppData\Local\Adobe

O43 - CFD: 25/07/2011 - 19:36:02 - [1,860] ----D C:\Users\Sergio\AppData\Local\Ahead

O43 - CFD: 23/07/2012 - 00:02:56 - [2,736] ----D C:\Users\Sergio\AppData\Local\Apps

O43 - CFD: 23/07/2011 - 13:46:55 - [0] ----D C:\Users\Sergio\AppData\Local\Dados de aplicativos

O43 - CFD: 06/03/2012 - 12:31:09 - [0] ----D C:\Users\Sergio\AppData\Local\Deployment

O43 - CFD: 22/08/2012 - 21:20:40 - [6,359] ----D C:\Users\Sergio\AppData\Local\Diagnostics

O43 - CFD: 26/08/2012 - 17:57:15 - [0,673] ----D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics

O43 - CFD: 17/01/2012 - 10:19:35 - [0,059] ----D C:\Users\Sergio\AppData\Local\Facebook

O43 - CFD: 30/06/2012 - 17:56:21 - [1171,840] ----D C:\Users\Sergio\AppData\Local\Google

O43 - CFD: 23/07/2011 - 13:46:55 - [0] ----D C:\Users\Sergio\AppData\Local\Histórico

O43 - CFD: 05/07/2012 - 20:59:56 - [0] ----D C:\Users\Sergio\AppData\Local\Macromedia

O43 - CFD: 03/05/2012 - 21:25:14 - [551,285] ----D C:\Users\Sergio\AppData\Local\Microsoft

O43 - CFD: 18/12/2011 - 20:48:53 - [0,659] ----D C:\Users\Sergio\AppData\Local\Microsoft Games

O43 - CFD: 09/08/2012 - 19:17:00 - [30,769] ----D C:\Users\Sergio\AppData\Local\Mozilla

O43 - CFD: 05/05/2012 - 19:07:08 - [0] ----D C:\Users\Sergio\AppData\Local\Opera

O43 - CFD: 29/11/2011 - 21:57:33 - [0] ----D C:\Users\Sergio\AppData\Local\PackageAware

O43 - CFD: 04/09/2012 - 21:50:42 - [0,486] ----D C:\Users\Sergio\AppData\Local\Temp

O43 - CFD: 23/07/2011 - 13:46:55 - [0] ----D C:\Users\Sergio\AppData\Local\Temporary Internet Files

O43 - CFD: 09/10/2011 - 22:19:50 - [0,044] ----D C:\Users\Sergio\AppData\Local\Thinstall

O43 - CFD: 16/03/2012 - 17:11:28 - [3,679] ----D C:\Users\Sergio\AppData\Local\Thunderbird

O43 - CFD: 01/09/2012 - 19:32:32 - [0,200] ----D C:\Users\Sergio\AppData\Local\Unity

O43 - CFD: 09/10/2011 - 22:20:02 - [-709,687] ----D C:\Users\Sergio\AppData\Local\VirtualStore

O43 - CFD: 05/08/2012 - 09:18:23 - [0,117] ----D C:\Users\Sergio\AppData\Local\Windows Live

O43 - CFD: 30/11/2011 - 13:45:07 - [0] ----D C:\Users\Sergio\AppData\Local\{039D0BA5-ABA5-46E4-B73C-19DE7BED255C}

O43 - CFD: 25/08/2012 - 23:16:21 - [0] ----D C:\Users\Sergio\AppData\Local\{05183429-84D0-4AE0-AA22-C2753DA38AB7}

O43 - CFD: 18/09/2011 - 15:10:49 - [0] ----D C:\Users\Sergio\AppData\Local\{07C6C355-B004-4E8B-ADE4-CE45722B6442}

O43 - CFD: 20/02/2012 - 17:09:37 - [0] ----D C:\Users\Sergio\AppData\Local\{0B57888D-BE6B-4C35-8BE8-DDD00EEE04C8}

O43 - CFD: 09/01/2012 - 16:54:38 - [0] ----D C:\Users\Sergio\AppData\Local\{0CDD589F-1CA7-4C6F-A6A7-2A6B2F8B20CC}

O43 - CFD: 09/07/2012 - 12:25:38 - [0] ----D C:\Users\Sergio\AppData\Local\{1270DC32-F3B3-444D-8B36-7003A49F14B1}

O43 - CFD: 05/01/2012 - 14:13:47 - [0] ----D C:\Users\Sergio\AppData\Local\{127D9365-2CE0-4852-995F-35286E80DB40}

O43 - CFD: 26/11/2011 - 17:21:30 - [0] ----D C:\Users\Sergio\AppData\Local\{15FB640D-F9C4-4BB8-B65E-3A31D4995AC7}

O43 - CFD: 03/05/2012 - 20:51:04 - [0] ----D C:\Users\Sergio\AppData\Local\{16C2FCAC-ED4B-40E8-9334-7F131C4AE6AB}

O43 - CFD: 08/07/2012 - 23:25:13 - [0] ----D C:\Users\Sergio\AppData\Local\{1BB361C0-6563-488A-B046-1769224B3E50}

O43 - CFD: 19/02/2012 - 20:10:29 - [0] ----D C:\Users\Sergio\AppData\Local\{213EEA16-B131-48E4-96C1-1729A4D90A47}

O43 - CFD: 29/10/2011 - 15:33:06 - [0] ----D C:\Users\Sergio\AppData\Local\{2146CE28-2336-4D4D-BCF2-66B382C57CA9}

O43 - CFD: 08/07/2012 - 23:53:00 - [0] ----D C:\Users\Sergio\AppData\Local\{2299D8B1-CDAD-4AC7-9126-71E4AD124F3A}

O43 - CFD: 09/07/2012 - 16:31:35 - [0] ----D C:\Users\Sergio\AppData\Local\{24A80BE5-D6FC-4B09-8299-DA8CD7A86541}

O43 - CFD: 08/01/2012 - 18:20:22 - [0] ----D C:\Users\Sergio\AppData\Local\{26762A23-6D96-47F3-8754-67F227C00DD0}

O43 - CFD: 20/02/2012 - 17:09:48 - [0] ----D C:\Users\Sergio\AppData\Local\{28732B64-08A5-4F09-A30C-BAAF42BE2B14}

O43 - CFD: 08/07/2012 - 01:37:14 - [0] ----D C:\Users\Sergio\AppData\Local\{2AD0ADC1-D881-4915-830D-7215A9A65B74}

O43 - CFD: 09/07/2012 - 13:55:25 - [0] ----D C:\Users\Sergio\AppData\Local\{2B641219-4FF0-4BB0-9417-950F15A8AA5F}

O43 - CFD: 09/07/2012 - 17:37:10 - [0] ----D C:\Users\Sergio\AppData\Local\{2CB60180-5906-4A2B-8987-0C7E3AD4662B}

O43 - CFD: 04/01/2012 - 17:09:26 - [0] ----D C:\Users\Sergio\AppData\Local\{2D88F5AD-5D2A-48E9-924F-2A43D202FD6C}

O43 - CFD: 05/01/2012 - 14:14:01 - [0] ----D C:\Users\Sergio\AppData\Local\{2F70A373-5D2C-462F-B2A3-62A1AD0D50DB}

O43 - CFD: 04/01/2012 - 17:09:38 - [0] ----D C:\Users\Sergio\AppData\Local\{3358D823-3B31-47A4-B7AB-EB998D21652A}

O43 - CFD: 08/07/2012 - 12:06:30 - [0] ----D C:\Users\Sergio\AppData\Local\{36455D7A-E8B8-4EBB-B0CA-DB623BBBC02A}

O43 - CFD: 22/02/2012 - 17:09:50 - [0] ----D C:\Users\Sergio\AppData\Local\{3FFF8A68-0128-4F3C-980E-64CB5509FE1A}

O43 - CFD: 07/07/2012 - 21:43:27 - [0] ----D C:\Users\Sergio\AppData\Local\{4492098C-E21D-49DC-9F47-9D4CFB4DD169}

O43 - CFD: 09/01/2012 - 16:54:24 - [0] ----D C:\Users\Sergio\AppData\Local\{46FB93A6-510B-484F-85BA-6F21B029E768}

O43 - CFD: 17/05/2012 - 22:01:35 - [0] ----D C:\Users\Sergio\AppData\Local\{4B53F910-C7A8-4453-B062-0AE645DD0354}

O43 - CFD: 22/07/2012 - 13:25:45 - [0] ----D C:\Users\Sergio\AppData\Local\{4BCE74EA-62F7-4ABE-B2A1-70CC7D3853D0}

O43 - CFD: 09/07/2012 - 20:12:12 - [0] ----D C:\Users\Sergio\AppData\Local\{4E7593FD-5863-4DFA-B136-1870636A3A3A}

O43 - CFD: 08/07/2012 - 22:06:59 - [0] ----D C:\Users\Sergio\AppData\Local\{500C9843-1296-4205-86B1-A9365D057CD6}

O43 - CFD: 08/07/2012 - 19:09:33 - [0] ----D C:\Users\Sergio\AppData\Local\{5285DF8F-14D4-49A8-A630-9D7387F1CC9E}

O43 - CFD: 08/07/2012 - 15:15:45 - [0] ----D C:\Users\Sergio\AppData\Local\{53F2B422-5241-43F4-A067-E8C47AB75A3B}

O43 - CFD: 09/07/2012 - 00:41:09 - [0] ----D C:\Users\Sergio\AppData\Local\{547D8FD6-4B41-4BB1-B6FB-8EAA8B71019F}

O43 - CFD: 17/05/2012 - 22:00:18 - [0] ----D C:\Users\Sergio\AppData\Local\{59288D89-A5E4-4845-AB1E-ADE2A42DA8D4}

O43 - CFD: 29/10/2011 - 17:27:51 - [0] ----D C:\Users\Sergio\AppData\Local\{5AF0BC5C-765F-41C4-AA5E-9FF1FDC6DD24}

O43 - CFD: 29/10/2011 - 17:41:46 - [0] ----D C:\Users\Sergio\AppData\Local\{6163B633-BDA1-4B27-8EAF-C4B9FE4CB7B3}

O43 - CFD: 03/05/2012 - 21:25:26 - [0] ----D C:\Users\Sergio\AppData\Local\{66F22B59-C1D7-456E-8672-3F8876FA9C79}

O43 - CFD: 07/07/2012 - 20:04:37 - [0] ----D C:\Users\Sergio\AppData\Local\{674AAA9F-4520-4279-86DA-95635F8B83B9}

O43 - CFD: 09/10/2011 - 13:58:15 - [0] ----D C:\Users\Sergio\AppData\Local\{6DEEF961-B207-4786-AC4F-EBFB5D11212A}

O43 - CFD: 09/07/2012 - 20:07:58 - [0] ----D C:\Users\Sergio\AppData\Local\{7259C14E-91E0-4D24-9493-D29CAA294D35}

O43 - CFD: 18/02/2012 - 22:49:55 - [0] ----D C:\Users\Sergio\AppData\Local\{72D03B99-8C8D-4A70-8B29-5F7513DFD897}

O43 - CFD: 25/11/2011 - 22:00:29 - [0] ----D C:\Users\Sergio\AppData\Local\{75AA2603-7E7A-4D56-97DD-789A3EF5CDC2}

O43 - CFD: 03/05/2012 - 21:25:57 - [0] ----D C:\Users\Sergio\AppData\Local\{78125CA9-6B3A-47D4-AE5D-7F7E6FED49DE}

O43 - CFD: 05/08/2012 - 09:18:22 - [0] ----D C:\Users\Sergio\AppData\Local\{78605791-0E62-4DC4-95A9-6B16D8DEB7E2}

O43 - CFD: 07/07/2012 - 21:44:10 - [0] ----D C:\Users\Sergio\AppData\Local\{78C6040C-1C58-4047-8CE5-D2E635EEE40D}

O43 - CFD: 13/08/2011 - 23:13:13 - [0] ----D C:\Users\Sergio\AppData\Local\{7B8DE4B5-82C2-4733-890E-6154DD1F2736}

O43 - CFD: 07/07/2012 - 23:29:21 - [0] ----D C:\Users\Sergio\AppData\Local\{83BA6102-7488-4E68-9968-356726884715}

O43 - CFD: 18/02/2012 - 22:49:43 - [0] ----D C:\Users\Sergio\AppData\Local\{8A17AE58-D70C-4232-8391-115AAD702D86}

O43 - CFD: 09/07/2012 - 20:07:48 - [0] ----D C:\Users\Sergio\AppData\Local\{8BF2737B-D2A8-4C13-ADBF-C6FCA27EC428}

O43 - CFD: 07/07/2012 - 22:12:43 - [0] ----D C:\Users\Sergio\AppData\Local\{909EAEBF-A2AF-48A4-B715-B58AEA8C894B}

O43 - CFD: 09/07/2012 - 12:50:23 - [0] ----D C:\Users\Sergio\AppData\Local\{91F2689B-B42F-4BD5-B170-271879E1F014}

O43 - CFD: 15/01/2012 - 19:31:43 - [0] ----D C:\Users\Sergio\AppData\Local\{96855890-C4B7-4EBE-B603-3B37F07E4BEA}

O43 - CFD: 08/07/2012 - 18:46:53 - [0] ----D C:\Users\Sergio\AppData\Local\{A0D26DF9-19B5-4442-81CD-891A55AF6B0D}

O43 - CFD: 07/07/2012 - 20:56:40 - [0] ----D C:\Users\Sergio\AppData\Local\{A1B7E284-5D35-43D5-A354-873BBB895DCF}

O43 - CFD: 04/01/2012 - 17:01:45 - [0] ----D C:\Users\Sergio\AppData\Local\{A8D40B58-3646-4E0B-B028-9973F6ACBF30}

O43 - CFD: 07/07/2012 - 23:29:22 - [0] ----D C:\Users\Sergio\AppData\Local\{AB943710-890F-4CAC-94F6-3926A3FA1CB6}

O43 - CFD: 03/05/2012 - 21:10:18 - [0] ----D C:\Users\Sergio\AppData\Local\{AF646883-B41E-432B-9704-17A4A7D06CC8}

O43 - CFD: 28/10/2011 - 17:59:56 - [0] ----D C:\Users\Sergio\AppData\Local\{B1C64905-E1A2-48B4-804F-B85D330C6263}

O43 - CFD: 08/07/2012 - 22:07:10 - [0] ----D C:\Users\Sergio\AppData\Local\{B1E24C8C-B9D3-495C-B719-62FB9E0BB218}

O43 - CFD: 09/07/2012 - 17:48:55 - [0] ----D C:\Users\Sergio\AppData\Local\{B22A97C0-8C6C-4DBF-9BE7-6A642D3B163C}

O43 - CFD: 27/08/2011 - 22:22:54 - [0] ----D C:\Users\Sergio\AppData\Local\{B2E1A061-1EB1-4DA2-B793-BBDD6B105F29}

O43 - CFD: 08/07/2012 - 12:37:41 - [0] ----D C:\Users\Sergio\AppData\Local\{B51C94E5-8364-4DC2-9A5C-8B8063542449}

O43 - CFD: 05/08/2012 - 09:18:10 - [0] ----D C:\Users\Sergio\AppData\Local\{B5C7E014-7F47-4BF8-B42E-51209BE9B955}

O43 - CFD: 08/07/2012 - 19:09:44 - [0] ----D C:\Users\Sergio\AppData\Local\{B7202785-3D17-45DD-83E5-C718648B7828}

O43 - CFD: 06/05/2012 - 21:31:28 - [0] ----D C:\Users\Sergio\AppData\Local\{B7D4A5A7-01F9-4983-A655-FA75A8AFCB85}

O43 - CFD: 02/01/2012 - 16:18:22 - [0] ----D C:\Users\Sergio\AppData\Local\{BE336543-A7E0-4BDD-BC9E-D722CF498427}

O43 - CFD: 02/09/2011 - 19:17:57 - [0] ----D C:\Users\Sergio\AppData\Local\{C69E3F4D-8E16-4CFC-9C41-CA19F1AE6000}

O43 - CFD: 17/01/2012 - 19:16:48 - [0] ----D C:\Users\Sergio\AppData\Local\{D11EDE27-15E8-4176-9852-AB196AFAC69D}

O43 - CFD: 09/07/2012 - 16:18:31 - [0] ----D C:\Users\Sergio\AppData\Local\{D8D8064F-7E6B-4E53-9A7C-EDF9581A8007}

O43 - CFD: 07/01/2012 - 19:50:02 - [0] ----D C:\Users\Sergio\AppData\Local\{D92C39C5-0F43-4E3B-96DB-5D510994C293}

O43 - CFD: 09/07/2012 - 18:34:16 - [0] ----D C:\Users\Sergio\AppData\Local\{E0D6FC06-2410-4925-883C-F7115639F64C}

O43 - CFD: 19/02/2012 - 20:10:40 - [0] ----D C:\Users\Sergio\AppData\Local\{E148BDC1-9639-4EE1-845D-64E89C765103}

O43 - CFD: 12/11/2011 - 13:51:15 - [0] ----D C:\Users\Sergio\AppData\Local\{E176ED12-A83B-4906-8CD0-E29A281BC115}

O43 - CFD: 22/07/2012 - 13:25:56 - [0] ----D C:\Users\Sergio\AppData\Local\{E53DFA98-37C7-4C84-87CA-B66E9B71029E}

O43 - CFD: 09/07/2012 - 17:37:22 - [0] ----D C:\Users\Sergio\AppData\Local\{E65813FE-5D8B-42FF-840E-7E3F3111CE88}

O43 - CFD: 09/07/2012 - 13:27:29 - [0] ----D C:\Users\Sergio\AppData\Local\{E86E685F-3EFA-4C2B-B5D6-B4876A13B7B1}

O43 - CFD: 09/07/2012 - 20:11:59 - [0] ----D C:\Users\Sergio\AppData\Local\{E9A31BAD-61EF-4169-A724-623EF834C0D0}

O43 - CFD: 07/01/2012 - 19:49:50 - [0] ----D C:\Users\Sergio\AppData\Local\{EE1300EC-5AA2-4898-B25C-945F781FF840}

O43 - CFD: 22/02/2012 - 17:10:02 - [0] ----D C:\Users\Sergio\AppData\Local\{F6AFAAF6-BF05-46FF-A02E-E02BFBB52B05}

O43 - CFD: 08/01/2012 - 18:20:34 - [0] ----D C:\Users\Sergio\AppData\Local\{F92ADEAD-4FF0-4B5E-9115-606C3AC6FEE2}

O43 - CFD: 15/01/2012 - 19:31:55 - [0] ----D C:\Users\Sergio\AppData\Local\{FC1B2AE9-ECBA-4FCC-9D36-CB0155E26BBF}

O43 - CFD: 14/07/2009 - 01:42:04 - [0,014] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

O43 - CFD: 18/07/2012 - 23:48:39 - [0,000] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

O43 - CFD: 23/07/2012 - 04:09:56 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar

O43 - CFD: 31/01/2012 - 21:57:11 - [0,006] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite

O43 - CFD: 26/07/2012 - 00:21:29 - [0,004] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory

O43 - CFD: 14/04/2012 - 14:57:10 - [0,000] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

O43 - CFD: 19/03/2012 - 16:54:16 - [0] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

O43 - CFD: 14/07/2009 - 01:37:42 - [0,001] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

O43 - CFD: 16/03/2012 - 18:47:02 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2012

O43 - CFD: 12/11/2011 - 19:27:48 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\project64 1.6

O43 - CFD: 18/07/2012 - 23:48:39 - [0,000] R---D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

O43 - CFD: 23/07/2011 - 23:03:31 - [0,003] ----D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

~ Scan Program Folder in 00mn 11s

 

 

 

---\\ Last modified or created files under Windows and System32 (O44)

O44 - LFC:[MD5.FAC8C0E5DAD4ADF75658182AD7B6CDD9] - 04/09/2012 - 21:51:20 ---A- . (...) -- C:\Windows\WindowsUpdate.log [118792]

O44 - LFC:[MD5.AC849B99E032F4017BB1CE37934DD4AF] - 04/09/2012 - 21:38:34 ---A- . (...) -- C:\Windows\setupact.log [112]

O44 - LFC:[MD5.B6A80BD315A80460E303B5F876925C30] - 04/09/2012 - 21:38:33 -S-A- . (...) -- C:\Windows\bootstat.dat [67584]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 04/09/2012 - 21:24:03 ---A- . (...) -- C:\Windows\setuperr.log [0]

O44 - LFC:[MD5.AAC5824B728CA34BC3E41515649C605A] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI [5224]

O44 - LFC:[MD5.C430C5953026E71EF3A9A4681E6E4D3C] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\perfc009.dat [2655162]

O44 - LFC:[MD5.AFDC5E580D7CC3B1658A753F79CDDD0E] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\perfh009.dat [3284974]

O44 - LFC:[MD5.A0976433759206F13C81B66F4602281F] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [2676868]

O44 - LFC:[MD5.AA2BC5F2E17F4A503336D402BFA8E37E] - 03/09/2012 - 19:57:19 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [3332770]

O44 - LFC:[MD5.9A5E23F24682E57F10F3F233EBF45BB2] - 03/09/2012 - 19:18:25 ----- . (...) -- C:\bootsqm.dat [3288]

O44 - LFC:[MD5.4B3426BE091633F0903EC2B1BCD27EA9] - 31/08/2012 - 20:39:28 ---A- . (...) -- C:\hpfr3420.log [137553]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 31/08/2012 - 20:39:27 ---A- . (...) -- C:\hpfr3420.xml [0]

O44 - LFC:[MD5.26E7593A3745BCFFAFDBB4481A16EF82] - 01/09/2012 - 20:04:43 ---A- . (.Macromedia, Inc. - Macromedia Flash Player 6.0 r23.) -- C:\flash.exe [819301]

O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 01/09/2012 - 19:38:46 ---A- . (...) -- C:\Windows\System32\config.nt [2577]

O44 - LFC:[MD5.DFE9152ABFA89BB8CFDC057409B2D4DA] - 21/08/2012 - 06:13:15 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\Windows\System32\Drivers\aswTdi.sys [54232]

O44 - LFC:[MD5.30E45AF8B4D83176CA850FC9699E860B] - 21/08/2012 - 06:13:15 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\Windows\System32\Drivers\aswSnx.sys [729752]

O44 - LFC:[MD5.F04BDBCB965C05C51F4A7DE7B62063D6] - 21/08/2012 - 06:13:15 ---A- . (.AVAST Software - avast! self protection module.) -- C:\Windows\System32\Drivers\aswSP.sys [355632]

O44 - LFC:[MD5.F76E51561562AC4105DBBE53FC99BC10] - 21/08/2012 - 06:13:14 ---A- . (.AVAST Software - avast! File System Minifilter for Windows 2.) -- C:\Windows\System32\Drivers\aswMonFlt.sys [58680]

O44 - LFC:[MD5.924819669AFD0EDF5C067193D371FAB0] - 21/08/2012 - 06:13:14 ---A- . (.AVAST Software - avast! WFP Redirect Driver.) -- C:\Windows\System32\Drivers\aswRdr2.sys [44784]

O44 - LFC:[MD5.F5DC168BF77572D51BE28BA261B30CB4] - 21/08/2012 - 06:13:13 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\Windows\System32\Drivers\aswFsBlk.sys [21256]

O44 - LFC:[MD5.B6A0320DFEFE916346CB900938661DAD] - 21/08/2012 - 06:12:33 ---A- . (.AVAST Software - avast! Screen Saver stub.) -- C:\Windows\avastSS.scr [41224]

O44 - LFC:[MD5.CCB414FEE0E81E1B7F64AEEA63BC2649] - 21/08/2012 - 06:12:23 ---A- . (.AVAST Software - avast! start-up scanner.) -- C:\Windows\System32\aswBoot.exe [227648]

O44 - LFC:[MD5.818D091A1F48400062F33AEB194949C4] - 18/08/2012 - 16:02:50 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\Windows\System32\FlashPlayerApp.exe [426184]

O44 - LFC:[MD5.4154A3678BCF729F6C6AB2297A92F939] - 18/08/2012 - 16:02:50 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [70344]

O44 - LFC:[MD5.CE2C07A332325EA2C887A52055445A1E] - 18/08/2012 - 15:52:34 ---A- . (...) -- C:\Windows\System32\FNTCACHE.DAT [289848]

O44 - LFC:[MD5.7B426B8E809EDF081D771EF429345528] - 21/06/2011 - 11:24:06 ---A- . (...) -- C:\Windows\System32\Drivers\sp_rsdrv2.sys [32768]

~ Scan Files in 00mn 07s

 

 

 

---\\ Local Security Authority-LSA Deny (O48)

O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll

O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Mecanismo cliente do 'Editor de configuração de segurança Windows'.) -- C:\Windows\System32\scecli.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Pacote de Segurança Kerberos.) -- C:\Windows\System32\kerberos.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\Windows\System32\schannel.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Digest Access.) -- C:\Windows\System32\wdigest.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Web Service Security Package.) -- C:\Windows\System32\tspkg.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Pku2u Security Package.) -- C:\Windows\System32\pku2u.dll

O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corp. - LiveSSP.) -- C:\Windows\System32\livessp.dll

~ Scan Keys in 00mn 00s

 

 

 

---\\ Safe Boot Control (O49)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\Windows\System32\Drivers\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\Windows\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\Windows\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\Windows\System32\Drivers\volmgr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\Windows\System32\Drivers\volmgrx.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\Windows\System32\Drivers\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\nsiproxy.sys . (.Microsoft Corporation - NSI Proxy.) -- C:\Windows\System32\Drivers\nsiproxy.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpencdd.sys . (.Microsoft Corporation - RDP Encoder Miniport.) -- C:\Windows\System32\Drivers\rdpencdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\Windows\System32\Drivers\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\Windows\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\Windows\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\Windows\System32\Drivers\volmgr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\Windows\System32\Drivers\volmgrx.sys

~ Scan CSB in 00mn 00s

 

 

 

---\\ MountPoints2 Shell Key (MPKS) (O51)

O51 - MPSK:{1b84cd26-3596-11e1-95c1-1078d2b3eade}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)

O51 - MPSK:{5ac63608-366d-11e1-8424-1078d2b3eade}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)

~ Scan Keys in 00mn 00s

 

 

 

---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52)

O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\Windows\System32\iccvid.dll

O52 - TDSD: \Drivers32\"vidc.VP60"="C:\Windows\system32\vp6vfw.dll" . (.On2.com - VP6 VIDEO FOR WINDOWS CODEC.) -- C:\Windows\system32\vp6vfw.dll

O52 - TDSD: \Drivers32\"vidc.VP61"="C:\Windows\system32\vp6vfw.dll" . (.On2.com - VP6 VIDEO FOR WINDOWS CODEC.) -- C:\Windows\system32\vp6vfw.dll

O52 - TDSD: \Drivers32\"VIDC.DIVX"="divx.dll" . (.DivX, Inc. - DivX.) -- C:\Windows\System32\divx.dll

O52 - TDSD: \Drivers32\"VIDC.XVID"="xvidvfw.dll" . (...) -- C:\Windows\System32\xvidvfw.dll

O52 - TDSD: \Drivers32\"VIDC.YV12"="yv12vfw.dll" . (.www.helixcommunity.org - Helix YV12 YUV Codec.) -- C:\Windows\System32\yv12vfw.dll

O52 - TDSD: \Drivers32\"msacm.ac3acm"="ac3acm.acm" . (.fccHandler - AC-3 ACM Codec.) -- C:\Windows\System32\ac3acm.acm

O52 - TDSD: \Drivers32\"msacm.lameacm"="lameACM.acm" . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\Windows\System32\lameACM.acm

O52 - TDSD: \Drivers32\"VIDC.FFDS"="ff_vfw.dll" . (...) -- C:\Windows\System32\ff_vfw.dll

O52 - TDSD: \Drivers32\"VIDC.FMVC"="fmcodec.dll" . (.Fox Magic Software - FM Screen Capture Codec (VFW).) -- C:\Windows\System32\fmcodec.dll

O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

O52 - TDSD: \drivers.desc\"vp6vfw.dll"="EA VP6 Codec" . (.On2.com - VP6 VIDEO FOR WINDOWS CODEC.) -- C:\Windows\System32\vp6vfw.dll

O52 - TDSD: \drivers.desc\"ac3acm.acm"="AC-3 ACM Codec" . (.fccHandler - AC-3 ACM Codec.) -- C:\Windows\System32\ac3acm.acm

O52 - TDSD: \drivers.desc\"ff_vfw.dll"="ffdshow video encoder" . (...) -- C:\Windows\System32\ff_vfw.dll

~ Scan Keys in 00mn 00s

 

 

 

---\\ ShareTools MSconfig StartupReg (SMSR) (O53)

O53 - SMSR:HKLM\...\startupreg\PAC7302_Monitor [Key] . (.PixArt Imaging Incorporation - Registry Monitor.) -- c:\windows\pixart\pac7302\monitor.exe

O53 - SMSR:HKLM\...\startupreg\SweetIM [Key] . (...) -- c:\program files\sweetim\messenger\sweetim.exe (.not file.)

O53 - SMSR:HKLM\...\startupreg\Sweetpacks Communicator [Key] . (.SweetIM Technologies Ltd. - Update Manager for SweetPacks.) -- c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe

~ Scan SMSR Keys in 00mn 00s

 

 

 

---\\ Microsoft Control Security Providers (MCSP) (O54)

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\System32\credssp.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\System32\credssp.dll

~ Scan Keys in 00mn 00s

 

 

 

---\\ Microsoft Windows Policies System (MWPS) (O55)

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3

O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0

O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1

O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1

O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0

O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0

O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0

O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0

~ Scan Keys in 00mn 00s

 

 

 

---\\ Microsoft Windows Policies Explorer (MWPE) (O56)

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=145

~ Scan Keys in 00mn 00s

 

 

 

---\\ System Drivers List (SDL) (O58)

O58 - SDL:[MD5.21E785EBD7DC90A06391141AAC7892FB] - 13/07/2009 - 22:26:15 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422976]

O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 18:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]

~ Scan Drivers in 00mn 00s

 

 

 

---\\ List all tools cleaner (LATC) (O63)

O63 - Logiciel: ZHPDiag 1.31 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1

~ Scan ADS in 00mn 00s

 

 

 

---\\ List all legacy services(LALS) (O64)

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswFsBlk.sys (aswFsBlk) .(.AVAST Software - avast! File System Access Blocking Driver.) - LEGACY_ASWFSBLK

O64 - Services: CurCS - 21/08/2012 - C:\Windows\system32\drivers\aswMonFlt.sys (aswMonFlt) .(.AVAST Software - avast! File System Minifilter for Windows 2.) - LEGACY_ASWMONFLT

O64 - Services: CurCS - 21/08/2012 - C:\Windows\system32\Drivers\aswrdr2.sys (aswRdr) .(.AVAST Software - avast! WFP Redirect Driver.) - LEGACY_ASWRDR

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswSnx.sys (aswSnx) .(.AVAST Software - avast! Virtualization Driver.) - LEGACY_ASWSNX

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswSP.sys (aswSP) .(.AVAST Software - avast! self protection module.) - LEGACY_ASWSP

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\aswTdi.sys (aswTdi) .(.AVAST Software - avast! TDI Filter Driver.) - LEGACY_ASWTDI

O64 - Services: CurCS - 05/01/2012 - C:\Program Files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys (FileMonitor) .(.IObit - IMF File MiniFilter Driver.) - LEGACY_FILEMONITOR

O64 - Services: CurCS - 05/07/2012 - C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys (RegFilter) .(.IObit.com - Registry Filter.) - LEGACY_REGFILTER

O64 - Services: CurCS - ??\??\???? - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV

O64 - Services: CurCS - 05/07/2012 - C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys (UrlFilter) .(.IObit.com - URL Filter.) - LEGACY_URLFILTER

~ Scan Services in 00mn 00s

 

 

 

---\\ File Associations Shell Spawning (O67)

O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe

O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Iniciador do snap-in de 'Visualizar eventos'.) -- C:\Windows\System32\eventvwr.exe

O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe

O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Editor do Registro.) -- C:\Windows\regedit.exe

O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe

O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.evt> <evtfile>[HKCR\..\open\Command] (.Microsoft Corporation - Iniciador do snap-in de 'Visualizar eventos'.) -- C:\Windows\System32\eventvwr.exe

O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <ChromeHTML>[HKCR\..\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Editor do Registro.) -- C:\Windows\regedit.exe

~ Scan Keys in 00mn 00s

 

 

 

---\\ Start Menu Internet (SMI) (O68)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe

O68 - StartMenuInternet: <Opera> <Opera>[HKLM\..\Shell\open\Command] (.Not Key.)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe (.not file.)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe (.not file.)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe (.not file.)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Users\Sergio\AppData\Local\Google\Chrome\Application\chrome.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Windows\System32\ie4uinit.exe (.not file.)

~ Scan Keys in 00mn 00s

 

 

 

---\\ Search Browser Infection (SBI) (O69)

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.newtab.url", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf0000000000000000000'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf0000000000000000000[...]

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.search.order.1", "Search the web (Babylon)");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.admin", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.aflt", "babsst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.babExt", "");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=2912_4");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.bbDpng", 24);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.dfltSrch", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.hmpg", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.id", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.instlDay", "15544");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.instlRef", "sst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.lastDP", 24);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.newTab", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.newTabUrl", "http://search.babylon.com/?babsrc=NT_bb"'>http://search.babylon.com/?babsrc=NT_bb");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.noFFXTlbr", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.propectorlck", 81662174);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prtkDS", 1);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.ptch_0717", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.smplGrp", "none");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.srcExt", "ss");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.tlbrId", "base");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.babExt", "");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=2912_4");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.hardId", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.id", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.instlDay", "15544");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.newTab", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf[...]

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("keyword.URL", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=KW_ss&mntrId=14e5addf000000000000000000000000&q'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=KW_ss&mntrId=14e5addf000000000000000000000000&q[...]

O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} [DefaultScope] - (Search the web (Babylon)) - http://search.babylon.com

O69 - SBI: SearchScopes [HKCU] {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} - (Search The Web) - http://www.google.com

O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Goo) - http://www.google.com

O69 - SBI: SearchScopes [HKCU] {96F94A0A-0F78-4839-98BF-54F4C08F6734} - (Google) - http://www.google.com

~ Scan Keys in 00mn 00s

 

 

 

---\\ Search Svchost Services (SSS) (O83)

O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Serviço de Experiência com Aplicativo.) -- C:\Windows\System32\aelupsvc.dll [62464]

O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\Windows\System32\certprop.dll [67584]

O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\Windows\System32\certprop.dll [67584]

O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - DLL de Serviço do Servidor.) -- C:\Windows\System32\srvsvc.dll [168960]

O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Cliente da Diretiva de Grupo.) -- C:\Windows\System32\gpsvc.dll [593408]

O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - Extensão IKE.) -- C:\Windows\System32\ikeext.dll [674304]

O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Serviço de Áudio do Windows.) -- C:\Windows\System32\Audiosrv.dll [473600]

O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Gerenciador de Discagem Automática de Acesso Remoto.) -- C:\Windows\System32\rasauto.dll [90624]

O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Gerenciador de conexão de acesso remoto.) -- C:\Windows\System32\rasmans.dll [286208]

O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Gerenciador de Interface Dinâmica.) -- C:\Windows\System32\mprdim.dll [75264]

O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - Serviço de Notificação de Eventos do Sistema (SENS).) -- C:\Windows\System32\sens.dll [49664]

O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Componentes do Microsoft NAT Helper.) -- C:\Windows\System32\ipnathlp.dll [300544]

O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Servidor de telefonia do Microsoft® Windows.) -- C:\Windows\System32\tapisrv.dll [242176]

O83 - Search Svchost Services: TermService (TermService) . (.Microsoft Corporation - Gerenciador de Conexões Remotas do Servidor Host da Sessão da Área de.) -- C:\Windows\System32\termsrv.dll [521216]

O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\System32\wuaueng.dll [1933848]

O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Serviço de transferência inteligente de plano de fundo.) -- C:\Windows\System32\qmgr.dll [585728]

O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - DLL de serviços do Shell do Windows.) -- C:\Windows\System32\shsvcs.dll [328192]

O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Serviço que oferece conectividade IPv6 em uma rede IPv4..) -- C:\Windows\System32\iphlpsvc.dll [499712]

O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - DLL de serviço de logon secundário.) -- C:\Windows\system32\seclogon.dll [21504]

O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Serviço de Informações de Aplicativos.) -- C:\Windows\System32\appinfo.dll [47104]

O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - Serviço de Descoberta iSCSI.) -- C:\Windows\System32\iscsiexe.dll [114688]

O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Serviço Agendador de Classes de Multimídia.) -- C:\Windows\System32\mmcss.dll [49664]

O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Relatórios de Problemas e Soluções.) -- C:\Windows\System32\wercplsupport.dll [61440]

O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Serviço Microsoft EAPHost.) -- C:\Windows\System32\eapsvc.dll [98304]

O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\System32\profsvc.dll [164352]

O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Serviço Agendador de Tarefas.) -- C:\Windows\System32\schedsvc.dll [750592]

O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Serviço de Gerenciamento de Chaves.) -- C:\Windows\System32\kmsvc.dll [71168]

O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Serviço de Configuração da Área de Trabalho Remota.) -- C:\Windows\System32\sessenv.dll [113664]

O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\System32\wbem\WMIsvc.dll [168960]

O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - DLL de Serviço Pesquisador de Computadores.) -- C:\Windows\System32\browser.dll [102912]

O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - DLL do Serviço de Tema do Shell do Windows.) -- C:\Windows\System32\themeservice.dll [37376]

O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - Serviço BDE.) -- C:\Windows\System32\bdesvc.dll [76800]

~ Scan Services in 00mn 00s

 

 

 

---\\ Search Particular Root Folder (SPRF) (O84)

[MD5.6D9E5361414A404F62DC249F2AADC327] [sPRF][31/01/2008] (.Unknown owner - 7-zip32.) -- C:\Users\Sergio\AppData\Local\Temp\7-zip32.dll [506880]

[MD5.4668C9C20FA1EA6D22D1ADE71CF89165] [sPRF][04/09/2012] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\Sergio\Desktop\ZHPDiag2.exe [3544694]

~ Scan Files in 00mn 00s

 

 

 

---\\ Firewall Active Exception List (FirewallRules) (O87)

O87 - FAEL: "{2632C74A-804A-49D4-88B9-07E7D29DB442}" | In - None - P6 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe

O87 - FAEL: "TCP Query User{834D63C8-866F-4417-8D2E-74CA55D718E7}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe" | In - Public - P6 - TRUE | .(.Google Inc..) -- C:\users\sergio\appdata\local\google\chrome\application\chrome.exe

O87 - FAEL: "UDP Query User{59D563AC-EEF8-4137-80EB-ECE659CA0A73}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe" | In - Public - P17 - TRUE | .(.Google Inc..) -- C:\users\sergio\appdata\local\google\chrome\application\chrome.exe

O87 - FAEL: "TCP Query User{C211A00F-4024-4C8F-9FF1-AE20B79A4840}C:\program files\ea sports\fifa 11\game\fifa.exe" | In - Public - P6 - TRUE | .(.Electronic Arts - FIFA 11.) -- C:\program files\ea sports\fifa 11\game\fifa.exe

O87 - FAEL: "UDP Query User{1FEBB3C7-DEB2-4AFE-BF14-F8E2E17CF9BA}C:\program files\ea sports\fifa 11\game\fifa.exe" | In - Public - P17 - TRUE | .(.Electronic Arts - FIFA 11.) -- C:\program files\ea sports\fifa 11\game\fifa.exe

O87 - FAEL: "TCP Query User{9B833D61-0C19-4B09-88CD-1019E9962B80}C:\program files\java\jre6\bin\javaw.exe" | In - Public - P6 - TRUE | .(.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\program files\java\jre6\bin\javaw.exe

O87 - FAEL: "UDP Query User{A030C684-D2ED-407A-8F82-F3CE61A9C4B4}C:\program files\java\jre6\bin\javaw.exe" | In - Public - P17 - TRUE | .(.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\program files\java\jre6\bin\javaw.exe

O87 - FAEL: "TCP Query User{55CCDBC7-3ECF-455F-AF68-5B6871C93A93}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" | In - Public - P6 - TRUE | .(.DsNET.) -- C:\program files\dsnet corp\atube catcher 2.0\yct.exe

O87 - FAEL: "UDP Query User{FA88821C-9371-490E-8663-C8B8ADF500D7}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" | In - Public - P17 - TRUE | .(.DsNET.) -- C:\program files\dsnet corp\atube catcher 2.0\yct.exe

O87 - FAEL: "{A478EFAD-1389-4DEB-9BC9-20BF7FA1238C}" | In - Public - P6 - TRUE | .(.SweetIM Technologies Ltd. - Update Manager for SweetPacks.) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe

O87 - FAEL: "{36BE1240-3E4F-41BB-B9A0-060F51E1789B}" | In - Public - P17 - TRUE | .(.SweetIM Technologies Ltd. - Update Manager for SweetPacks.) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe

~ Scan Firewall in 00mn 00s

 

 

 

---\\ Additionnal Scan (O88)

Database Version : 9183 - (04/09/2012)

Clés trouvées (Keys found) : 28

Valeurs trouvées (Values found) : 0

Dossiers trouvés (Folders found) : 7

Fichiers trouvés (Files found) : 1

 

[HKLM\Software\Classes\sweetie.ietoolbar] =>Toolbar.SweetIM

[HKLM\Software\Classes\sweetie.ietoolbar.1] =>Toolbar.SweetIM

[HKLM\Software\Classes\sweetim_urlsearchhook.toolbarurlsearchhook] =>Toolbar.SweetIM

[HKLM\Software\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1] =>Toolbar.SweetIM

[HKLM\Software\Classes\Toolbar3.sweetie] =>Toolbar.SweetIM

[HKLM\Software\Classes\Toolbar3.sweetie.1] =>Toolbar.SweetIM

[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Adware.Agent

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Adware.MyWebSearch

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}] =>Adware.IMBooster

[HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon

[HKLM\Software\Classes\Interface\{eee6c358-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\Interface\{eee6c35a-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{eee6c35b-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{eee6c35b-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Classes\CLSID\{eee6c35b-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}] =>Adware.BHO

[HKLM\Software\Classes\TypeLib\{eee6c35e-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Classes\TypeLib\{eee6c35f-6118-11dc-9c72-001320c79847}] =>Toolbar.SweetIM

[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}] =>Toolbar.SweetIM

[HKCU\Software\SweetIM] =>Toolbar.SweetIM

[HKLM\Software\SweetIM] =>Toolbar.SweetIM

[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM] =>Toolbar.SweetIM

[HKLM\Software\aTube Catcher\OpenCandy] =>Adware.OpenCandy

C:\Program Files\DealPly =>PUP.DealPly

C:\Program Files\SweetIM =>Toolbar.SweetIM

C:\ProgramData\Babylon =>Toolbar.Babylon

C:\Users\Sergio\AppData\Roaming\Babylon =>Toolbar.Babylon

C:\Users\Sergio\AppData\Roaming\pdfforge =>PUP.Dealio

C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\hscznr7j.default\SearchPlugins\sweetim.xml =>Toolbar.SweetIM

~ Scan Additionnel in 00mn 03s

 

 

 

---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)

SR - | Auto 27/07/2012 63960 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

SS - | Demand 18/08/2012 250056 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

SR - | Auto 10/11/2011 490840 | (AdvancedSystemCareService5) . (.IObit.) - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

SR - | Auto 21/08/2012 44808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

SS - | Auto 23/07/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe

SS - | Demand 23/07/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe

SS - | Demand 09/05/2011 136120 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

SR - | Auto 09/01/2012 821592 | (IMFservice) . (.IObit.) - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

SR - | Auto 20/12/2010 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

SS - | Demand 25/05/2012 129976 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

SS - | Demand 13/04/2007 792112 | (NBService) . (.Nero AG.) - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

SS - | Demand 08/05/2007 271920 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

SR - | Auto 11/09/2010 600680 | (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\System32\nvvsvc.exe

SR - | Auto 167936 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

SS - | Auto 07/06/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe

SR - | Auto 10/09/2010 369256 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

SR - | Auto 20/12/2010 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

SR - | Auto 14/12/2010 27760 | (VIAKaraokeService) . (.VIA Technologies, Inc..) - C:\Windows\System32\viakaraokesrv.exe

SR - | Auto 13/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 13/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Scan Services in 00mn 04s

 

 

 

End of the scan (1310 lines in 00mn 56s)(0)

[DigRam 144]

Boa Noite! srspereira

 

|- Baixe: < > ( ... par Xplode )

 

|- Ao acessar,clique na imagem: < >

 

|- Salve-o no desktop!

|- Clique direito em adwcleaner.exe,e escolha sua execução como "administrador".

|- Ps: Dê início ao scan,clicando em "Delete" ou "Suppression".

 

 

|- Ao concluir,poste o relatório: C:\AdwCleaner[S1].txt

 

-/-

 

|- Feche programas/pastas que estejam abertos.

|- Feche,também,o navegador!

|- Para Windows Vista,desabilite a UAC.

 

 

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.

|- Selecione e copie estas informações,que estão em vermelho,para o "Bloco de Notas".

 

M3 - MFPP: Plugins - [sergio] -- C:\Program Files\Mozilla FireFox\searchplugins\babylon.xml => Infection BT (Toolbar.Babylon)

O43 - CFD: 14/04/2012 - 14:43:52 - [0] ----D C:\Program Files\DealPly => Infection PUP (PUP.DealPly)

O43 - CFD: 05/04/2012 - 17:24:17 - [0] ----D C:\ProgramData\Babylon => Infection BT (Toolbar.Babylon)

O43 - CFD: 05/04/2012 - 17:24:17 - [0,019] ----D C:\Users\Sergio\AppData\Roaming\Babylon => Infection BT (Toolbar.Babylon)

O43 - CFD: 14/03/2012 - 22:41:41 - [0,002] ----D C:\Users\Sergio\AppData\Roaming\pdfforge => Infection BT (PUP.Dealio)

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.newtab.url", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf0000000000000000000'>http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf0000000000000000000[...]

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("browser.search.order.1", "Search the web (Babylon)");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.admin", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.aflt", "babsst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.babExt", "");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.babTrack", "affID=112555&tt=2912_4");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.bbDpng", 24);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.dfltSrch", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.hmpg", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.id", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.instlDay", "15544");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.instlRef", "sst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.lastDP", 24);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.newTab", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.newTabUrl", "http://search.babylon.com/?babsrc=NT_bb");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.noFFXTlbr", false);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.propectorlck", 81662174);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prtkDS", 1);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.ptch_0717", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.smplGrp", "none");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.srcExt", "ss");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.tlbrId", "base");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.babExt", "");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=2912_4");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.hardId", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.id", "14e5addf000000000000000000000000");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.instlDay", "15544");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.newTab", true);

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=NT_ss&mntrId=14e5addf[...]

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1723:19:26");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

O69 - SBI: prefs.js [sergio - hscznr7j.default] user_pref("keyword.URL", "http://search.babylon.com/?affID=112555&tt=2912_4&babsrc=KW_ss&mntrId=14e5addf000000000000000000000000&q[...]

 

[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] => Infection BT (Adware.Agent)

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] => Infection BT (Adware.MyWebSearch)

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}] => Infection BT (Adware.IMBooster)

[HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] => Infection BT (Toolbar.Babylon)

[HKLM\Software\aTube Catcher\OpenCandy]

[HKLM\Software\Babylon] => Infection BT (Toolbar.Babylon)

 

C:\Program Files\DealPly => Infection PUP (PUP.DealPly)

C:\ProgramData\Babylon => Infection BT (Toolbar.Babylon)

C:\Users\Sergio\AppData\Roaming\Babylon => Infection BT (Toolbar.Babylon)

C:\Users\Sergio\AppData\Roaming\pdfforge => Infection BT (PUP.Dealio)

 

hostfix

proxyfix

emptytemp

emptyflash

firewallraz

|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"

|- Minimize o Bloco de Notas.

 

 

|- Clique no menu,"Paste ClipBoard".

|- Clique em "GO" -> Oui.

 

 

|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.

|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt

 

Abs!

[wings 22]

Tópico Arquivado

 

Como o autor não respondeu por mais de 10 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.