Author Topic: Programs closing down randomly (Vista) (Read 18658 times)

Rebs · « **on:** May 21, 2011, 07:24:33 PM »

I'm new to these forums but I've noticed this particular issue has been the topic of many threads here. However, I believe this has to be dealt individually, so I decided to create this topic.

To the point:

I've been having this problem for over a week now, programs keep randomly closing (message: Program X stopped working and had to be closed). I've ran a variety of anti-spyware programs, anti-virus, cleaned registry, ran scandisk and the problem persists.

Do you have any idea what this might be?

I suspect it's from a "codec" (which obv wasn't really a codec) I downloaded after getting a file from one of those filesharing links.

Anyway, here's Hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:11:01, on 22-05-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\SysWOW64\conime.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pt_pt&c=92&bd=Pavilion&pf=cndt
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.live.com/1rewlive4startup/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pt_pt&c=92&bd=Pavilion&pf=cndt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.duxet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {e0301295-ab3e-4af3-979f-3d453c5f9f48} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programa Auxiliar de Início de Sessão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Serviço de rede')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: Serviço de Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7943 bytes

SuperDave · « **Reply #1 on:** May 22, 2011, 06:17:22 PM »

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*******************************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
********************************************

Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*************************************************
Download DDS from HERE or HERE and save it to your desktop.

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs.

1) DDS.txt
2) Attach.txt

* Save both logs to your desktop.
* Please copy and paste the entire contents of both logs in your next reply.

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.

Rebs · « **Reply #2 on:** May 23, 2011, 12:38:07 AM »

Hello Dave, thanks for the answer. Here are the logs as requested:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/23/2011 at 05:23 AM

Application Version : 4.52.1000

Core Rules Database Version : 7109
Trace Rules Database Version: 4921

Scan type : Complete Scan
Total Scan Time : 02:41:22

Memory items scanned : 573
Memory threats detected : 0
Registry items scanned : 13712
Registry threats detected : 0
File items scanned : 218841
File threats detected : 0

----

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Versão da base de dados: 6641

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

23-05-2011 06:59:33
mbam-log-2011-05-23 (06-59-33).txt

Tipo de pesquisa: Completa (C:\|D:\|)
Objectos verificados: 385922
Tempo decorrido: 1 hora(s), 8 minuto(s), 54 segundo(s)

Processos de memória infectados: 0
módulos de Memória infectados: 0
Chaves do Registo Infectadas: 0
Valores do Registo infectados: 0
Itens de dados do Registo Infectados: 0
Pastas Infectadas: 0
Ficheiros Infectados: 0

Processos de memória infectados:
(Nenhum item malicioso detectado)

módulos de Memória infectados:
(Nenhum item malicioso detectado)

Chaves do Registo Infectadas:
(Nenhum item malicioso detectado)

Valores do Registo infectados:
(Nenhum item malicioso detectado)

Itens de dados do Registo Infectados:
(Nenhum item malicioso detectado)

Pastas Infectadas:
(Nenhum item malicioso detectado)

Ficheiros Infectados:
(Nenhum item malicioso detectado)

- Sorry I forgot to change the language to English before running the test, but as you can see.. no threats were found.

As for DDS, I can't seem to be able to run it. It stops working and closes down, due to the same problem that brought me here.

SuperDave · « **Reply #3 on:** May 23, 2011, 11:37:17 AM »

Ok. Let's try this one.

Download OTL to your desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* When the window appears, underneath Output at the top change it to Minimal Output.
* Check the boxes beside LOP Check and Purity Check.
* Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy and pate the contents of these files, one at a time, into your next reply.

Note: You may need two or more posts to fit them all in.

Rebs · « **Reply #4 on:** May 23, 2011, 12:16:06 PM »

OTL logfile created on: 23-05-2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Ramiro\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000816 | Country: Portugal | Language: PTG | Date Format: dd-MM-yyyy

5,00 Gb Total Physical Memory | 3,29 Gb Available Physical Memory | 65,75% Memory free
10,14 Gb Paging File | 8,53 Gb Available in Paging File | 84,17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 915,76 Gb Total Space | 128,62 Gb Free Space | 14,05% Space Free | Partition Type: NTFS
Drive D: | 10,76 Gb Total Space | 1,58 Gb Free Space | 14,70% Space Free | Partition Type: NTFS
Drive E: | 230,58 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: TRINCA-NA-PÊRA | User Name: Ramiro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Ramiro\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Windows\SysWOW64\conime.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Ramiro\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (ezSharedSvc) -- C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)

========== Driver Services (SafeList) ==========

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\DRIVERS\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\DRIVERS\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (SBRE) -- C:\Windows\SysNative\drivers\SBREdrv.sys (Sunbelt Software)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\DRIVERS\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\DRIVERS\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\59F1.tmp (Sophos Plc)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iastor.sys (Intel Corporation)
DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (RT73) -- C:\Windows\SysNative\DRIVERS\Dr71WU.sys (Ralink Technology Inc.)
DRV - (Lavasoft Kernexplorer) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys ()
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SASDIFSV) -- C:\Programas\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Programas\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)
DRV - (PCD5SRVC{8AAF211B-043E02A9-05040000}) -- C:\Programas\PC-Doctor for Windows\pcd5srvc_x64.pkms (PC-Doctor, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pt_pt&c=92&bd=Pavilion&pf=cndt
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pt_pt&c=92&bd=Pavilion&pf=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pt_pt&c=92&bd=Pavilion&pf=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.duxet.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pt_pt&c=92&bd=Pavilion&pf=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.live.com/1rewlive4startup/home
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {e0301295-ab3e-4af3-979f-3d453c5f9f48} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginen ame: "Bing"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=WLETDF&PC=WLEM&q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://g.live.com/1rewlive4startup/home"
FF - prefs.js..extensions.enabledItems: [email protected]:1.2.2n
FF - prefs.js..extensions.enabledItems: [email protected]:1.01
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {40a1f5d7-afc2-498f-b264-02668d616ff6}:1.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVfox000&ptb=v7vjs4NH3LOYKt6.2Gqdsw&ind=2010110605&ptnrS=ZVfox000&si=&n=77cfda8d&psa=&st=kwd&searchfor="

FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\MyWebSearch\bar\3.bin
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG10\Firefox4\ [2011-05-23 09:30:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-05-22 08:10:23 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011-05-13 13:28:20 | 000,000,000 | ---D | M]

[2009-09-15 18:52:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Extensions
[2011-05-23 10:35:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions
[2010-03-26 20:52:02 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010-04-28 02:14:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010-10-16 19:08:38 | 000,000,000 | ---D | M] (Mega Manager Integration) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
[2011-05-13 12:02:17 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010-10-16 17:16:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}-trash
[2011-02-05 04:56:53 | 000,000,000 | ---D | M] (uTorrentBar_PT Community Toolbar) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{e0301295-ab3e-4af3-979f-3d453c5f9f48}
[2011-04-13 15:45:04 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011-02-24 19:28:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\DefaultManager@Microsoft-trash
[2011-02-05 04:56:53 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\[email protected]
[2010-01-08 18:50:26 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\[email protected]
[2011-05-09 02:51:30 | 000,000,000 | ---D | M] ("Firefox Stats") -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\[email protected]
[2009-12-10 04:56:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\[email protected]
[2011-03-08 20:59:48 | 000,000,000 | ---D | M] (vShare) -- C:\Users\Ramiro\AppData\Roaming\mozilla\Firefox\Profiles\nfxw56s1.default\extensions\vshare@toolbar
[2011-02-24 16:42:49 | 000,001,832 | ---- | M] () -- C:\Users\Ramiro\AppData\Roaming\Mozilla\Firefox\Profiles\nfxw56s1.default\searchplugins\bing.xml
[2010-11-06 10:34:49 | 000,010,017 | ---- | M] () -- C:\Users\Ramiro\AppData\Roaming\Mozilla\Firefox\Profiles\nfxw56s1.default\searchplugins\mywebsearch.xml
[2011-05-23 10:35:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010-07-04 15:24:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010-11-02 22:16:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011-02-14 20:45:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011-02-26 11:07:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011-05-23 09:30:59 | 000,000,000 | ---D | M] (No name found) -- C:\PROGRAM FILES (X86)\AVG\AVG10\FIREFOX4
[2011-02-26 11:07:04 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011-03-05 20:56:29 | 000,001,525 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011-03-05 20:56:29 | 000,001,529 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\priberam.xml
[2011-03-05 20:56:29 | 000,002,071 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\sapo.xml
[2011-03-05 20:56:29 | 000,000,942 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-ptpt.xml
[2011-03-05 20:56:29 | 000,000,953 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-br.xml

O1 HOSTS File: ([2010-02-03 05:23:09 | 000,000,761 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E0301295-AB3E-4AF3-979F-3D453C5F9F48} - No CLSID value found.
O4 - HKLM..\Run: [AVG_TRAY] File not found
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.113.164.5 212.113.164.6
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programas\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Ramiro\AppData\Roaming\Microsoft\Windows DreamScene\DreamScene.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ramiro\AppData\Roaming\Microsoft\Windows DreamScene\DreamScene.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010-11-04 03:29:28 | 000,000,042 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{756deaa4-448e-11de-910d-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{756deaa4-448e-11de-910d-806e6f6e6963}\Shell\AutoRun\command - "" = E:\acer.exe -- [2010-11-04 03:29:27 | 005,771,438 | R--- | M] (Adobe Systems, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011-05-23 19:08:35 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Ramiro\Desktop\OTL.exe
[2011-05-23 09:41:45 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011-05-23 09:41:45 | 000,000,000 | ---D | C] -- C:\Programas\AVAST Software
[2011-05-23 07:25:15 | 000,606,738 | R--- | C] (Swearware) -- C:\Users\Ramiro\Desktop\dds.scr.scr
[2011-05-22 19:43:33 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Roaming\Pixel Studio Pro
[2011-05-22 19:43:26 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pixel Studio Pro
[2011-05-22 19:43:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pixel
[2011-05-22 18:11:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011-05-22 18:11:20 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Ramiro\Desktop\mbam-setup-1.50.1.1100.exe
[2011-05-22 18:10:47 | 003,063,136 | ---- | C] (Piriform Ltd) -- C:\Users\Ramiro\Desktop\ccsetup306.exe
[2011-05-22 04:29:59 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\INVedit
[2011-05-22 04:02:18 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Roaming\SUPERAntiSpyware.com
[2011-05-22 04:02:18 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011-05-22 04:02:16 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011-05-22 04:02:16 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2011-05-22 04:02:13 | 000,000,000 | ---D | C] -- C:\Programas\SUPERAntiSpyware
[2011-05-22 03:55:46 | 011,207,392 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Ramiro\Desktop\SUPERAntiSpyware.exe
[2011-05-22 02:09:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2011-05-22 02:09:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011-05-22 02:02:28 | 000,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Users\Ramiro\Desktop\HJTInstall.exe
[2011-05-22 00:16:18 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\Nova pasta
[2011-05-21 23:17:42 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{2BAF77D5-4390-44F8-B5FF-3242B7325071}
[2011-05-21 05:55:49 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\MCRedstoneSim22
[2011-05-20 10:15:59 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{61B20B5E-A996-4820-8FEE-F7CC5D9ECD5E}
[2011-05-20 10:15:14 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{0C2C9ED8-28E8-46F9-AC52-D8E93503476C}
[2011-05-20 06:20:53 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\World3
[2011-05-19 23:16:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Codec Pack - All In 1
[2011-05-19 22:37:14 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\Estática
[2011-05-19 20:20:00 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\_Sol(1)[1].Prob.Estática2
[2011-05-19 20:07:47 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{1007B654-7E70-4F19-BACA-DC20F98A555F}
[2011-05-19 04:34:55 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{8377A6F3-1694-45DC-B476-97567D2D5F58}
[2011-05-18 16:34:28 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{AD488AED-95FE-4A07-9DF4-B91644C3A906}
[2011-05-15 10:41:30 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Roaming\.minecraft
[2011-05-15 10:24:18 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\DarowsMinecraftBeta1.5_01
[2011-05-14 22:36:47 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\ftool212win
[2011-05-14 22:27:44 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{EC408EBE-FF1E-411B-94ED-D6E315A89AC2}
[2011-05-13 14:38:14 | 000,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2011-05-13 14:36:51 | 010,126,824 | ---- | C] (Microsoft Corporation) -- C:\Users\Ramiro\Desktop\mseinstall.exe
[2011-05-13 14:30:47 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW
[2011-05-13 14:18:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011-05-13 14:13:15 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011-05-13 14:13:15 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011-05-13 13:12:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011-05-13 13:10:10 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msls31.dll
[2011-05-13 13:10:09 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2011-05-13 13:10:09 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2011-05-13 13:10:09 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011-05-13 13:10:09 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dxtmsft.dll
[2011-05-13 13:10:09 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dxtrans.dll
[2011-05-13 13:10:09 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011-05-13 13:10:09 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2011-05-13 13:10:09 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2011-05-13 13:10:09 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2011-05-13 13:10:09 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2011-05-13 13:10:09 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2011-05-13 13:10:09 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2011-05-13 13:10:08 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011-05-13 13:10:08 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011-05-13 13:10:08 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011-05-13 13:10:08 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2011-05-13 13:10:08 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2011-05-13 13:10:08 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2011-05-13 13:10:08 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2011-05-13 13:10:08 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe
[2011-05-13 13:10:08 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011-05-13 13:10:08 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2011-05-13 13:10:08 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2011-05-13 13:10:08 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011-05-13 13:10:07 | 001,797,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2011-05-13 13:10:07 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011-05-13 13:10:07 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieaksie.dll
[2011-05-13 13:10:07 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieakui.dll
[2011-05-13 13:10:07 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2011-05-13 13:10:07 | 000,123,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2011-05-13 13:10:07 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011-05-13 13:10:07 | 000,114,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\advpack.dll
[2011-05-13 13:10:07 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2011-05-13 13:10:07 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\admparse.dll
[2011-05-13 13:10:07 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2011-05-13 13:10:07 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\imgutil.dll
[2011-05-13 13:10:07 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011-05-13 13:10:06 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieakeng.dll
[2011-05-13 13:10:02 | 002,303,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2011-05-13 13:10:02 | 000,818,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011-05-13 13:10:02 | 000,267,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieaksie.dll
[2011-05-13 13:10:02 | 000,222,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2011-05-13 13:10:02 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2011-05-13 13:10:02 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieakui.dll
[2011-05-13 13:10:02 | 000,114,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\admparse.dll
[2011-05-13 13:10:02 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2011-05-13 13:10:02 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2011-05-13 13:10:02 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2011-05-13 13:10:01 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011-05-13 13:10:01 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieakeng.dll
[2011-05-13 13:10:01 | 000,145,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011-05-13 13:10:01 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advpack.dll
[2011-05-13 13:10:01 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2011-05-13 13:10:01 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2011-05-13 13:10:01 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2011-05-13 13:10:01 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2011-05-13 13:10:01 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2011-05-13 13:10:01 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2011-05-13 13:10:00 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2011-05-13 13:10:00 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2011-05-13 13:10:00 | 000,452,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2011-05-13 13:10:00 | 000,448,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011-05-13 13:10:00 | 000,282,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2011-05-13 13:10:00 | 000,236,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011-05-13 13:10:00 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2011-05-13 13:10:00 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2011-05-13 13:10:00 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2011-05-13 13:10:00 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2011-05-13 13:09:59 | 001,492,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2011-05-13 13:09:59 | 000,697,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011-05-13 13:09:59 | 000,165,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2011-05-13 13:09:59 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2011-05-13 13:09:59 | 000,103,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2011-05-13 13:09:59 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011-05-13 13:09:59 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2011-05-13 13:09:58 | 000,603,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2011-05-13 13:09:58 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2011-05-13 13:09:58 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2011-05-13 13:09:57 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2011-05-13 12:13:55 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Roaming\Malwarebytes
[2011-05-13 12:12:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2011-05-13 12:12:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011-05-13 12:12:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011-05-13 12:12:41 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011-05-13 12:12:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011-05-10 00:36:01 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\MCE - Fichas
[2011-05-10 00:34:20 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\Desktop\MCE - Teórica
[2011-04-30 05:51:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2011-04-30 05:51:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
[2011-04-30 05:51:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011-04-27 14:17:52 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\Apps
[2011-04-27 10:52:01 | 001,653,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2011-04-27 10:52:01 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2011-04-27 10:51:59 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2011-04-27 10:51:59 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2011-04-27 10:51:59 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Apphlpdm.dll
[2011-04-27 10:51:59 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll
[2011-04-26 20:07:58 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{912FB8D9-FACD-4A2A-AC41-7F433EF10046}
[2011-04-26 01:21:07 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{593A1866-40EB-4659-AE93-ECB6BF217821}
[2011-04-24 21:20:46 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{4F13303A-A8C9-4662-BF47-51F8FDB6D4ED}
[2011-04-23 21:08:10 | 000,000,000 | ---D | C] -- C:\Users\Ramiro\AppData\Local\{C10ED9FC-E1CB-4060-9439-DB4D6968E69E}
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011-05-23 19:08:47 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Ramiro\Desktop\OTL.exe
[2011-05-23 19:08:15 | 000,001,026 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1682711522-1043235145-2778782327-1002UA.job
[2011-05-23 19:05:30 | 000,001,356 | ---- | M] () -- C:\Users\Ramiro\AppData\Local\d3d9caps.dat
[2011-05-23 19:02:38 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011-05-23 19:02:38 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011-05-23 19:02:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-05-23 09:40:46 | 056,923,744 | ---- | M] () -- C:\Users\Ramiro\Desktop\setup_av_free.exe
[2011-05-23 07:25:17 | 000,606,738 | R--- | M] (Swearware) -- C:\Users\Ramiro\Desktop\dds.scr.scr
[2011-05-23 02:46:44 | 000,243,200 | ---- | M] () -- C:\Users\Ramiro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-05-22 20:22:17 | 000,002,374 | ---- | M] () -- C:\Users\Ramiro\Desktop\livre_1298767676.png
[2011-05-22 19:45:48 | 000,065,169 | ---- | M] () -- C:\Users\Ramiro\Desktop\SimboloFCP.jpg
[2011-05-22 19:43:28 | 000,000,822 | ---- | M] () -- C:\Users\Ramiro\Desktop\Pixel Studio Pro.lnk
[2011-05-22 19:34:19 | 014,296,495 | ---- | M] () -- C:\Users\Ramiro\Desktop\pixeldemo-1.0.740-win32.exe
[2011-05-22 19:18:43 | 000,005,846 | ---- | M] () -- C:\Users\Ramiro\Desktop\mario.jpg
[2011-05-22 18:22:23 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011-05-22 18:21:57 | 000,662,600 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat
[2011-05-22 18:21:57 | 000,598,702 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011-05-22 18:21:57 | 000,131,810 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat
[2011-05-22 18:21:57 | 000,104,716 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011-05-22 18:15:27 | 000,000,950 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011-05-22 18:11:49 | 000,000,858 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011-05-22 18:11:43 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Ramiro\Desktop\mbam-setup-1.50.1.1100.exe
[2011-05-22 18:10:58 | 003,063,136 | ---- | M] (Piriform Ltd) -- C:\Users\Ramiro\Desktop\ccsetup306.exe
[2011-05-22 10:08:00 | 000,000,974 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1682711522-1043235145-2778782327-1002Core.job
[2011-05-22 08:11:26 | 439,891,648 | ---- | M] () -- C:\Users\Ramiro\Desktop\City of Angels [www.gamerpy.com].rmvb
[2011-05-22 05:03:16 | 001,506,662 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011-05-22 04:29:39 | 000,169,243 | ---- | M] () -- C:\Users\Ramiro\Desktop\INVedit.zip
[2011-05-22 04:02:16 | 000,001,758 | ---- | M] () -- C:\Users\Ramiro\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011-05-22 04:01:52 | 011,207,392 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Ramiro\Desktop\SUPERAntiSpyware.exe
[2011-05-22 02:09:49 | 000,001,930 | ---- | M] () -- C:\Users\Ramiro\Desktop\HijackThis.lnk
[2011-05-22 02:09:11 | 000,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Users\Ramiro\Desktop\HJTInstall.exe
[2011-05-22 02:02:05 | 001,385,298 | ---- | M] () -- C:\Users\Ramiro\Desktop\HijackThis.msi.part
[2011-05-22 01:53:18 | 000,000,000 | ---- | M] () -- C:\Users\Ramiro\Desktop\HijackThis.msi
[2011-05-22 01:07:20 | 000,003,032 | ---- | M] () -- C:\Users\Ramiro\Desktop\p3ramiro.pos
[2011-05-22 01:07:20 | 000,001,839 | ---- | M] () -- C:\Users\Ramiro\Desktop\p3ramiro.ftl
[2011-05-22 00:16:32 | 000,001,528 | ---- | M] () -- C:\Users\Ramiro\Desktop\paixaop4444.ftl
[2011-05-22 00:16:04 | 000,004,093 | ---- | M] () -- C:\Users\Ramiro\Desktop\Nova pasta.rar
[2011-05-22 00:15:56 | 000,000,194 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled1.2.html
[2011-05-21 23:59:54 | 001,518,652 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011-05-21 05:53:59 | 000,171,369 | ---- | M] () -- C:\Users\Ramiro\Desktop\MCRedstoneSim22.zip
[2011-05-20 10:56:36 | 000,003,106 | ---- | M] () -- C:\Users\Ramiro\Desktop\micael.pos
[2011-05-20 10:56:36 | 000,001,876 | ---- | M] () -- C:\Users\Ramiro\Desktop\micael.ftl
[2011-05-20 10:08:48 | 000,003,085 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled.pos
[2011-05-20 06:36:07 | 005,902,038 | ---- | M] () -- C:\Users\Ramiro\Desktop\Rollercoaster v1.1.rar
[2011-05-20 04:36:00 | 004,956,886 | ---- | M] () -- C:\Users\Ramiro\Desktop\World3.zip
[2011-05-20 04:19:55 | 005,894,831 | ---- | M] () -- C:\Users\Ramiro\Desktop\Darknetix-Best_MineCraft_Save_Ever!!!.rar
[2011-05-19 23:15:55 | 000,737,280 | ---- | M] (Indigo Rose Corporation) -- C:\Windows\iun6002.exe
[2011-05-19 22:51:04 | 000,003,308 | ---- | M] () -- C:\Users\Ramiro\Desktop\teste.pos
[2011-05-19 22:51:04 | 000,001,893 | ---- | M] () -- C:\Users\Ramiro\Desktop\teste.ftl
[2011-05-19 22:36:58 | 001,638,537 | ---- | M] () -- C:\Users\Ramiro\Desktop\Estática.zip
[2011-05-19 02:39:15 | 000,001,828 | ---- | M] () -- C:\Users\Ramiro\Desktop\Rainbow Man.png
[2011-05-19 02:35:02 | 596,822,429 | ---- | M] () -- C:\Users\Ramiro\Desktop\PACAD.2010.en.rar
[2011-05-19 01:26:25 | 000,003,010 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled2.pos
[2011-05-19 01:26:25 | 000,003,010 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled2 - Cópia.pos
[2011-05-19 01:26:25 | 000,001,614 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled2micael.ftl
[2011-05-19 01:26:25 | 000,001,614 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled2.ftl
[2011-05-19 01:26:25 | 000,001,614 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled2 - Cópia.ftl
[2011-05-19 01:22:22 | 000,003,011 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioest2.pos
[2011-05-19 01:22:22 | 000,001,627 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioest2.ftl
[2011-05-19 00:37:07 | 000,003,085 | ---- | M] () -- C:\aaa.pos
[2011-05-19 00:37:07 | 000,001,847 | ---- | M] () -- C:\aaa.ftl
[2011-05-19 00:34:12 | 000,003,085 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioESTATICA.pos
[2011-05-19 00:34:12 | 000,001,810 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioESTATICA.ftl
[2011-05-19 00:23:21 | 000,001,847 | ---- | M] () -- C:\Users\Ramiro\Desktop\untitled.ftl
[2011-05-18 17:50:05 | 000,001,892 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioest1.ftl
[2011-05-18 17:50:05 | 000,001,530 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioest1.pos
[2011-05-18 17:50:05 | 000,001,470 | ---- | M] () -- C:\Users\Ramiro\Desktop\exercicioest1.dat
[2011-05-17 15:59:59 | 000,000,456 | ---- | M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job
[2011-05-15 10:21:53 | 044,770,360 | ---- | M] () -- C:\Users\Ramiro\Desktop\DarowsMinecraftBeta1.5_01.zip
[2011-05-15 00:58:25 | 000,040,795 | ---- | M] () -- C:\Users\Ramiro\Desktop\backstabbers.png
[2011-05-14 22:46:45 | 000,041,866 | ---- | M] () -- C:\Users\Ramiro\Desktop\_Sol(1)[1].Prob.Estática2.zip
[2011-05-14 22:36:48 | 003,211,264 | ---- | M] () -- C:\Users\Ramiro\Desktop\Ftool.exe
[2011-05-14 22:36:38 | 001,162,962 | ---- | M] () -- C:\Users\Ramiro\Desktop\ftool212win.zip
[2011-05-14 21:13:05 | 000,270,142 | ---- | M] () -- C:\Users\Ramiro\Desktop\Minecraft.exe
[2011-05-14 12:17:29 | 114,957,371 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2011-05-13 14:36:51 | 010,126,824 | ---- | M] (Microsoft Corporation) -- C:\Users\Ramiro\Desktop\mseinstall.exe
[2011-05-13 14:09:47 | 000,000,975 | ---- | M] () -- C:\Users\Ramiro\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011-05-13 13:10:24 | 000,008,798 | ---- | M] () -- C:\Windows\SysWow64\icrav03.rat
[2011-05-13 13:10:24 | 000,008,798 | ---- | M] () -- C:\Windows\SysNative\icrav03.rat
[2011-05-13 13:10:24 | 000,001,988 | ---- | M] () -- C:\Windows\SysWow64\ticrf.rat
[2011-05-13 13:10:24 | 000,001,988 | ---- | M] () -- C:\Windows\SysNative\ticrf.rat
[2011-05-13 13:10:10 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msls31.dll
[2011-05-13 13:10:09 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2011-05-13 13:10:09 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2011-05-13 13:10:09 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011-05-13 13:10:09 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\dxtmsft.dll
[2011-05-13 13:10:09 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\dxtrans.dll
[2011-05-13 13:10:09 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011-05-13 13:10:09 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2011-05-13 13:10:09 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2011-05-13 13:10:09 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2011-05-13 13:10:09 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2011-05-13 13:10:09 | 000,063,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2011-05-13 13:10:09 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2011-05-13 13:10:08 | 001,427,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011-05-13 13:10:08 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2011-05-13 13:10:08 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011-05-13 13:10:08 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2011-05-13 13:10:08 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2011-05-13 13:10:08 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2011-05-13 13:10:08 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2011-05-13 13:10:08 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe
[2011-05-13 13:10:08 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2011-05-13 13:10:08 | 000,072,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011-05-13 13:10:08 | 000,066,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2011-05-13 13:10:08 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2011-05-13 13:10:08 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011-05-13 13:10:07 | 001,797,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2011-05-13 13:10:07 | 000,716,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011-05-13 13:10:07 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieaksie.dll
[2011-05-13 13:10:07 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieakui.dll
[2011-05-13 13:10:07 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2011-05-13 13:10:07 | 000,123,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2011-05-13 13:10:07 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011-05-13 13:10:07 | 000,114,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\advpack.dll
[2011-05-13 13:10:07 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2011-05-13 13:10:07 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\admparse.dll
[2011-05-13 13:10:07 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2011-05-13 13:10:07 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\imgutil.dll
[2011-05-13 13:10:07 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011-05-13 13:10:06 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieakeng.dll
[2011-05-13 13:10:02 | 002,303,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2011-05-13 13:10:02 | 000,818,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011-05-13 13:10:02 | 000,267,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieaksie.dll
[2011-05-13 13:10:02 | 000,222,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2011-05-13 13:10:02 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2011-05-13 13:10:02 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieakui.dll
[2011-05-13 13:10:02 | 000,114,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\admparse.dll
[2011-05-13 13:10:02 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2011-05-13 13:10:02 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2011-05-13 13:10:02 | 000,012,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2011-05-13 13:10:01 | 000,248,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011-05-13 13:10:01 | 000,160,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieakeng.dll
[2011-05-13 13:10:01 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011-05-13 13:10:01 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\advpack.dll
[2011-05-13 13:10:01 | 000,135,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2011-05-13 13:10:01 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2011-05-13 13:10:01 | 000,091,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2011-05-13 13:10:01 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2011-05-13 13:10:01 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2011-05-13 13:10:01 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2011-05-13 13:10:00 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2011-05-13 13:10:00 | 000,534,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2011-05-13 13:10:00 | 000,452,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2011-05-13 13:10:00 | 000,448,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011-05-13 13:10:00 | 000,282,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2011-05-13 13:10:00 | 000,236,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011-05-13 13:10:00 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2011-05-13 13:10:00 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2011-05-13 13:10:00 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2011-05-13 13:10:00 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2011-05-13 13:10:00 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2011-05-13 13:09:59 | 001,492,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2011-05-13 13:09:59 | 000,697,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011-05-13 13:09:59 | 000,165,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2011-05-13 13:09:59 | 000,160,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2011-05-13 13:09:59 | 000,103,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2011-05-13 13:09:59 | 000,096,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011-05-13 13:09:59 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2011-05-13 13:09:58 | 000,603,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2011-05-13 13:09:58 | 000,173,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2011-05-13 13:09:58 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2011-05-13 13:09:57 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2011-05-13 08:27:13 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011-05-13 08:27:13 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011-05-13 08:25:55 | 000,236,688 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2011-05-12 01:06:47 | 000,000,897 | ---- | M] () -- C:\Users\Ramiro\Desktop\TABTRIG.8xp
[2011-05-09 22:49:30 | 000,002,419 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011-05-08 20:10:18 | 000,000,600 | ---- | M] () -- C:\Users\Ramiro\AppData\Local\PUTTY.RND
[2011-04-30 05:53:27 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
[2011-04-30 05:51:42 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011-05-23 09:38:45 | 056,923,744 | ---- | C] () -- C:\Users\Ramiro\Desktop\setup_av_free.exe
[2011-05-22 20:22:17 | 000,002,374 | ---- | C] () -- C:\Users\Ramiro\Desktop\livre_1298767676.png
[2011-05-22 19:45:48 | 000,065,169 | ---- | C] () -- C:\Users\Ramiro\Desktop\SimboloFCP.jpg
[2011-05-22 19:43:28 | 000,000,822 | ---- | C] () -- C:\Users\Ramiro\Desktop\Pixel Studio Pro.lnk
[2011-05-22 19:34:06 | 014,296,495 | ---- | C] () -- C:\Users\Ramiro\Desktop\pixeldemo-1.0.740-win32.exe
[2011-05-22 19:18:43 | 000,005,846 | ---- | C] () -- C:\Users\Ramiro\Desktop\mario.jpg
[2011-05-22 18:11:49 | 000,000,858 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011-05-22 08:04:09 | 439,891,648 | ---- | C] () -- C:\Users\Ramiro\Desktop\City of Angels [www.gamerpy.com].rmvb
[2011-05-22 04:28:15 | 000,169,243 | ---- | C] () -- C:\Users\Ramiro\Desktop\INVedit.zip
[2011-05-22 04:02:16 | 000,001,758 | ---- | C] () -- C:\Users\Ramiro\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011-05-22 02:09:49 | 000,001,930 | ---- | C] () -- C:\Users\Ramiro\Desktop\HijackThis.lnk
[2011-05-22 01:53:18 | 000,000,000 | ---- | C] () -- C:\Users\Ramiro\Desktop\HijackThis.msi
[2011-05-22 01:50:34 | 001,385,298 | ---- | C] () -- C:\Users\Ramiro\Desktop\HijackThis.msi.part
[2011-05-22 00:16:32 | 000,001,528 | ---- | C] () -- C:\Users\Ramiro\Desktop\paixaop4444.ftl
[2011-05-22 00:16:04 | 000,004,093 | ---- | C] () -- C:\Users\Ramiro\Desktop\Nova pasta.rar
[2011-05-22 00:15:54 | 000,000,194 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled1.2.html
[2011-05-21 05:53:58 | 000,171,369 | ---- | C] () -- C:\Users\Ramiro\Desktop\MCRedstoneSim22.zip
[2011-05-21 03:49:09 | 000,003,032 | ---- | C] () -- C:\Users\Ramiro\Desktop\p3ramiro.pos
[2011-05-21 03:49:09 | 000,001,839 | ---- | C] () -- C:\Users\Ramiro\Desktop\p3ramiro.ftl
[2011-05-20 10:08:48 | 000,003,085 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled.pos
[2011-05-20 09:48:10 | 000,003,106 | ---- | C] () -- C:\Users\Ramiro\Desktop\micael.pos
[2011-05-20 09:48:08 | 000,001,876 | ---- | C] () -- C:\Users\Ramiro\Desktop\micael.ftl
[2011-05-20 06:35:57 | 005,902,038 | ---- | C] () -- C:\Users\Ramiro\Desktop\Rollercoaster v1.1.rar
[2011-05-20 04:35:29 | 004,956,886 | ---- | C] () -- C:\Users\Ramiro\Desktop\World3.zip
[2011-05-20 04:18:04 | 005,894,831 | ---- | C] () -- C:\Users\Ramiro\Desktop\Darknetix-Best_MineCraft_Save_Ever!!!.rar
[2011-05-19 22:36:58 | 001,638,537 | ---- | C] () -- C:\Users\Ramiro\Desktop\Estática.zip
[2011-05-19 22:16:34 | 000,001,614 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled2micael.ftl
[2011-05-19 22:04:15 | 000,003,308 | ---- | C] () -- C:\Users\Ramiro\Desktop\teste.pos
[2011-05-19 22:04:15 | 000,001,893 | ---- | C] () -- C:\Users\Ramiro\Desktop\teste.ftl
[2011-05-19 16:49:37 | 000,003,010 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled2 - Cópia.pos
[2011-05-19 16:49:37 | 000,001,614 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled2 - Cópia.ftl
[2011-05-19 02:39:15 | 000,001,828 | ---- | C] () -- C:\Users\Ramiro\Desktop\Rainbow Man.png
[2011-05-19 01:37:35 | 596,822,429 | ---- | C] () -- C:\Users\Ramiro\Desktop\PACAD.2010.en.rar
[2011-05-19 00:59:49 | 000,003,010 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled2.pos
[2011-05-19 00:56:04 | 000,001,614 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled2.ftl
[2011-05-19 00:37:07 | 000,003,085 | ---- | C] () -- C:\aaa.pos
[2011-05-19 00:37:07 | 000,001,847 | ---- | C] () -- C:\aaa.ftl
[2011-05-19 00:23:09 | 000,001,847 | ---- | C] () -- C:\Users\Ramiro\Desktop\untitled.ftl
[2011-05-18 23:33:25 | 000,003,011 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioest2.pos
[2011-05-18 18:08:54 | 000,003,085 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioESTATICA.pos
[2011-05-18 18:08:54 | 000,001,810 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioESTATICA.ftl
[2011-05-18 17:48:36 | 000,001,530 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioest1.pos
[2011-05-18 17:48:36 | 000,001,470 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioest1.dat
[2011-05-15 10:19:53 | 044,770,360 | ---- | C] () -- C:\Users\Ramiro\Desktop\DarowsMinecraftBeta1.5_01.zip
[2011-05-15 00:58:25 | 000,040,795 | ---- | C] () -- C:\Users\Ramiro\Desktop\backstabbers.png
[2011-05-15 00:12:09 | 000,001,627 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioest2.ftl
[2011-05-14 23:30:38 | 000,001,892 | ---- | C] () -- C:\Users\Ramiro\Desktop\exercicioest1.ftl
[2011-05-14 22:46:45 | 000,041,866 | ---- | C] () -- C:\Users\Ramiro\Desktop\_Sol(1)[1].Prob.Estática2.zip
[2011-05-14 22:36:33 | 001,162,962 | ---- | C] () -- C:\Users\Ramiro\Desktop\ftool212win.zip
[2011-05-14 21:13:04 | 000,270,142 | ---- | C] () -- C:\Users\Ramiro\Desktop\Minecraft.exe
[2011-05-13 14:41:42 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011-05-13 13:10:08 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2011-05-13 13:10:00 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2011-05-13 12:12:44 | 000,000,950 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011-05-12 01:06:47 | 000,000,897 | ---- | C] () -- C:\Users\Ramiro\Desktop\TABTRIG.8xp
[2011-05-10 05:52:53 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011-05-10 05:52:53 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011-04-30 06:26:57 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
[2011-04-30 05:51:42 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011-03-07 20:10:29 | 000,000,600 | ---- | C] () -- C:\Users\Ramiro\AppData\Local\PUTTY.RND
[2010-12-21 03:27:20 | 000,001,105 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010-11-03 20:28:45 | 000,143,864 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010-10-05 22:17:52 | 001,518,652 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010-07-16 20:44:23 | 000,000,000 | ---- | C] () -- C:\ProgramData\3960018112
[2010-07-14 20:43:47 | 000,000,000 | ---- | C] () -- C:\ProgramData\3128923618
[2010-07-14 11:53:14 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010-07-13 23:26:05 | 000,000,000 | ---- | C] () -- C:\ProgramData\2677997683
[2010-07-13 02:25:05 | 000,000,000 | ---- | C] () -- C:\ProgramData\2022031000
[2010-07-11 22:57:19 | 000,000,000 | ---- | C] () -- C:\ProgramData\479065052
[2010-07-09 22:16:41 | 000,000,000 | ---- | C] () -- C:\ProgramData\3753761618
[2010-07-09 20:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2010-07-08 23:27:18 | 000,000,000 | ---- | C] () -- C:\ProgramData\3932246234
[2010-07-08 18:21:54 | 000,000,000 | ---- | C] () -- C:\ProgramData\561810586
[2010-07-08 18:15:39 | 000,000,000 | ---- | C] () -- C:\ProgramData\1532693532
[2010-07-08 18:15:10 | 000,000,000 | ---- | C] () -- C:\ProgramData\1736043003
[2010-07-08 18:05:51 | 000,000,000 | ---- | C] () -- C:\ProgramData\3261860909
[2010-06-03 06:37:24 | 000,000,000 | ---- | C] () -- C:\ProgramData\2610168015
[2010-06-03 03:45:16 | 000,000,000 | ---- | C] () -- C:\ProgramData\2422947355
[2010-06-03 03:41:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\2680800125
[2010-06-03 03:34:27 | 000,000,000 | ---- | C] () -- C:\ProgramData\4202166769
[2010-06-03 02:46:03 | 000,000,000 | ---- | C] () -- C:\ProgramData\3796208030
[2010-06-03 00:39:37 | 000,000,000 | ---- | C] () -- C:\ProgramData\3315461514
[2010-06-02 23:14:17 | 000,000,000 | ---- | C] () -- C:\ProgramData\2836823284
[2010-06-01 01:04:51 | 000,271,200 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010-06-01 01:04:51 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010-05-11 23:56:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\3557768672
[2010-05-10 18:17:16 | 000,000,000 | ---- | C] () -- C:\ProgramData\2076479517
[2010-05-10 14:01:05 | 000,000,000 | ---- | C] () -- C:\ProgramData\2618299969
[2010-05-10 05:45:48 | 000,000,510 | ---- | C] () -- C:\Windows\wordpad.INI
[2010-05-10 05:03:32 | 000,000,000 | ---- | C] () -- C:\ProgramData\3336244796
[2010-05-09 05:53:53 | 000,000,000 | ---- | C] () -- C:\ProgramData\2266778060
[2010-05-09 01:04:16 | 000,000,000 | ---- | C] () -- C:\ProgramData\3573279311
[2010-05-08 21:50:47 | 000,000,000 | ---- | C] () -- C:\ProgramData\1182322599
[2010-05-08 01:27:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\1907348517
[2010-05-07 23:39:31 | 000,000,000 | ---- | C] () -- C:\ProgramData\1572917460
[2010-05-06 23:37:10 | 000,000,000 | ---- | C] () -- C:\ProgramData\2659817469
[2010-05-06 21:29:10 | 000,000,000 | ---- | C] () -- C:\ProgramData\1909318870
[2010-05-06 19:28:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\2649077057
[2010-05-06 19:04:44 | 000,000,000 | ---- | C] () -- C:\ProgramData\2674626008
[2010-05-06 02:30:40 | 000,000,000 | ---- | C] () -- C:\ProgramData\3910187123
[2010-05-05 23:50:53 | 000,000,000 | ---- | C] () -- C:\ProgramData\2501230040
[2010-05-05 21:34:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\280395400
[2010-05-03 00:39:18 | 000,000,000 | ---- | C] () -- C:\ProgramData\1289102523
[2010-05-02 01:02:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\4261205932
[2010-05-01 01:37:30 | 000,000,000 | ---- | C] () -- C:\ProgramData\1031708563
[2010-04-30 22:40:18 | 000,000,000 | ---- | C] () -- C:\ProgramData\1782638393
[2010-04-30 19:49:34 | 000,000,000 | ---- | C] () -- C:\ProgramData\458447532
[2010-04-30 19:38:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\1431524218
[2010-04-30 03:45:54 | 000,000,000 | ---- | C] () -- C:\ProgramData\652983959
[2010-04-30 00:58:22 | 000,000,000 | ---- | C] () -- C:\ProgramData\1435226942
[2010-04-29 22:01:34 | 000,000,000 | ---- | C] () -- C:\ProgramData\4083023734
[2010-04-29 19:38:50 | 000,000,000 | ---- | C] () -- C:\ProgramData\3708157698
[2010-04-29 05:26:56 | 000,000,000 | ---- | C] () -- C:\ProgramData\2215393236
[2010-04-29 03:18:24 | 000,000,000 | ---- | C] () -- C:\ProgramData\1359465149
[2010-04-29 02:51:51 | 000,000,000 | ---- | C] () -- C:\ProgramData\929510127
[2010-04-28 22:45:32 | 000,000,000 | ---- | C] () -- C:\ProgramData\871424518
[2010-04-28 22:07:31 | 000,000,000 | ---- | C] () -- C:\ProgramData\1819339477
[2010-04-28 21:47:40 | 000,000,000 | ---- | C] () -- C:\ProgramData\1995256862
[2010-04-27 22:52:46 | 000,000,000 | ---- | C] () -- C:\ProgramData\401540024
[2010-04-27 18:28:10 | 000,000,000 | ---- | C] () -- C:\ProgramData\929482734
[2010-04-27 18:23:41 | 000,000,000 | ---- | C] () --

Rebs · « **Reply #5 on:** May 23, 2011, 12:16:41 PM »

OTL Extras logfile created on: 23-05-2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Ramiro\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000816 | Country: Portugal | Language: PTG | Date Format: dd-MM-yyyy

5,00 Gb Total Physical Memory | 3,29 Gb Available Physical Memory | 65,75% Memory free
10,14 Gb Paging File | 8,53 Gb Available in Paging File | 84,17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 915,76 Gb Total Space | 128,62 Gb Free Space | 14,05% Space Free | Partition Type: NTFS
Drive D: | 10,76 Gb Total Space | 1,58 Gb Free Space | 14,70% Space Free | Partition Type: NTFS
Drive E: | 230,58 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: TRINCA-NA-PÊRA | User Name: Ramiro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L" File not found
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = 02 35 A2 C8 E1 A2 CA 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{17B64440-B824-4FEA-9A5E-EF0819044D6C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{244F102A-0DD9-415B-83DF-3C1C84946F7F}" = lport=49161 | protocol=6 | dir=in | name=akamai netsession interface |
"{3301B4E0-95C4-4112-976F-836D9ABE81CA}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{53555E8D-FC02-490A-B053-F8CB9ECFDC79}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{94E65D5B-0015-4799-A426-CA4A242A3C31}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{A5474B44-5644-4A15-A934-073997B55D28}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{F147512D-0862-4B35-81E7-5189DF926E61}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{080CB5E1-6B1C-4E33-8C31-6414353731B8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{0AF8FBCF-E85D-4FB5-8842-042E53DD3B56}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{0D2877C1-00D9-4335-A4AA-582A57E846EB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty 4\iw3mp.exe |
"{0DCDFC0B-7C99-4A37-A6C9-0F44422B5BE4}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe |
"{0DE1D09C-86F1-40B0-897C-170146B755E2}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{12441626-70CD-4879-8B6D-07FA59CB80D9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{18F89E6A-6BEB-4A66-A450-96844F069D49}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{27AC9DD3-4962-45B3-B53D-3327FFC4EEA1}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{31D2B94A-FE79-4A1F-815F-31C423A2FB2D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\reliccoh.exe |
"{360EEEB5-3B27-47D4-8054-3A3622ADC48E}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\tv\qpservice.exe |
"{3668C7B3-FF38-404A-85CC-3C723D2A4646}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\robsfiker\counter-strike\hl.exe |
"{3D7C8B4E-4796-4584-927C-A4B14BC685E7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\virtua tennis 2009\config.exe |
"{3ECFE3EC-F201-478C-B0DA-BCA9CA4D1C83}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{46A77BAB-6E06-4E76-8112-1E6AC51F54D3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4EBAFBF2-8E15-4E39-AB84-32589222F0AA}" = protocol=17 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{5871C738-145B-4DB8-8749-9004E64AE4EC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5F24CD40-0658-46CA-B2BA-6ECB3BFE7F3E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{6332F1A7-E5F1-424A-8D6B-3EA65D1F5DED}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe |
"{671A12DB-8718-4ED7-B4A0-251D4F57C900}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\tv\qp.exe |
"{68C7F7E5-FD49-4642-9AB4-A714433D8B60}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe |
"{68D403BA-D09F-49BB-89C8-62E83F656FF3}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe |
"{6A992663-11E2-4909-A404-284ECE884D82}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
"{6B18FA02-3FE5-4049-9F88-127BD977BBB6}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe |
"{6C5049F8-C144-4C14-907A-E58FA0AA29A8}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe |
"{7B90F0A1-FE5B-4FDA-91DC-B5BDABBBC733}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7E81BE31-E35D-4910-928A-9B4887FE1C40}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7FBE7EB0-A2A3-46AD-987B-CFEB27CFD912}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8400E309-370D-4BB3-A7BC-718D8D33A41C}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{854A3DAE-0521-4CAB-8AB6-FB870E59B328}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe |
"{876C0FE5-9F1A-4125-8B1A-90AA6D82FAE3}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{8B73EC94-A5AD-4FF3-BEF6-9ED74F263E67}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty 4\iw3sp.exe |
"{8D19F0F3-988C-425B-B06E-8DE8B82958C0}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe |
"{B0987716-5191-489F-9871-F9CF9583A4DE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\robsfiker\counter-strike\hl.exe |
"{B188CE00-90AF-4BFE-BD26-997D0B6CE8F9}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe |
"{B2AED131-4F1D-4843-A51E-639E9F58AEAC}" = dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{BA89F795-5C86-43CC-8C47-075B1E8C3071}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\company of heroes\reliccoh.exe |
"{BB4537FC-830D-4659-9965-4DC072A28923}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{BB5DF0ED-2400-4292-979A-6EF52E8D4EF4}" = protocol=6 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{BCEF1EF1-245D-4944-AB02-8D1CD53793F6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{C08921C5-1BDE-41A4-8A50-467B3A775ECF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C1CA0F7E-56A6-48CF-9C62-CED8F0E9B622}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe |
"{C6738991-2C99-4F71-BC24-BA33906A549B}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{C8A802E5-7040-45EF-84D5-80CB53D08B78}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe |
"{CDC4C512-59F1-4A6A-AD96-2C3127FC920C}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe |
"{CE834EE0-251C-401A-ADF0-37582B1E100C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe |
"{D170E97A-8DE6-484B-8921-A8E40DAF387F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{D23E9985-2927-4724-84A0-178178E7CD11}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D35649CB-9416-486E-8267-7D96DB233840}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe |
"{D3BD1A49-D731-440E-A9F5-0E639E950ADD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{D4AB2E67-3EAA-483D-8230-7C8C29BCF8BF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty 4\iw3mp.exe |
"{D51A1B3B-C2F7-43D0-98C1-9B927FB7453F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\virtua tennis 2009\config.exe |
"{D6D462F2-F423-4C34-8592-5E293BFDDE3F}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe |
"{D9A67B6E-89D5-4787-B387-AF8F7313762D}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe |
"{DB36B2BB-42DF-4DFB-A240-EA1244B25AF5}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe |
"{DF74388A-F111-41B0-8CF2-43D5A574BD76}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe |
"{E0028A84-579E-443C-939A-2C572F8D6F57}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{ED63E357-0CA9-4F63-A4F1-ACEAB4028B3B}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe |
"{EF738CE5-73E0-488A-ACA6-CDA2CD8D4F57}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{F18D0B9D-E866-4BA6-B994-52D20764902E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F3C4CC17-EEC5-4A89-AB11-4F9F55246E6F}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{F3F4341C-61A3-4157-83A2-55ABB207077F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty 4\iw3sp.exe |
"{F74BF07C-5FE9-4679-B812-8CBDAD70C1C7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"TCP Query User{33B9A295-4B7B-4E36-A56F-E7398C8B8724}C:\program files (x86)\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"TCP Query User{926619FF-5DA9-4873-B8A5-59D2EA5FFBC3}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"TCP Query User{94409EDA-1BC8-4750-A70C-906788C2073B}C:\users\ramiro\desktop\xtreme9\xtreme9\mirc.exe" = protocol=6 | dir=in | app=c:\users\ramiro\desktop\xtreme9\xtreme9\mirc.exe |
"UDP Query User{1BA23329-65ED-49EE-9895-0D29D77E9BC6}C:\users\ramiro\desktop\xtreme9\xtreme9\mirc.exe" = protocol=17 | dir=in | app=c:\users\ramiro\desktop\xtreme9\xtreme9\mirc.exe |
"UDP Query User{482C4619-6DC3-4A47-B4A2-6E622990B793}C:\program files (x86)\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe |
"UDP Query User{4E1F03AE-1ADD-4576-87FE-BF895494B494}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{17E02F38-FF2D-4c3d-83DF-ECE2A1D20A5E}" = AIO_CDB_ToolboxIni64
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{22441735-5983-AD2A-5CC5-FA2CCD7EF732}" = ATI Stream SDK v2 Developer
"{23236FC2-648D-4ACF-AD16-68492D0F0AC9}" = FileBox eXtender
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{42FBA9A9-A14D-3918-BFE1-4FC8FEDDEF5C}" = Microsoft .NET Framework 4 Client Profile PTG Language Pack
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4FFA2088-8317-3B14-93CD-4C699DB37843}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{742DF898-7ABE-4CF4-8557-5D17C400D49C}" = AVG 2011
"{7B1DBCBE-DF17-3B58-844C-F572F70EF5C4}" = Microsoft .NET Framework 3.5 Language Pack SP1 - ptg
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8F473675-D702-45F9-8EBC-342B40C17BF5}" = Apple Mobile Device Support
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F560BEB-021F-43AC-825F-AA60442D8DE4}" = 64 Bit HP CIO Components Installer
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{AE57C044-8912-A181-A0E4-BC2DAB3A092A}" = ATI Catalyst Install Manager
"{B24A47E5-F196-461E-A7A4-AADB72CB19DD}" = iTunes
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D49110AD-34A7-485C-901D-DFBBFF70D3EC}" = AVG 2011
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F1568AA6-5982-4AFB-A871-C68E4328BC3B}" = HP MediaSmart SmartMenu
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - ptg" = Microsoft .NET Framework 3.5 Language Pack SP1 - PTG
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile PTG Language Pack" = Microsoft .NET Framework 4 Client Profile PTG Language Pack
"OfficeTrial" = Microsoft Office Casa e Estudantes 2007 Avaliação
"PC-Doctor for Windows" = Ferramentas de Diagnóstico de Hardware
"VistaGlazz_is1" = VistaGlazz 2.3

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0295F89F-F698-4101-9A7D-49F407EC2D82}" = HP Active Support Library
"{03BF5CB1-B72E-4CA6-A278-F65680F05420}" = HP Picasso Media Center Add-In
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B26A979-EC68-4624-A647-98A506CEE048}" = GoGear Mix Device Manager
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1CC069FA-1A86-402E-9787-3F04E652C67A}" = HP Support Information
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{23BE4DF2-293D-4077-82F4-1FD8C269277C}" = TuneUp Utilities Language Pack (en-US)
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{2AD2DD70-27F7-4343-BB4E-DE50A32D854B}" = Windows Live Messenger
"{2B7E4354-0492-460A-BDB1-1F59EE141025}" = AirPlus G
"{2C33926E-9468-A9DD-0739-1708BF2A4070}" = Catalyst Control Center InstallProxy
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{3889988F-762B-4B85-AB17-71C9CC3AE445}" = Messenger Companion
"{3A09ED0F-8DDF-47BB-B53D-841AB9D1D3A7}" = Complemento Messenger
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials
"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources
"{47F36D92-E58E-456D-B73C-3382737E4C42}" = HP Update
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79F86C69-2B17-4368-9234-472A23639E16}" = Ad-Aware
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{85B39C57-D7DA-4944-A6AB-F26894188B6B}" = GoGear Mix Device Manager
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{95A747E0-DF19-46CB-A622-20A0107201BD}" = HP Total Care Setup
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{99BEB67F-B288-44F5-8B2A-23F5F522A1AE}_is1" = Universal Anticheat 2 v2.42
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9CC89170-000B-457D-91F1-53691F85B223}" = Python 2.6.1
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail
"{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A589DA26-51BD-475D-8C32-E19E34145842}" = Camtasia Studio 6
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1046-7B44-A94000000001}" = Adobe Reader 9.4.3 - Português
"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C260343B-6282-42A2-939F-1FF7E503F608}" = Wolfram Notebook Indexer 2.0
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC29B835-95A5-3CD9-087B-F94D7B9ECC9B}" = Catalyst Control Center InstallProxy
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D54A52A8-DF24-4CE8-850B-074CA47DFA74}" = Windows Live Messenger
"{D722CF4B-4B06-BF11-FDEA-BD1B319FEA57}" = muvee Reveal
"{D7A1C3CB-1F27-4EAA-98DF-D266CA6B67D3}" = Microsoft Works
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1591139-8B44-411B-A81B-D35F83A0565A}" = HP Customer Experience Enhancements
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"12345_is1" = WeGame Client Public Beta 2.0
"Actual Transparent Windows_is1" = Actual Transparent Window 3.8
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Cool's_Codec_pack_4.12" = Codec Pack - All In 1 6.0.3.0
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FileBox eXtender" = FileBox eXtender
"FileZilla Client" = FileZilla Client 3.3.5.1
"HijackThis" = HijackThis 2.0.2
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"mIRC" = mIRC
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"Opera 11.10.2092" = Opera 11.10
"PunkBusterSvc" = PunkBuster Services
"Steam App 10" = Counter-Strike
"Steam App 10690" = Virtua Tennis 2009
"Steam App 7940" = Call of Duty 4: Modern Warfare
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"Veetle TV" = Veetle TV 0.9.18
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = Arquivo do WinRAR
"Xfire" = Xfire (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12-05-2011 18:31:17 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha firefox.exe, versão 1.9.2.4127, carimbo de data/hora
0x4daf6302, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x16e8,
hora de início da aplicação 0x01cc10f44ec50401.

Error - 12-05-2011 18:39:27 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha RealPlay.exe, versão 12.0.0.301, carimbo de data/hora
0x4a9ded49, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x1fec,
hora de início da aplicação 0x01cc10f57308cf31.

Error - 12-05-2011 18:40:07 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha avgcmgr.exe, versão 10.0.0.1160, carimbo de data/hora
0x4cc0f41e, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x4724,
hora de início da aplicação 0x01cc10f58ae21851.

Error - 12-05-2011 18:48:38 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha DivXsm.exe, versão 0.0.0.0, carimbo de data/hora
0x4383deef, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x29c0,
hora de início da aplicação 0x01cc10f6bbccdf31.

Error - 12-05-2011 18:52:50 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha msiexec.exe, versão 4.5.6002.18005, carimbo de
data/hora 0x49e01c42, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora
0x00000000, código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo
0x3aac, hora de início da aplicação 0x01cc10f751fb1991.

Error - 12-05-2011 18:52:59 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha steam.exe, versão 1.0.968.628, carimbo de data/hora
0x4cda0db5, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x3a50,
hora de início da aplicação 0x01cc10f7577a4bc1.

Error - 12-05-2011 19:39:42 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha DivXsm.exe, versão 0.0.0.0, carimbo de data/hora
0x4383deef, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x7542a57d, ID do processo 0x22fc4,
hora de início da aplicação 0x01cc10fddd98f481.

Error - 12-05-2011 19:46:45 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha wmplayer.exe, versão 11.0.6002.18311, carimbo de
data/hora 0x4c8e2d72, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora
0x00000000, código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo
0x240d0, hora de início da aplicação 0x01cc10fed9f4af31.

Error - 12-05-2011 19:54:21 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha RarExtLoader.exe, versão 0.0.0.0, carimbo de data/hora
0x4a242929, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x2e770,
hora de início da aplicação 0x01cc10ffe9293e21.

Error - 12-05-2011 19:54:23 | Computer Name = Trinca-na-pêra | Source = Application Error | ID = 1000
Description = Aplicação em falha wermgr.exe, versão 6.0.6001.18000, carimbo de data/hora
0x47918ca1, módulo em falha unknown, versão 0.0.0.0, carimbo de data/hora 0x00000000,
código de excepção 0xc0000005, desvio da falha 0x771b442a, ID do processo 0x2e828,
hora de início da aplicação 0x01cc10ffeaa49381.

[ System Events ]
Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7001
Description =

Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7000
Description =

Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7009
Description =

Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7000
Description =

Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7009
Description =

Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7000
Description =

Error - 23-05-2011 13:05:40 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7026
Description =

Error - 23-05-2011 14:02:54 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7001
Description =

Error - 23-05-2011 14:02:54 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7000
Description =

Error - 23-05-2011 14:02:54 | Computer Name = Trinca-na-pêra | Source = Service Control Manager | ID = 7026
Description =

< End of report >

SuperDave · « **Reply #6 on:** May 23, 2011, 05:01:19 PM »

The log shows that you only have 14.05% free space on your C drive. Windows requires 15% or more to function properly. You should keep an eye on this to make sure it doesn't drop any further or you could have problems like the one you're presently experiencing. You could transfer important documents, files, pictures, movies and music to one of your other drives.

* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

Code: [Select]

:OTL
IE - HKCU\..\URLSearchHook: {e0301295-ab3e-4af3-979f-3d453c5f9f48} - Reg Error: Key error. File not found
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\MyWebSearch\bar\3.bin

:folders -- this is the command for deleting folders.
C:\Program Files (x86)\MyWebSearch

:COMMANDS
[resethosts]
[purity]
[emptytemp]
[start explorer]

* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
*********************************************************
This next tool may not work with AVG on your computer. If you receive this message, please let me know and we'll do a work-around.

Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.

link # 1
Link # 2
If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Right-click combofix.exe and select Run as Administrator and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix login your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

Rebs · « **Reply #7 on:** May 23, 2011, 06:55:20 PM »

Thanks again for the answer.

I've been meaning to clean up the PC. Actually, before I even read your last reply I was doing just that. It should be fine now, the disk has over 30% free space.

OTC log:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{e0301295-ab3e-4af3-979f-3d453c5f9f48} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0301295-ab3e-4af3-979f-3d453c5f9f48}\ not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected] deleted successfully.
File C:\Program Files (x86)\MyWebSearch\bar\3.bin not found.
Error: Unable to interpret <:folders -- this is the command for deleting folders.> in the current context!
Error: Unable to interpret <C:\Program Files (x86)\MyWebSearch> in the current context!
========== COMMANDS ==========
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: AppData

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: HP
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 33572 bytes
->Java cache emptied: 1425920 bytes

User: HP(23)
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Public

User: Ramiro
->Temp folder emptied: 54447166 bytes
->Temporary Internet Files folder emptied: 295046 bytes
->Java cache emptied: 87818689 bytes
->FireFox cache emptied: 85165060 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 7351 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 1345856 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1665098 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33237 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 222,00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 05242011_005640

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\1FAF.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\59F1.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SET886C.tmp scheduled to be moved on reboot.
File\Folder C:\Windows\SysNative\uxt3BB8.tmp not found!

Registry entries deleted on Reboot...

---

I can't RUN Combofix. As soon as I try to run it, it gets around 15 programs to stop working, i.e.

grep.cfxxe stopped working
NirCmd stopped working
pev.exe stopped working
Console IME stopped working
FireFox.exe stopped working
hidec.exe stopped working
Freeware implememntation of REG.EXE stopped working

etc.

(these aren't even supose to be running processes)

SuperDave · « **Reply #8 on:** May 24, 2011, 12:51:56 PM »

P2P - I see you have P2P software installed on your machine (uTorrent). We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
**************************************************
Sorry. I made an error with the script. Please run this again

Download OTL to your desktop.

* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

Code: [Select]

:OTL
:folders 
C:\Program Files (x86)\MyWebSearch

:COMMANDS
[resethosts]
[purity]
[emptytemp]
[start explorer]

* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
**************************************************************
Please try this to get ComboFix to run.

Delete your copy of ComboFix; download a fresh copy, except before you download it, rename it to blackpudding.bat

Navigate to Start --> Run, and enter the following command exactly as shown:

"%userprofile%\desktop\blackpudding.bat" /killall

See if ComboFix will run now

Rebs · « **Reply #9 on:** May 24, 2011, 02:57:18 PM »

I've used uTorrent like two times total and it's been removed from my HD for more than a week now afaik.

Anyway, I got a couple of blue screens while doing this, first one when coming back from reboot after OTL, second one was with ComboFix, which made me lose the log for OTL.

So I'll just start over from OTL.

OTL log:

All processes killed
========== OTL ==========
Error: Unable to interpret <:folders> in the current context!
Error: Unable to interpret <C:\Program Files (x86)\MyWebSearch> in the current context!
========== COMMANDS ==========
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: AppData

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: HP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes

User: HP(23)
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Ramiro
->Temp folder emptied: 2039998 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 20652346 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 1309696 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11442 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 23,00 mb

OTL by OldTimer - Version 3.2.23.0 log created on 05242011_220000

Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\1FAF.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\59F1.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SET886C.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

----

I'll edit this post in a few minutes with ComboFix log.

Rebs · « **Reply #10 on:** May 24, 2011, 03:51:40 PM »

Combo Fix Log

ComboFix 11-05-24.01 - Ramiro 24-05-2011 22:14:06.1.4 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.351.2070.18.5118.3305 [GMT 1:00]
Executando de: c:\users\Ramiro\Desktop\blackpudding.bat.exe
Comandos utilizados :: /killall
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Ramiro\AppData\Roaming\chrtmp
.
.
(((((((((((((((( Arquivos/Ficheiros criados de 2011-04-24 to 2011-05-24 ))))))))))))))))))))))))))))
.
.
2011-05-24 21:33 . 2011-05-24 21:46   --------   d-----w-   c:\users\Ramiro\AppData\Local\temp
2011-05-24 21:33 . 2011-05-24 21:33   --------   d-----w-   c:\users\HP\AppData\Local\temp
2011-05-24 21:33 . 2011-05-24 21:33   --------   d-----w-   c:\users\HP(23)\AppData\Local\temp
2011-05-24 21:33 . 2011-05-24 21:33   --------   d-----w-   c:\users\Default\AppData\Local\temp
2011-05-24 20:47 . 2011-05-24 21:08   --------   d-----w-   C:\32788R22FWJFW
2011-05-24 15:35 . 2011-05-10 12:10   253888   ----a-w-   c:\windows\system32\aswBoot.exe
2011-05-24 13:47 . 2011-05-24 15:35   --------   d-----w-   C:\323c8cf74f4e74d64f240e
2011-05-24 01:41 . 2011-02-23 16:04   18232   ----a-w-   c:\windows\system32\drivers\SmartDefragDriver.sys
2011-05-24 01:41 . 2011-02-23 15:50   32648   ----a-w-   c:\windows\system32\SmartDefragBootTime.exe
2011-05-24 01:41 . 2011-05-24 01:41   --------   d-----w-   c:\users\Ramiro\AppData\Roaming\IObit
2011-05-24 01:40 . 2011-05-24 01:40   --------   d-----w-   c:\program files (x86)\IObit
2011-05-23 23:56 . 2011-05-23 23:56   --------   d-----w-   C:\_OTL
2011-05-23 21:28 . 2011-05-24 13:45   --------   d-----w-   c:\program files (x86)\SpeedFan
2011-05-23 08:41 . 2011-05-24 21:07   --------   d-----w-   c:\programdata\AVAST Software
2011-05-23 08:41 . 2011-05-24 13:47   --------   d-----w-   c:\program files\AVAST Software
2011-05-23 07:54 . 2011-05-18 11:37   8718160   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{29DA49A7-2CEB-458C-9088-E8E92338D65E}\mpengine.dll
2011-05-22 18:43 . 2011-05-22 18:50   --------   d-----w-   c:\users\Ramiro\AppData\Roaming\Pixel Studio Pro
2011-05-22 18:43 . 2011-05-22 18:43   --------   d-----w-   c:\program files (x86)\Pixel
2011-05-22 03:02 . 2011-05-22 03:02   --------   d-----w-   c:\users\Ramiro\AppData\Roaming\SUPERAntiSpyware.com
2011-05-22 03:02 . 2011-05-22 03:02   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2011-05-22 03:02 . 2011-05-22 03:02   --------   d-----w-   c:\programdata\!SASCORE
2011-05-22 03:02 . 2011-05-24 00:38   --------   d-----w-   c:\program files\SUPERAntiSpyware
2011-05-22 01:09 . 2011-05-22 01:09   --------   d-----w-   c:\program files (x86)\Trend Micro
2011-05-21 22:17 . 2011-05-21 22:18   --------   d-----w-   c:\users\Ramiro\AppData\Local\{2BAF77D5-4390-44F8-B5FF-3242B7325071}
2011-05-20 09:15 . 2011-05-20 21:16   --------   d-----w-   c:\users\Ramiro\AppData\Local\{61B20B5E-A996-4820-8FEE-F7CC5D9ECD5E}
2011-05-20 09:15 . 2011-05-20 09:15   --------   d-----w-   c:\users\Ramiro\AppData\Local\{0C2C9ED8-28E8-46F9-AC52-D8E93503476C}
2011-05-19 22:16 . 2011-05-19 22:16   --------   d-----w-   c:\program files (x86)\Codec Pack - All In 1
2011-05-19 19:07 . 2011-05-19 19:08   --------   d-----w-   c:\users\Ramiro\AppData\Local\{1007B654-7E70-4F19-BACA-DC20F98A555F}
2011-05-19 03:34 . 2011-05-19 03:35   --------   d-----w-   c:\users\Ramiro\AppData\Local\{8377A6F3-1694-45DC-B476-97567D2D5F58}
2011-05-18 15:34 . 2011-05-18 15:34   --------   d-----w-   c:\users\Ramiro\AppData\Local\{AD488AED-95FE-4A07-9DF4-B91644C3A906}
2011-05-15 09:41 . 2011-05-19 01:12   --------   d-----w-   c:\users\Ramiro\AppData\Roaming\.minecraft
2011-05-14 21:27 . 2011-05-14 21:28   --------   d-----w-   c:\users\Ramiro\AppData\Local\{EC408EBE-FF1E-411B-94ED-D6E315A89AC2}
2011-05-13 13:38 . 2010-04-06 08:34   345984   ----a-w-   c:\windows\system32\drivers\netio.sys
2011-05-13 11:13 . 2011-05-13 11:13   --------   d-----w-   c:\users\Ramiro\AppData\Roaming\Malwarebytes
2011-05-13 11:12 . 2011-05-13 11:12   --------   d-----w-   c:\programdata\Malwarebytes
2011-05-13 11:12 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-13 11:12 . 2011-05-22 17:15   --------   d-----w-   c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-13 11:12 . 2010-12-20 17:08   24152   ----a-w-   c:\windows\system32\drivers\mbam.sys
2011-05-10 19:26 . 2011-04-07 12:02   2409784   ----a-w-   c:\program files\Windows Mail\OESpamFilter.dat
2011-05-10 19:26 . 2011-04-07 12:01   2409784   ----a-w-   c:\program files (x86)\Windows Mail\OESpamFilter.dat
2011-04-30 05:26 . 2011-04-30 04:53   16432   ----a-w-   c:\windows\system32\lsdelete.exe
2011-04-30 04:51 . 2011-04-30 04:51   --------   d-----w-   c:\program files (x86)\Lavasoft
2011-04-30 04:51 . 2011-04-30 04:51   --------   d-----w-   c:\programdata\Lavasoft
2011-04-27 13:17 . 2011-04-27 13:17   --------   d-----w-   c:\users\Ramiro\AppData\Local\Apps
2011-04-27 09:52 . 2011-03-12 22:52   1653760   ----a-w-   c:\windows\system32\XpsPrint.dll
2011-04-27 09:52 . 2011-03-12 21:55   876032   ----a-w-   c:\windows\SysWow64\XpsPrint.dll
2011-04-27 09:51 . 2011-03-03 15:59   32256   ----a-w-   c:\windows\system32\Apphlpdm.dll
2011-04-27 09:51 . 2011-03-03 15:40   28672   ----a-w-   c:\windows\SysWow64\Apphlpdm.dll
2011-04-27 09:51 . 2011-03-03 14:00   4240384   ----a-w-   c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-27 09:51 . 2011-03-03 13:35   4240384   ----a-w-   c:\windows\SysWow64\GameUXLegacyGDFs.dll
2011-04-26 19:07 . 2011-04-26 19:07   --------   d-----w-   c:\users\Ramiro\AppData\Local\{912FB8D9-FACD-4A2A-AC41-7F433EF10046}
2011-04-26 00:21 . 2011-04-26 00:21   --------   d-----w-   c:\users\Ramiro\AppData\Local\{593A1866-40EB-4659-AE93-ECB6BF217821}
.
.
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-19 22:15 . 2009-09-15 22:35   737280   ----a-w-   c:\windows\iun6002.exe
2011-03-10 17:18 . 2011-04-13 10:54   1360384   ----a-w-   c:\windows\system32\mfc42u.dll
2011-03-10 17:18 . 2011-04-13 10:54   1398784   ----a-w-   c:\windows\system32\mfc42.dll
2011-03-10 17:03 . 2011-04-13 10:54   1162240   ----a-w-   c:\windows\SysWow64\mfc42u.dll
2011-03-10 17:03 . 2011-04-13 10:54   1136640   ----a-w-   c:\windows\SysWow64\mfc42.dll
2011-03-09 21:10 . 2010-06-24 11:33   18328   ----a-w-   c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-03 16:02 . 2011-04-13 10:55   975872   ----a-w-   c:\windows\system32\inetcomm.dll
2011-03-03 15:59 . 2011-04-27 09:51   100352   ----a-w-   c:\windows\apppatch\AppPatch64\acspecfc.dll
2011-03-03 15:59 . 2011-04-27 09:51   331776   ----a-w-   c:\windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 15:59 . 2011-04-27 09:51   284672   ----a-w-   c:\windows\apppatch\AppPatch64\AcGenral.dll
2011-03-03 15:42 . 2011-04-13 10:55   739328   ----a-w-   c:\windows\SysWow64\inetcomm.dll
2011-03-03 15:40 . 2011-04-27 09:51   173056   ----a-w-   c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-27 09:51   542720   ----a-w-   c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-27 09:51   458752   ----a-w-   c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-27 09:51   2159616   ----a-w-   c:\windows\apppatch\AcGenral.dll
2011-03-03 13:46 . 2011-04-13 10:54   2762240   ----a-w-   c:\windows\system32\win32k.sys
2011-03-02 16:12 . 2011-04-13 10:54   117760   ----a-w-   c:\windows\system32\dnsrslvr.dll
2011-02-26 10:07 . 2010-07-04 14:24   472808   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2011-02-24 16:38 . 2011-04-13 10:55   991104   ----a-w-   c:\windows\system32\winresume.efi
2011-02-24 16:38 . 2011-04-13 10:55   979840   ----a-w-   c:\windows\system32\winresume.exe
2011-02-24 16:37 . 2011-04-13 10:55   1076608   ----a-w-   c:\windows\system32\winload.efi
2011-02-24 16:37 . 2011-04-13 10:55   1063296   ----a-w-   c:\windows\system32\winload.exe
2011-02-24 16:37 . 2011-04-13 10:55   20864   ----a-w-   c:\windows\system32\kdusb.dll
2011-02-24 16:37 . 2011-04-13 10:55   18816   ----a-w-   c:\windows\system32\kd1394.dll
2011-02-24 16:37 . 2011-04-13 10:55   17792   ----a-w-   c:\windows\system32\kdcom.dll
.
.
------- Sigcheck -------
.
[7] 2009-07-10 . 9235EC680D3DB17464B39C7C7DECB4DD . 301568 . . [6.0.6001.18287] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18287_none_28ff7f1fd585934f\shsvcs.dll
[7] 2009-07-10 . 3F6101365E6319171054ADD75788516C . 300032 . . [6.0.6000.21081] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6000.21081_none_279cb3aaf1823d60\shsvcs.dll
[7] 2009-07-10 . C2409C9B7C7E422E7680AE4E1738BFC8 . 302080 . . [6.0.6001.22467] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.22467_none_299ebda8ee92f85e\shsvcs.dll
[7] 2009-07-10 . F33C4D0B9EEFCDE346F8753DC4D6867F . 299520 . . [6.0.6000.16883] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6000.16883_none_27153f51d8629d02\shsvcs.dll
[7] 2009-07-10 . 00DD742B99B278429714DEE859A73DD0 . 302080 . . [6.0.6002.22169] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6002.22169_none_2b873024ebb78030\shsvcs.dll
[7] 2009-07-10 . 56793271ECDEDD350C5ADD305603E963 . 302080 . . [6.0.6002.18063] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6002.18063_none_2af7919dd29f485c\shsvcs.dll
[7] 2009-04-11 . 2AD15758174DCC7993FF3C00A955DD66 . 301568 . . [6.0.6002.18005] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6002.18005_none_2b3a71b9d26cd364\shsvcs.dll
[7] 2008-01-21 . EB3114330236CF030E8EDF62881BAF67 . 301568 . . [6.0.6001.18000] .. c:\windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_294ef8add54b0818\shsvcs.dll
[-] 2011-03-19 . 66CFDF478939DD6388858DE06F2CE14C . 302080 . . [6.0.6000.16386] .. c:\windows\system32\shsvcs.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"KBD"="c:\program files (x86)\Hewlett-Packard\KBD\KbdStub.EXE"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"TkBellExe"="c:\program files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH6.sys

R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\59F1.tmp

R3 PCD5SRVC{8AAF211B-043E02A9-05040000};PCD5SRVC{8AAF211B-043E02A9-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms [2008-11-04 25888]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys

R4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys

R4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys

R4 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys

S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys

S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-05-04 128384]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/04/17 17:05];c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl [2008-11-28 17:04 146928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 27648]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-05-16 2151128]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-04-30 17152]
.
.
--- =Outros Serviços/Drivers Na Memória ---
.
*NewlyCreated* - LAVASOFT_KERNEXPLORER
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Conteúdo da pasta 'Tarefas Agendadas'
.
2011-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1682711522-1043235145-2778782327-1002Core.job
- c:\users\Ramiro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-01 17:58]
.
2011-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1682711522-1043235145-2778782327-1002UA.job
- c:\users\Ramiro\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-01 17:58]
.
2011-05-17 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-11-05 18:26]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Scan Suplementar -------
.
uStart Page = hxxp://g.live.com/1rewlive4startup/home
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.duxet.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Ramiro\AppData\Roaming\Mozilla\Firefox\Profiles\nfxw56s1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
FF - prefs.js: browser.startup.homepage - hxxp://g.live.com/1rewlive4startup/home
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVfox000&ptb=v7vjs4NH3LOYKt6.2Gqdsw&ind=2010110605&ptnrS=ZVfox000&si=&n=77cfda8d&psa=&st=kwd&searchfor=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Firefox Stats: [email protected] - %profile%\extensions\[email protected]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Mega Manager Integration: {40a1f5d7-afc2-498f-b264-02668d616ff6} - %profile%\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORFÃOS REMOVIDOS - - - -
.
WebBrowser-{E0301295-AB3E-4AF3-979F-3D453C5F9F48} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\59F1.tmp"
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PCD5SRVC{8AAF211B-043E02A9-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms"
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@SACL=
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
@SACL=
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@SACL=
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@SACL=
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Control]
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage]
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories]
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@SACL=
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@SACL=
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable]
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@SACL=
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@SACL=
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@SACL=
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@SACL=
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Control]
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@SACL=
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Programmable]
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@SACL=
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@SACL=
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@SACL=
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@SACL=
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid]
@Denied: (A 2) (Everyone)
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@SACL=
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@SACL=
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@SACL=
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@SACL=
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@SACL=
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@SACL=
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Outros Processos em Execução ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
c:\program files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Tempo para conclusão: 2011-05-24 22:50:38 - Máquina reiniciou
ComboFix-quarantined-files.txt 2011-05-24 21:50
.
Pré-execução: 258.234.142.720 bytes livres
Pós execução: 256.608.624.640 bytes livres
.
- - End Of File - - 549354A5C2E464EE73DC040B6EE85149

SuperDave · « **Reply #11 on:** May 24, 2011, 04:46:46 PM »

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select the following items.

Process << Selected
Kernel Modules << Selected
SSDT << Selected
Kernel Hooks << Selected
IRP Hooks << NOT Selected
Ports << NOT Selected
Hidden Files << Selected

At the bottom of the page

Hidden Objects Only << Selected

Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

Rebs · « **Reply #12 on:** May 24, 2011, 05:09:09 PM »

I get some error while creating the Sysprot log (I can open it anyway). It says 'Failed to start service. Sysprot Antirootkit needs to be run with Admin Privileges!'. The same message shows even when I run the exe as an administrator.

I can still get to the next phase, the log is created, but after choosing to scan root drive the program just doesn't seem to be doing anything.. I'm not sure if it's actually scanning or not.

Rebs · « **Reply #13 on:** May 24, 2011, 05:15:41 PM »

Oh yeah, I think it's because the program doesn't support Vista 64-bit

SuperDave · « **Reply #14 on:** May 24, 2011, 05:45:05 PM »

Quote

Oh yeah, I think it's because the program doesn't support Vista 64-bit

Sorry. I missed that. Try this one.

Please download Rooter and Save it to your desktop.

Double click it to start the tool.Vista and Windows7 run as administrator.
Click Scan.
Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.

Computer Hope Forum

News:

Author Topic: Programs closing down randomly (Vista) (Read 18658 times)

Rebs

Programs closing down randomly (Vista)

SuperDave

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

SuperDave

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

SuperDave

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

SuperDave

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

SuperDave

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

Rebs

Re: Programs closing down randomly (Vista)

SuperDave

Re: Programs closing down randomly (Vista)