Ir para conteúdo

Foto

Páginas que abrem sozinhas


Este tópico foi arquivado. Isto significa que você não pode mais responder ao tópico.
11 respostas neste tópico

#1
nicole25

nicole25

    Novato

  • Membro
  • Pip
  • 6 posts
Boa tarde,

Tenho um netbook Asus e de uns tempos pra cá tanto no chrome quanto no explorer abrem uma páginas de publicidade sozinhas. O problema já tinha aparecido antes e usei o AntiSpyware, mas agora as páginas voltaram a abrir e mesmo escaneando com esse programa elas persistem.

Log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:55:59, on 26/11/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Windows\AsScrPro.exe
C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Device Center\itype.exe
C:\Program Files\Microsoft Device Center\ipoint.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Real\RealPlayer\Update\realsched.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Users\Nicole\Downloads\HijackThis.exe
C:\windows\system32\wuauclt.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Nicole\AppData\Local\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmood...D&cr=1693381917
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmood...D&cr=1693381917
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylo....19&affID=17159
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - (no file)
O2 - BHO: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~1\Funmoods\1.5.23.22\bh\escort.dll (file missing)
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: TutorialsBHO - {DDC198F3-88BB-431f-987C-F6E8760C9163} - C:\Program Files\Tuto4pc\TutoriaisSlimbaBHO.dll
O3 - Toolbar: (no name) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - (no file)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ETDWare] %ProgramFiles%\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\windows\AsScrPro.exe
O4 - HKLM\..\Run: [EeeSplendidAgent] C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe
O4 - HKLM\..\Run: [HotkeyMon] AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
O4 - HKLM\..\Run: [HotkeyService] AsusSender.exe C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
O4 - HKLM\..\Run: [SuperHybridEngine] AsusSender.exe C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
O4 - HKLM\..\Run: [LiveUpdate] AsusSender.exe C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe auto
O4 - HKLM\..\Run: [CapsHook] AsusSender.exe C:\Program Files\EeePC\CapsHook\CapsHook.exe
O4 - HKLM\..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe autorun
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [OOBESetup] C:\Program Files\asus\OOBERegBackup\OOBERegBackup.exe /restore -"C:\Program Files\asus\OOBERegBackup\OOBEReg.ini"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [ASUSPRP] C:\Program Files\ASUS\APRP\APRP.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [tutoriaisup] "C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelliType Pro] "c:\Program Files\Microsoft Device Center\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft Device Center\ipoint.exe"
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "c:\program files\real\realplayer\Update\realsched.exe" -osboot
O4 - HKCU\..\Run: [Google Update] "C:\Users\Nicole\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Nicole\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Asus Launcher Service (AsusService) - Unknown owner - C:\Windows\System32\AsusService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: majt4pcbrslmba - Unknown owner - C:\Users\Nicole\AppData\Local\majt4pcbrslmba\majt4pcbrslmba.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 11589 bytes

#2
GiovaneMartins

GiovaneMartins

    Geek

  • Membro
  • PipPipPipPip
  • 2.058 posts
Olá,

Meu nome é Giovane Martins, e vou acompanhar seu caso. Assim que minha resposta for conferida, lhe passarei as instruções necessárias.

Inicialmente, observe o seguinte:
  • Não inicie um novo tópico sobre esse problema. Responda sempre este tópico.
  • Não use ferramentas por conta própria, nem siga outras instruções senão as passadas nesse tópico.
  • Clique em Seguir este tópico (no canto superior direito do post principal), e na janela que surgir, deixe marcada a caixa ao lado de Imediatamente, em "Receber Notificações". Isso permitirá que você receba uma notificação por e-mail quando o tópico for respondido.

    Você também pode usar a opção Conteúdo que Sigo, localizada no seu perfil.
  • A análise pode levar algum tempo, então seja paciente.
  • As instruções são específicas para seu computador, e devem ser seguidas somente nele.
  • Evite utilizar as tags <QUOTE> ou <CODE> nos logs, pois isso dificulta na análise do mesmo.
  • Se algo der errado, não importa. Sempre acompanhe seu tópico, informando-me dos resultados, até que seu computador esteja limpo.
  • Por favor, não abandone seu tópico. É importante para nós saber se a remoção ocorreu com sucesso ou não.
  • Mesmo que seu problema seja resolvido durante o tópico, aguarde até que eu diga que os logs estão limpos.
  • Caso não haja uma resposta em até 5 dias, envie-me uma MP.

:legal:
[Linha Defensiva no Twitter] [Linha Defensiva no Facebook]

Imagem Postada
Retribua a nossa ajuda não abandonando seu tópico. Obrigado.
Blog do Giovane | Twitter - @giovane_vaz

#3
GiovaneMartins

GiovaneMartins

    Geek

  • Membro
  • PipPipPipPip
  • 2.058 posts
Olá,

Por favor, siga os passos abaixo:

1)

Faça o download do AdwCleaner e salve no desktop.

http://general-chang...de/2-adwcleaner

Clique no ícone Imagem Postada para baixar o arquivo.

Execute o adwcleaner.exe.

OBS: Usuários do Windows Vista ou Windows 7 clique com o direito sobre o arquivo AdwCleaner.exe, depois clique em Imagem Postada.

Clique em Delete.

Será aberto o bloco de notas com o resultado. Selecione, copie e cole o seu conteúdo na próxima resposta.

2)

Baixe o Malwarebytes' Anti-Malware (MBAM)
http://download.cnet...4-10804572.html

Dê um duplo-clique no mbam-setup.exe, escolha a linguagem e na instalação, aceite todas as opções padrão.
  • Verifique se as caixas Atualizar Malwarebytes Anti-Malware e Executar Malwarebytes Anti-Malware estão marcadas e clique então, em Concluir.
  • Se houver atualizações a serem feitas, serão baixadas e instaladas.
  • Ao final da atualização, com o programa aberto, marque Verificação Completa e clique no botão Verificar.
  • Começará então o exame. Aguarde, pois pode demorar.
  • Ao acabar o exame, clique em OK, depois no botão Mostrar Resultados para ver o relatório.
  • Se houver ítens encontrados, certifique-se de que, estão todos marcados e clique no botão Remover.
  • Ao final da desinfecção, abrirá o Bloco de notas com um log e poderá aparecer um aviso se quer reiniciar o PC. (Ver Nota abaixo)
  • O log é automaticamente salvo pelo MBAM e para vê-lo, clique na aba Logs na janela principal do programa.
  • Selecione, copie e cole todo o conteúdo deste log na sua próxima resposta.
NOTA: Se o MBAM encontrar arquivos que não consiga remover, poderá ter de reiniciar o PC (talvez mais de uma vez). Faça isso imediatamente, ao ser perguntado se quer reiniciar o PC.

Em caso de dúvidas, leia o tutorial do programa:
http://linhadefensiv...showtopic=75554

3)

Faça o download do OTL by OldTimer, e salve na sua área de trabalho:
http://oldtimer.geekstogo.com/OTL.exe

** Usuários do Windows Vista e Windows 7:
Clique com o botão direito do mouse sobre o OTL.exe e depois em Executar como Administrador.

Onde diz Saída, marque Padrão
Marque também estas opções:
  • Ignorar Arquivos Microsoft
  • Verificar Lop
  • Verificar Purity
Selecione estas linhas em vermelho, clique com o direito sobre a seleção, e escolha a opção copiar

%SYSTEMDRIVE%\*.*
%systemdrive%\drivers\*.exe
%systemroot%\system32\drivers\*.* /90
%PROGRAMFILES%\*.*
%LOCALAPPDATA%\*.exe
%LOCALAPPDATA%\*.txt
%LOCALAPPDATA%\*.ini
%LOCALAPPDATA%\*.dll
%LOCALAPPDATA%\*.dat
%USERPROFILE%\*.exe
%USERPROFILE%\*.txt
%USERPROFILE%\*.ini
%USERPROFILE%\*.dll
%USERPROFILE%\*.dat /30
%appdata%\*.*
%systemroot%\system32\tasks\*.*
%windir%\tasks\*.*
CREATERESTOREPOINT
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run /s
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMP
HKCU\Software\Microsoft\Internet Explorer\Downloads
/md5start
services.*
/md5stop


Volte ao programa, clique com o direito em qualquer parte branca da sessão Exames Personalizados/Correções e escolha colar

Clique no botão Imagem Postada

O OTL começará a examinar seu computador. Não interrompa o processo e nem use outras janelas até que ele termine.

Não modifique nenhuma outra configuração, a menos que tenha sido orientado (a) a fazer isso.

O exame demora um pouco, tenha paciência.

Quando terminar, dois blocos de notas serão exibidos: OTL.txt e Extras.txt
Ambos ficarão salvos dentro do mesmo diretório onde está o OTL.exe, ou seja, na sua área de trabalho.

Compacte os arquivos com o WinZip ou WinRar, e Anexe-os <-link na sua próxima resposta.
[Linha Defensiva no Twitter] [Linha Defensiva no Facebook]

Imagem Postada
Retribua a nossa ajuda não abandonando seu tópico. Obrigado.
Blog do Giovane | Twitter - @giovane_vaz

#4
nicole25

nicole25

    Novato

  • Membro
  • Pip
  • 6 posts
Oi

Usei o Malwarebytes Anti-Malware e segui o procedimento

O log:


Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Versão da Base de Dados: v2012.10.30.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Nicole :: NICOLE25 [administrador]

Proteção: Permitir

30/10/2012 20:37:22
mbam-log-2012-10-30 (20-37-22).txt

Tipo de Verificação: Verificação Completa (C:\|)
Opções de verificações ativadas: Memória | Inicialização | Registro | Sistema de arquivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opções de verificação desativadas: P2P
Objetos escaneados: 369505
Tempo decorrido: 4 hora(s), 42 minuto(s), 22 segundo(s)

Processos de Memória Detectados: 0
(Não foram detectados ítens maliciosos)

Módulos de Memória Detectados: 0
(Não foram detectados ítens maliciosos)

Chaves de Registro Detectadas: 31
HKCR\CLSID\{DDC198F3-88BB-431f-987C-F6E8760C9163} (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCR\Tuto4PCBrSolimbaBHO.TutorialsBHO.1 (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCR\Tuto4PCBrSolimbaBHO.TutorialsBHO (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DDC198F3-88BB-431F-987C-F6E8760C9163} (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{DDC198F3-88BB-431F-987C-F6E8760C9163} (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{DDC198F3-88BB-431F-987C-F6E8760C9163} (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCR\TypeLib\{F8C244B0-6506-445E-BD71-0E2379328C8A} (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCR\Interface\{34D66B09-089C-405A-B0F4-DDAC12A7E5AF} (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCR\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947} (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCR\Interface\{3718D0AF-A3B8-4F5E-86F3-FAD8D02043BE} (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCR\funmoods.funmoodsHlpr.1 (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCR\funmoods.funmoodsHlpr (PUP.FunMoods) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Nenhuma ação foi feita.
HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\escort.escortIEPane (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\f (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Nenhuma ação foi feita.
HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Tuto4pc (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1 (PUP.Tuto4PC) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Tuto4pc (Trojan.EORezo) -> Enviado para a Quarentena e deletado com sucesso.

Valores de Registro Detectadas: 3
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Nenhuma ação foi feita.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Tutorials (Adware.Eorezo) -> Data: "C:\Program Files\Tuto4pc\tutoriaisslimba.exe" -> Enviado para a Quarentena e deletado com sucesso.

Itens de Dados no Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Pastas Detectadas: 0
(Não foram detectados ítens maliciosos)

Arquivos Detectados: 8
C:\Program Files\Tuto4pc\TutoriaisSlimbaBHO.dll (PUP.Tuto4PC) -> Nenhuma ação foi feita.
C:\Users\Nicole\AppData\Roaming\Tuto4pc\Tuto4pc\UpdateTutoriaisSlimba.exe (PUP.Tuto4PC) -> Nenhuma ação foi feita.
C:\Users\Nicole\AppData\Local\funmoods.crx (PUP.Funmoods) -> Nenhuma ação foi feita.
C:\Users\Nicole\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> Nenhuma ação foi feita.
C:\Program Files\Tuto4pc\tutoriaisslimba.exe (Adware.Eorezo) -> Enviado para a Quarentena e deletado com sucesso.
C:\The Sims 3\1-The sims 3\Razor1911\The_Sims_3_Keygen.exe (Trojan.Downloader) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Nicole\Downloads\download.exe (Adware.Pcmega) -> Enviado para a Quarentena e deletado com sucesso.
C:\Windows\AutoKMS.exe (Riskware.Keygen) -> Enviado para a Quarentena e deletado com sucesso.

(fim)

Oi de novo !

Acabei de postar o log e abriu uma página de publicidade no chrome , assim:
http://scache.eorezo...3dafitibr8.html

Ela abriu após o computador ter reiniciado para remover os virus.

#5
GiovaneMartins

GiovaneMartins

    Geek

  • Membro
  • PipPipPipPip
  • 2.058 posts
Olá,

Faltou o log do AdwCleaner e os logs do OTL.

Quanto ao Malwarebytes, reparei que a maior parte dos arquivos não foi removido. Repita o processo com o programa, e no final certifique-se de marcar todos os arquivos detectados, clicando em seguida no botão Remover.

Poste o log novamente. :legal:
[Linha Defensiva no Twitter] [Linha Defensiva no Facebook]

Imagem Postada
Retribua a nossa ajuda não abandonando seu tópico. Obrigado.
Blog do Giovane | Twitter - @giovane_vaz

#6
nicole25

nicole25

    Novato

  • Membro
  • Pip
  • 6 posts
Boa tarde, usei todos os programas, mas meu problemas com as publicidades persiste.

Aqui estão os logs :

-Adw Cleaner:


# AdwCleaner v2.010 - Logfile created 12/01/2012 at 00:36:26
# Updated 29/11/2012 by Xplode
# Operating system : Windows 7 Starter Service Pack 1 (32 bits)
# User : Nicole - NICOLE25
# Boot Mode : Normal
# Running from : C:\Users\Nicole\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Users\Nicole\AppData\Local\funmoods-speeddial.crx
Folder Deleted : C:\Program Files\Tuto4pc
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tuto4pc
Folder Deleted : C:\Users\Nicole\AppData\Local\APN
Folder Deleted : C:\Users\Nicole\AppData\Local\Temp\AskSearch
Folder Deleted : C:\Users\Nicole\AppData\Local\Temp\OpenCandy
Folder Deleted : C:\Users\Nicole\AppData\Local\Tuto4pc
Folder Deleted : C:\Users\Nicole\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\Nicole\AppData\Roaming\Tuto4pc

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKCU\Software\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\funmoods.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\funmoods.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto Firefox_is1
Key Deleted : HKLM\Software\Tutorials
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=grupo&chnl=grupo&cd=2XzutAtN2Y1L1QzuyEzzyD0BtAzyyC0A0DzyyB0CzytByC0CtN0D0TzutBtDtCtBtDyBtCtD&cr=1693381917 --> hxxp://www.google.com
Deleted : [HKCU\Software\Microsoft\Internet Explorer\Main - Backup.Old.Start Page]
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=be37926c0000000000001a4bd6db376e&tlver=1.4.19.19&affID=17159 --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=grupo&chnl=grupo&cd=2XzutAtN2Y1L1QzuyEzzyD0BtAzyyC0A0DzyyB0CzytByC0CtN0D0TzutBtDtCtBtDyBtCtD&cr=1693381917 --> hxxp://www.google.com

-\\ Google Chrome v23.0.1271.95

File : C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.12] : homepage = "hxxp://start.funmoods.com/?f=1&a=grupo&chnl=grupo&cd=2XzutAtN2Y1L1QzuyEzzyD0BtAzy[...]
Deleted [l.1739] : homepage = "hxxp://start.funmoods.com/?f=1&a=grupo&chnl=grupo&cd=2XzutAtN2Y1L1QzuyEzzyD0BtAzyyC0[...]

*************************

AdwCleaner[R1].txt - [6152 octets] - [01/12/2012 00:32:54]
AdwCleaner[S2].txt - [5872 octets] - [01/12/2012 00:36:26]

########## EOF - C:\AdwCleaner[S2].txt - [5932 octets] ##########


-MBAM: Eu escaneei o pc de novo, e o programa disse que não haviam itens a serem removidos


Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Versão da Base de Dados: v2012.11.27.11

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Nicole :: NICOLE25 [administrador]

01/12/2012 00:42:50
mbam-log-2012-12-01 (00-42-50).txt

Tipo de Verificação: Verificação Completa (C:\|)
Opções de verificações ativadas: Memória | Inicialização | Registro | Sistema de arquivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opções de verificação desativadas: P2P
Objetos escaneados: 390744
Tempo decorrido: 3 hora(s), 27 minuto(s), 32 segundo(s)

Processos de Memória Detectados: 0
(Não foram detectados ítens maliciosos)

Módulos de Memória Detectados: 0
(Não foram detectados ítens maliciosos)

Chaves de Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Valores de Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Itens de Dados no Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Pastas Detectadas: 0
(Não foram detectados ítens maliciosos)

Arquivos Detectados: 0
(Não foram detectados ítens maliciosos)

(fim)

O post ficou muito longo, aqui estão os logs do OTL


-OTL :

OTL logfile created on: 12/1/2012 9:07:31 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nicole\Downloads
Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Brazil | Language: PTB | Date Format: dd/MM/yyyy

1014.18 Mb Total Physical Memory | 212.61 Mb Available Physical Memory | 20.96% Memory free
1.99 Gb Paging File | 0.60 Gb Available in Paging File | 30.01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 217.86 Gb Total Space | 12.87 Gb Free Space | 5.91% Space Free | Partition Type: NTFS

Computer Name: NICOLE25 | User Name: Nicole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/12/01 00:32:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Nicole\Downloads\OTL.exe
PRC - [2012/10/30 22:36:01 | 000,296,096 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2012/10/16 15:07:01 | 004,762,496 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/23 20:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/08/21 06:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 06:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/07/18 11:51:06 | 003,703,808 | ---- | M] () -- C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe
PRC - [2012/07/18 11:48:38 | 003,016,704 | ---- | M] () -- C:\Users\Nicole\AppData\Local\majt4pcbrslmba\majt4pcbrslmba.exe
PRC - [2012/07/11 16:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2012/06/26 22:36:58 | 001,629,280 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Device Center\ipoint.exe
PRC - [2012/06/26 22:36:58 | 001,109,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Device Center\itype.exe
PRC - [2012/04/04 06:25:00 | 000,295,584 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2011/02/25 03:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 10:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/04/29 15:51:17 | 003,058,304 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe
PRC - [2010/04/29 00:30:48 | 001,180,592 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
PRC - [2010/04/13 05:32:40 | 000,548,744 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrl.exe
PRC - [2010/04/07 03:16:52 | 001,599,880 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrlHelper.exe
PRC - [2010/03/29 21:29:36 | 000,415,920 | ---- | M] () -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
PRC - [2010/03/25 19:26:40 | 000,413,112 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
PRC - [2010/03/09 18:38:10 | 000,439,712 | ---- | M] (ASUS) -- C:\Program Files\EeePC\CapsHook\CapsHook.exe
PRC - [2010/02/23 08:47:04 | 001,024,368 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
PRC - [2010/02/23 08:46:18 | 000,735,968 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
PRC - [2010/01/29 16:18:52 | 000,751,592 | ---- | M] () -- C:\Program Files\ASUS\LiveUpdate\LiveUpdate.exe
PRC - [2009/09/11 16:41:02 | 000,100,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
PRC - [2009/08/18 22:35:56 | 000,219,136 | ---- | M] () -- C:\Windows\System32\AsusService.exe
PRC - [2009/06/05 00:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009/06/05 00:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe


========== Modules (No Company Name) ==========

MOD - [2012/11/28 01:43:17 | 000,460,904 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\ppgooglenaclpluginchrome.dll
MOD - [2012/11/28 01:43:15 | 004,008,040 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\pdf.dll
MOD - [2012/11/28 01:42:30 | 000,587,880 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\libglesv2.dll
MOD - [2012/11/28 01:42:29 | 000,124,520 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\libegl.dll
MOD - [2012/11/28 01:42:22 | 000,157,304 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\avutil-51.dll
MOD - [2012/11/28 01:42:21 | 002,168,952 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\avcodec-54.dll
MOD - [2012/11/28 01:42:21 | 000,275,576 | ---- | M] () -- C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\avformat-54.dll
MOD - [2012/11/13 12:34:57 | 014,586,808 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_5_502_110.dll
MOD - [2012/07/18 11:51:06 | 003,703,808 | ---- | M] () -- C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe
MOD - [2010/03/29 21:29:36 | 000,415,920 | ---- | M] () -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe


========== Services (SafeList) ==========

SRV - [2012/11/13 12:34:59 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/09/23 20:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/08/21 06:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/07/18 11:48:38 | 003,016,704 | ---- | M] () [Auto | Running] -- C:\Users\Nicole\AppData\Local\majt4pcbrslmba\majt4pcbrslmba.exe -- (majt4pcbrslmba)
SRV - [2012/07/13 14:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/07/11 16:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2010/02/23 09:19:44 | 000,689,416 | ---- | M] (Trend Micro Inc.) [On_Demand | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- (TmProxy)
SRV - [2010/02/23 09:19:44 | 000,345,352 | ---- | M] (Trend Micro Inc.) [On_Demand | Stopped] -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2010/02/23 09:19:18 | 000,497,008 | ---- | M] (Trend Micro Inc.) [On_Demand | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmPfw.exe -- (TmPfw)
SRV - [2010/02/23 08:46:18 | 000,735,968 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe -- (SfCtlCom)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/08/18 22:35:56 | 000,219,136 | ---- | M] () [Auto | Running] -- C:\Windows\System32\AsusService.exe -- (AsusService)
SRV - [2009/07/13 23:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/06/05 00:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbdev.sys -- (hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/08/21 06:13:15 | 000,729,752 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/08/21 06:13:15 | 000,355,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/08/21 06:13:15 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/08/21 06:13:14 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012/08/21 06:13:14 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012/08/21 06:13:13 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/07/22 14:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 19:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/06/27 02:37:12 | 002,191,872 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2011/05/13 04:21:06 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/05/13 04:21:06 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus)
DRV - [2011/05/13 04:21:06 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV - [2011/05/13 04:21:04 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb)
DRV - [2010/11/20 08:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 07:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/04/19 03:48:11 | 000,051,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2010/04/19 03:43:57 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2010/04/19 02:59:18 | 000,011,448 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AsUpIO.sys -- (AsUpIO)
DRV - [2010/02/23 09:57:30 | 000,158,224 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2010/02/23 09:57:30 | 000,089,872 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tmtdi.sys -- (tmtdi)
DRV - [2010/02/23 09:57:30 | 000,059,920 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tmactmon.sys -- (tmactmon)
DRV - [2010/02/23 09:57:30 | 000,050,704 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV - [2010/02/23 09:57:28 | 000,283,152 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tmwfp.sys -- (tmwfp)
DRV - [2010/02/23 09:57:28 | 000,146,448 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tmlwf.sys -- (tmlwf)
DRV - [2009/12/04 14:39:06 | 000,230,928 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmxpflt.sys -- (tmxpflt)
DRV - [2009/12/04 14:38:18 | 000,036,368 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmpreflt.sys -- (tmpreflt)
DRV - [2009/12/04 14:05:06 | 001,322,680 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vsapint.sys -- (vsapint)
DRV - [2009/07/13 21:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/13 21:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [1999/03/06 09:38:28 | 000,006,144 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASUSHWIO.SYS -- (asushwio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{018EC340-8CFE-AC38-3213-3B5EADFEC510}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmood...D&cr=1693381917

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://eeepc.asus.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,Backup.Old.DefaultScope = {F3794AF9-1D1C-4730-9376-A41721BE3E39}
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{018EC340-8CFE-AC38-3213-3B5EADFEC510}: "URL" = http://www.google.co...q={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{A050F2C4-40F4-453D-9339-E8F7CBF7DB8E}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{F3794AF9-1D1C-4730-9376-A41721BE3E39}: "URL" = http://start.funmood...D&cr=1693381917
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.5.109: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Nicole\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Nicole\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Nicole\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/10/30 22:44:48 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Users\Nicole\AppData\Local\Google\Chrome\Application\23.0.1271.95\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U24 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Nicole\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Nicole\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw_1165635.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: AT_DaleChihulyV3 = C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnenonhiffdmndmgiinmldkabciohign\3_2\
CHR - Extension: Pesquisa do Google = C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: avast! WebRep = C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Gmail = C:\Users\Nicole\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/06/10 19:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Facilitador de Leitor de Link Adobe PDF) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)
O4 - HKLM..\Run: [ASUSPRP] C:\Program Files\ASUS\APRP\aprp.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CapsHook] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()
O4 - HKLM..\Run: [EeeSplendidAgent] C:\Program Files\ASUS\EPC\EeeSplendid\AsAgent.exe File not found
O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4 - HKLM..\Run: [HotkeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Device Center\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Device Center\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LiveUpdate] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [OOBESetup] C:\Program Files\asus\OOBERegBackup\OOBERegBackup.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [tutoriaisup] C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe ()
O4 - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Nicole\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Enviar para o OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: E&xportar para o Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 200.222.122.134 200.165.132.155
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A3CD837-25F4-4864-897F-5488DA7450EE}: DhcpNameServer = 200.222.122.134 200.165.132.155
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 19:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d9a25252-46db-11e1-8bfb-485b396ad97c}\Shell - "" = AutoRun
O33 - MountPoints2\{d9a25252-46db-11e1-8bfb-485b396ad97c}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\Shell - "" = AutoRun
O33 - MountPoints2\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/11/27 21:37:21 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe
[2012/11/27 21:37:16 | 000,000,000 | ---D | C] -- C:\Users\Nicole\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/11/06 21:11:45 | 000,000,000 | ---D | C] -- C:\Users\Nicole\Desktop\a-Crack
[2012/11/05 20:23:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012/11/05 19:23:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ALM
[2012/11/05 18:59:21 | 000,000,000 | ---D | C] -- C:\Users\Nicole\Desktop\Adobe Application Manager 6.2
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/01 09:14:01 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/12/01 09:08:03 | 000,001,082 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000UA.job
[2012/12/01 07:27:06 | 000,001,078 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000UA.job
[2012/12/01 00:46:47 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/01 00:46:47 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/01 00:39:23 | 000,000,202 | ---- | M] () -- C:\windows\tasks\AutoKMS.job
[2012/12/01 00:39:12 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/12/01 00:39:04 | 797,581,312 | -HS- | M] () -- C:\hiberfil.sys
[2012/11/29 22:12:20 | 000,616,008 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/11/29 22:12:20 | 000,106,388 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/11/29 11:57:14 | 003,899,128 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/11/28 23:08:04 | 000,001,030 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000Core.job
[2012/11/28 19:52:54 | 000,063,179 | ---- | M] () -- C:\Users\Nicole\Desktop\folder rock on.jpg
[2012/11/28 19:52:14 | 000,187,505 | ---- | M] () -- C:\Users\Nicole\Desktop\folder rock on.pdf
[2012/11/28 19:27:07 | 000,001,056 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000Core.job
[2012/11/28 18:46:23 | 000,019,455 | ---- | M] () -- C:\Users\Nicole\Desktop\carta.pdf
[2012/11/13 12:34:58 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe
[2012/11/13 12:34:58 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl
[2012/11/07 22:57:10 | 000,071,563 | ---- | M] () -- C:\Users\Nicole\Desktop\Copa 2014.pdf
[2012/11/07 15:49:26 | 000,585,728 | ---- | M] () -- C:\Users\Nicole\Desktop\Copa 2014.indd
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/11/28 19:52:53 | 000,063,179 | ---- | C] () -- C:\Users\Nicole\Desktop\folder rock on.jpg
[2012/11/28 19:51:58 | 000,187,505 | ---- | C] () -- C:\Users\Nicole\Desktop\folder rock on.pdf
[2012/11/28 18:46:16 | 000,019,455 | ---- | C] () -- C:\Users\Nicole\Desktop\carta.pdf
[2012/11/27 12:14:19 | 000,000,003 | ---- | C] () -- C:\windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012/11/27 12:11:36 | 000,000,003 | ---- | C] () -- C:\windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012/11/08 12:57:37 | 000,071,563 | ---- | C] () -- C:\Users\Nicole\Desktop\Copa 2014.pdf
[2012/11/07 12:57:14 | 000,078,116 | R--- | C] () -- C:\Users\Nicole\HelveticaObl.ttf
[2012/11/07 12:57:14 | 000,065,576 | R--- | C] () -- C:\Users\Nicole\HelveticaOutBd.ttf
[2012/11/07 12:57:14 | 000,056,476 | R--- | C] () -- C:\Users\Nicole\HelveticaRdBdObl.ttf
[2012/11/07 12:57:14 | 000,050,884 | R--- | C] () -- C:\Users\Nicole\HelveticaObl___.ttf
[2012/11/07 12:57:14 | 000,050,364 | R--- | C] () -- C:\Users\Nicole\HelveticaNw___.ttf
[2012/11/07 12:57:14 | 000,050,160 | R--- | C] () -- C:\Users\Nicole\HelveticaRdBd.ttf
[2012/11/07 12:57:14 | 000,044,028 | R--- | C] () -- C:\Users\Nicole\HelveticaNwLefty.ttf
[2012/11/07 12:57:14 | 000,043,996 | R--- | C] () -- C:\Users\Nicole\HelveticaNwBdLefty.ttf
[2012/11/07 12:57:14 | 000,043,148 | R--- | C] () -- C:\Users\Nicole\HelveticaNeueIt.ttf
[2012/11/07 12:57:14 | 000,041,180 | R--- | C] () -- C:\Users\Nicole\HelveticaNeue.ttf
[2012/11/07 12:57:14 | 000,040,104 | R--- | C] () -- C:\Users\Nicole\HelveticaNeueLt.ttf
[2012/11/07 12:57:14 | 000,039,656 | R--- | C] () -- C:\Users\Nicole\HelveticaNeueMed.ttf
[2012/11/07 12:57:14 | 000,039,568 | R--- | C] () -- C:\Users\Nicole\HelveticaNeueHv.ttf
[2012/11/07 12:57:14 | 000,039,520 | R--- | C] () -- C:\Users\Nicole\HelveticaNeueBd.ttf
[2012/11/07 12:57:14 | 000,038,664 | ---- | C] () -- C:\Users\Nicole\HelveticaNeueCE-Black.otf
[2012/11/07 12:57:14 | 000,036,700 | R--- | C] () -- C:\Users\Nicole\HelveticaNeueOut.ttf
[2012/11/07 12:57:14 | 000,034,024 | R--- | C] () -- C:\Users\Nicole\HelveticaMonoObl.ttf
[2012/11/07 12:57:14 | 000,032,708 | R--- | C] () -- C:\Users\Nicole\HelveticaMonoBdObl.ttf
[2012/11/07 12:57:14 | 000,032,016 | R--- | C] () -- C:\Users\Nicole\helvetica-normal.ttf
[2012/11/07 12:57:14 | 000,031,680 | R--- | C] () -- C:\Users\Nicole\HelveticaMono.ttf
[2012/11/07 12:57:14 | 000,030,992 | R--- | C] () -- C:\Users\Nicole\HelveticaMonoBd.ttf
[2012/11/07 12:57:14 | 000,013,096 | R--- | C] () -- C:\Users\Nicole\HelveticaNwBdProfi.ttf
[2012/11/07 12:57:13 | 000,082,788 | R--- | C] () -- C:\Users\Nicole\HelveticaBlkHollow.ttf
[2012/11/07 12:57:13 | 000,074,356 | R--- | C] () -- C:\Users\Nicole\HelveticaMedIt.ttf
[2012/11/07 12:57:13 | 000,052,084 | R--- | C] () -- C:\Users\Nicole\HelveticaCdOblThn.ttf
[2012/11/07 12:57:13 | 000,051,612 | R--- | C] () -- C:\Users\Nicole\HelveticaBlkIt.ttf
[2012/11/07 12:57:13 | 000,046,836 | R--- | C] () -- C:\Users\Nicole\HelveticaCdBd.ttf
[2012/11/07 12:57:13 | 000,046,172 | R--- | C] () -- C:\Users\Nicole\HelveticaCdBdObl.ttf
[2012/11/07 12:57:13 | 000,046,056 | R--- | C] () -- C:\Users\Nicole\HelveticaCdLtObl.ttf
[2012/11/07 12:57:13 | 000,046,020 | R--- | C] () -- C:\Users\Nicole\HelveticaCdLt.ttf
[2012/11/07 12:57:13 | 000,044,912 | R--- | C] () -- C:\Users\Nicole\HelveticaCdBlk.ttf
[2012/11/07 12:57:13 | 000,044,528 | R--- | C] () -- C:\Users\Nicole\HelveticaCdObl.ttf
[2012/11/07 12:57:13 | 000,044,236 | R--- | C] () -- C:\Users\Nicole\HelveticaCdBlkObl.ttf
[2012/11/07 12:57:13 | 000,043,528 | R--- | C] () -- C:\Users\Nicole\HelveticaExtThn.ttf
[2012/11/07 12:57:13 | 000,043,492 | R--- | C] () -- C:\Users\Nicole\HelveticaCdThn.ttf
[2012/11/07 12:57:13 | 000,043,488 | R--- | C] () -- C:\Users\Nicole\HelveticaCd.ttf
[2012/11/07 12:57:13 | 000,043,356 | R--- | C] () -- C:\Users\Nicole\HelveticaExtMed.ttf
[2012/11/07 12:57:13 | 000,043,336 | R--- | C] () -- C:\Users\Nicole\HelveticaLtObl.ttf
[2012/11/07 12:57:13 | 000,042,964 | R--- | C] () -- C:\Users\Nicole\HelveticaBlk___-.ttf
[2012/11/07 12:57:13 | 000,042,840 | R--- | C] () -- C:\Users\Nicole\HelveticaExtLt.ttf
[2012/11/07 12:57:13 | 000,042,708 | R--- | C] () -- C:\Users\Nicole\HelveticaCdMed.ttf
[2012/11/07 12:57:13 | 000,042,688 | R--- | C] () -- C:\Users\Nicole\HelveticaCdHv.ttf
[2012/11/07 12:57:13 | 000,042,636 | R--- | C] () -- C:\Users\Nicole\HelveticaInserat.ttf
[2012/11/07 12:57:13 | 000,042,568 | R--- | C] () -- C:\Users\Nicole\HelveticaLt.ttf
[2012/11/07 12:57:13 | 000,042,500 | R--- | C] () -- C:\Users\Nicole\HelveticaCdHvObl.ttf
[2012/11/07 12:57:13 | 000,042,492 | R--- | C] () -- C:\Users\Nicole\HelveticaHv.ttf
[2012/11/07 12:57:13 | 000,042,380 | R--- | C] () -- C:\Users\Nicole\HelveticaMed.ttf
[2012/11/07 12:57:13 | 000,042,308 | R--- | C] () -- C:\Users\Nicole\HelveticaIt.ttf
[2012/11/07 12:57:13 | 000,042,292 | R--- | C] () -- C:\Users\Nicole\HelveticaExtBlk.ttf
[2012/11/07 12:57:13 | 000,042,060 | R--- | C] () -- C:\Users\Nicole\HelveticaExtHv.ttf
[2012/11/07 12:57:13 | 000,042,032 | R--- | C] () -- C:\Users\Nicole\HelveticaExt.ttf
[2012/11/07 12:57:13 | 000,041,948 | R--- | C] () -- C:\Users\Nicole\HelveticaExtBd.ttf
[2012/11/07 12:57:13 | 000,041,712 | R--- | C] () -- C:\Users\Nicole\HelveticaExComp.ttf
[2012/11/07 12:57:13 | 000,041,604 | R--- | C] () -- C:\Users\Nicole\HelveticaBlkObl.ttf
[2012/11/07 12:57:13 | 000,041,460 | R--- | C] () -- C:\Users\Nicole\HelveticaComp.ttf
[2012/11/07 12:57:13 | 000,040,968 | R--- | C] () -- C:\Users\Nicole\HelveticaMedExt.ttf
[2012/11/07 12:57:13 | 000,040,128 | R--- | C] () -- C:\Users\Nicole\HelveticaMedCdObl.ttf
[2012/11/07 12:57:13 | 000,039,840 | R--- | C] () -- C:\Users\Nicole\HelveticaMedCd.ttf
[2012/11/07 12:57:13 | 000,039,736 | R--- | C] () -- C:\Users\Nicole\HelveticaMedExtObl.ttf
[2012/11/07 12:57:13 | 000,022,216 | R--- | C] () -- C:\Users\Nicole\HelveticaFractionsBd.ttf
[2012/11/07 12:57:13 | 000,021,568 | R--- | C] () -- C:\Users\Nicole\HelveticaFractions.ttf
[2012/11/07 12:57:12 | 000,084,056 | R--- | C] () -- C:\Users\Nicole\helr67w.ttf
[2012/11/07 12:57:12 | 000,083,980 | R--- | C] () -- C:\Users\Nicole\helr65w.ttf
[2012/11/07 12:57:12 | 000,083,792 | R--- | C] () -- C:\Users\Nicole\helr47w.ttf
[2012/11/07 12:57:12 | 000,079,884 | R--- | C] () -- C:\Users\Nicole\helr66w.ttf
[2012/11/07 12:57:12 | 000,078,820 | R--- | C] () -- C:\Users\Nicole\helr68w.ttf
[2012/11/07 12:57:12 | 000,078,448 | R--- | C] () -- C:\Users\Nicole\helr48w.ttf
[2012/11/07 12:57:12 | 000,073,176 | R--- | C] () -- C:\Users\Nicole\Helvetica Neue.ttf
[2012/11/07 12:57:12 | 000,062,016 | ---- | C] () -- C:\Users\Nicole\ps_14529.ttf
[2012/11/07 12:57:12 | 000,061,860 | ---- | C] () -- C:\Users\Nicole\ps_14527.ttf
[2012/11/07 12:57:12 | 000,055,992 | ---- | C] () -- C:\Users\Nicole\ps_14528.ttf
[2012/11/07 12:57:12 | 000,055,992 | ---- | C] () -- C:\Users\Nicole\ps_14526.ttf
[2012/11/07 12:57:12 | 000,055,404 | R--- | C] () -- C:\Users\Nicole\HelveticaRdCdBdObl.ttf
[2012/11/07 12:57:12 | 000,054,848 | R--- | C] () -- C:\Users\Nicole\HelveticaRdBlkObl.ttf
[2012/11/07 12:57:12 | 000,052,812 | R--- | C] () -- C:\Users\Nicole\Helvetica.ttf
[2012/11/07 12:57:12 | 000,050,928 | R--- | C] () -- C:\Users\Nicole\HelveticaUltraLtIt.ttf
[2012/11/07 12:57:12 | 000,050,492 | R--- | C] () -- C:\Users\Nicole\HelveticaRdCdBd.ttf
[2012/11/07 12:57:12 | 000,049,696 | R--- | C] () -- C:\Users\Nicole\HelveticaBdObl___-.ttf
[2012/11/07 12:57:12 | 000,049,396 | R--- | C] () -- C:\Users\Nicole\HelveticaRdBlk.ttf
[2012/11/07 12:57:12 | 000,049,200 | R--- | C] () -- C:\Users\Nicole\HelveticaBdObl___--.ttf
[2012/11/07 12:57:12 | 000,048,256 | R--- | C] () -- C:\Users\Nicole\HelveticaUltraLt.ttf
[2012/11/07 12:57:12 | 000,043,676 | R--- | C] () -- C:\Users\Nicole\HelveticaThn.ttf
[2012/11/07 12:57:12 | 000,042,396 | R--- | C] () -- C:\Users\Nicole\HelveticaBd___-.ttf
[2012/11/07 12:57:12 | 000,042,048 | R--- | C] () -- C:\Users\Nicole\HelveticaUltraComp.ttf
[2012/11/07 12:57:12 | 000,041,776 | R--- | C] () -- C:\Users\Nicole\HelveticaBlk___.ttf
[2012/11/07 12:57:12 | 000,037,072 | ---- | C] () -- C:\Users\Nicole\HELVBL__.TTF
[2012/11/07 12:57:12 | 000,036,688 | ---- | C] () -- C:\Users\Nicole\helvlig.ttf
[2012/11/07 12:57:12 | 000,032,710 | ---- | C] () -- C:\Users\Nicole\hvb_____.PFB
[2012/11/07 12:57:12 | 000,005,313 | ---- | C] () -- C:\Users\Nicole\hvb_____.pfm
[2012/11/05 21:16:08 | 000,001,189 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CS6.lnk
[2012/11/05 20:59:06 | 000,001,067 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Widget Browser.lnk
[2012/11/05 20:01:40 | 000,001,165 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2012/11/05 19:24:31 | 000,001,608 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CS6.lnk
[2012/09/17 21:40:39 | 000,000,135 | ---- | C] () -- C:\windows\AutoKMS.ini
[2012/07/13 17:07:44 | 000,019,968 | ---- | C] () -- C:\Users\Nicole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/18 16:29:18 | 000,000,027 | ---- | C] () -- C:\ProgramData\SDGLYBMPWPP.SYS
[2010/12/11 00:08:26 | 000,012,288 | ---- | C] () -- C:\windows\System32\Regocx32.exe
[2010/12/10 23:33:18 | 000,000,014 | ---- | C] () -- C:\windows\System32\Call.ini
[2010/10/08 23:05:51 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/09/18 12:40:39 | 000,000,000 | ---- | C] () -- C:\Users\Nicole\AppData\Roaming\wklnhst.dat

========== ZeroAccess Check ==========

[2009/07/14 02:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 02:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 10:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 23:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2010/08/25 18:14:08 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Asus
[2012/06/12 01:01:49 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\BSplayer
[2012/06/11 22:49:21 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\BSplayer Pro
[2012/11/27 21:37:16 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/09/03 20:57:35 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/07/10 15:06:45 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\DAEMON Tools Lite
[2012/02/06 21:24:11 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\FrostWire
[2010/11/23 18:21:50 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\InterTrust
[2012/07/11 11:43:46 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\Origin
[2012/10/24 22:33:48 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\PDAppFlex
[2011/01/26 00:53:29 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\PhotoScape
[2010/12/25 13:43:42 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\RGE
[2012/09/11 20:45:01 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/11/01 00:16:01 | 000,000,000 | ---D | M] -- C:\Users\Nicole\AppData\Roaming\uTorrent

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2012/10/26 00:22:14 | 000,003,040 | ---- | M] () -- C:\Ad-Report-SCAN[1].txt
[2012/10/29 22:42:30 | 000,003,040 | ---- | M] () -- C:\Ad-Report-SCAN[2].txt
[2012/12/01 00:33:17 | 000,006,152 | ---- | M] () -- C:\AdwCleaner[R1].txt
[2012/12/01 00:36:49 | 000,006,001 | ---- | M] () -- C:\AdwCleaner[S2].txt
[2009/06/10 19:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2010/11/20 10:40:07 | 000,383,786 | RHS- | M] () -- C:\bootmgr
[2009/06/10 19:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2012/12/01 00:39:04 | 797,581,312 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/03 21:04:20 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/03/03 21:04:20 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/12/01 00:39:08 | 1073,741,824 | -HS- | M] () -- C:\pagefile.sys
[2010/07/17 12:48:11 | 000,002,119 | ---- | M] () -- C:\RHDSetup.log

< %systemdrive%\drivers\*.exe >

< %systemroot%\system32\drivers\*.* /90 >
[2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\windows\system32\drivers\mbam.sys
[2012/09/18 12:42:10 | 000,000,000 | -H-- | M] () -- C:\windows\system32\drivers\Msft_Kernel_point32_01009.Wdf
[2012/10/03 14:58:30 | 001,293,680 | ---- | M] (Microsoft Corporation) -- C:\windows\system32\drivers\tcpip.sys
[2012/10/03 13:21:38 | 000,035,328 | ---- | M] (Microsoft Corporation) -- C:\windows\system32\drivers\tcpipreg.sys

< %PROGRAMFILES%\*.* >
[2009/07/14 02:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %LOCALAPPDATA%\*.exe >

< %LOCALAPPDATA%\*.txt >

< %LOCALAPPDATA%\*.ini >
[2012/07/24 01:42:20 | 000,019,968 | ---- | M] () -- C:\Users\Nicole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< %LOCALAPPDATA%\*.dll >

< %LOCALAPPDATA%\*.dat >
[2012/11/28 16:52:13 | 000,143,656 | ---- | M] () -- C:\Users\Nicole\AppData\Local\GDIPFONTCACHEV1.DAT

< %USERPROFILE%\*.exe >

< %USERPROFILE%\*.txt >

< %USERPROFILE%\*.ini >
[2009/07/14 02:53:59 | 000,000,020 | -HS- | M] () -- C:\Users\Nicole\ntuser.ini

< %USERPROFILE%\*.dll >

< %USERPROFILE%\*.dat /30 >
[2012/12/01 09:15:44 | 008,388,608 | -HS- | M] () -- C:\Users\Nicole\ntuser.dat

< %appdata%\*.* >
[2010/09/18 12:40:39 | 000,000,000 | ---- | M] () -- C:\Users\Nicole\AppData\Roaming\wklnhst.dat

< %systemroot%\system32\tasks\*.* >
[2012/11/13 12:35:06 | 000,003,768 | ---- | M] () -- C:\windows\system32\tasks\Adobe Flash Player Updater
[2012/10/24 22:34:09 | 000,003,492 | ---- | M] () -- C:\windows\system32\tasks\AdobeAAMUpdater-1.0-Nicole25-Nicole
[2012/09/17 21:40:43 | 000,002,434 | ---- | M] () -- C:\windows\system32\tasks\AutoKMS
[2012/11/13 06:43:13 | 000,004,182 | ---- | M] () -- C:\windows\system32\tasks\avast! Emergency Update
[2012/07/12 20:22:23 | 000,003,688 | ---- | M] () -- C:\windows\system32\tasks\FacebookUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000Core
[2012/07/12 20:22:25 | 000,004,056 | ---- | M] () -- C:\windows\system32\tasks\FacebookUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000UA
[2012/09/21 00:03:33 | 000,003,658 | ---- | M] () -- C:\windows\system32\tasks\GoogleUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000Core
[2012/09/21 00:03:33 | 000,004,054 | ---- | M] () -- C:\windows\system32\tasks\GoogleUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000UA
[2012/09/18 12:42:28 | 000,003,056 | ---- | M] () -- C:\windows\system32\tasks\Microsoft_Hardware_Launch_devicecenter_exe
[2012/09/18 12:42:27 | 000,003,044 | ---- | M] () -- C:\windows\system32\tasks\Microsoft_Hardware_Launch_ipoint_exe
[2012/09/18 12:42:26 | 000,003,042 | ---- | M] () -- C:\windows\system32\tasks\Microsoft_Hardware_Launch_itype_exe
[2012/05/24 20:41:51 | 000,003,198 | ---- | M] () -- C:\windows\system32\tasks\RealUpgradeLogonTaskS-1-5-21-2261747524-142836605-432722655-1000
[2012/05/24 20:41:49 | 000,003,330 | ---- | M] () -- C:\windows\system32\tasks\RealUpgradeScheduledTaskS-1-5-21-2261747524-142836605-432722655-1000
[2011/03/09 19:43:45 | 000,003,148 | ---- | M] () -- C:\windows\system32\tasks\SidebarExecute
[2010/10/08 22:44:44 | 000,002,864 | ---- | M] () -- C:\windows\system32\tasks\{1DFAF03C-AE85-4886-8045-DB398071E02A}
[2012/07/10 15:15:09 | 000,003,410 | ---- | M] () -- C:\windows\system32\tasks\{4D324600-F6E6-45C3-8326-E275F65CD57E}
[2010/10/07 20:38:36 | 000,003,196 | ---- | M] () -- C:\windows\system32\tasks\{840B95F6-25DE-42B6-9090-41AA83285D78}
[2011/02/18 16:50:23 | 000,003,160 | ---- | M] () -- C:\windows\system32\tasks\{89E2F138-C31C-4989-BFB3-CB2BA6EE957C}
[2012/07/25 22:22:55 | 000,003,100 | ---- | M] () -- C:\windows\system32\tasks\{90DA99B8-F1F5-4F50-8FC6-5D9F0C730895}
[2010/11/23 18:21:28 | 000,003,136 | ---- | M] () -- C:\windows\system32\tasks\{9A83842C-8301-4341-9A10-7AE2E97D487F}
[2010/10/07 20:09:20 | 000,003,248 | ---- | M] () -- C:\windows\system32\tasks\{BEC278F6-752E-4DC9-AED4-5FA82A0B88F3}

< %windir%\tasks\*.* >
[2012/12/01 09:14:01 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/12/01 00:39:23 | 000,000,202 | ---- | M] () -- C:\windows\tasks\AutoKMS.job
[2012/11/28 19:27:07 | 000,001,056 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000Core.job
[2012/12/01 07:27:06 | 000,001,078 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000UA.job
[2012/11/28 23:08:04 | 000,001,030 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000Core.job
[2012/12/01 09:08:03 | 000,001,082 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2261747524-142836605-432722655-1000UA.job
[2012/12/01 00:39:21 | 000,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
[2012/10/29 20:28:02 | 000,032,620 | ---- | M] () -- C:\windows\tasks\SCHEDLGU.TXT

< HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run /s >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections >
"DefaultConnectionSettings" = 46 00 00 00 7C 0E 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 84 DC 67 4E 6D CF CD 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 01 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 41 37 9E 76 30 07 1E D0 3F 57 FE 9B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [Binary data over 200 bytes]
"SavedLegacySettings" = 46 00 00 00 CF 1B 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 84 DC 67 4E 6D CF CD 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 01 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 41 37 9E 76 30 07 1E D0 3F 57 FE 9B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [Binary data over 200 bytes]

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments >

< HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMP >

< HKCU\Software\Microsoft\Internet Explorer\Downloads >

< MD5 for: SERVICES >
[2009/06/10 19:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\System32\drivers\etc\services
[2009/06/10 19:39:37 | 000,017,463 | ---- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_045b589158ae90da\services

< MD5 for: SERVICES.AIP >
[2012/03/29 20:35:50 | 000,375,952 | ---- | M] (Adobe Systems Incorporated) MD5=5965DFD83E10938A579952EB58C10298 -- C:\Program Files\Adobe\Adobe Illustrator CS6\Plug-ins\Extensions\Services.aip

< MD5 for: SERVICES.ASFX >
[2012/09/23 20:43:52 | 000,002,588 | ---- | M] () MD5=0D18AE3100D7B9D49DCB1CE1EABA21F7 -- C:\Program Files\Adobe\Reader 11.0\Reader\Locale\pt_BR\Services\Services.asfx

< MD5 for: SERVICES.CFG >
[2012/09/23 20:43:36 | 000,603,848 | ---- | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 -- C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg

< MD5 for: SERVICES.EXE >
[2009/07/13 23:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\System32\services.exe
[2009/07/13 23:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2009/07/14 00:03:06 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 -- C:\Windows\System32\en-US\services.exe.mui
[2009/07/14 00:03:06 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_69d39d3a8748c332\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/14 02:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 02:41:45 | 000,001,288 | ---- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 19:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\System32\wbem\services.mof
[2009/06/10 19:26:14 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.mof

< MD5 for: SERVICES.MSC >
[2009/07/14 00:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\en-US\services.msc
[2009/06/10 19:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\services.msc
[2009/07/14 00:08:50 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 19:21:09 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 18:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\System32\wdi\perftrack\Services.ptxml
[2009/07/13 18:20:01 | 000,001,061 | ---- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\Services.ptxml

< End of report >






OTL Extras logfile created on: 12/1/2012 9:07:31 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nicole\Downloads
Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Brazil | Language: PTB | Date Format: dd/MM/yyyy

1014.18 Mb Total Physical Memory | 212.61 Mb Available Physical Memory | 20.96% Memory free
1.99 Gb Paging File | 0.60 Gb Available in Paging File | 30.01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 217.86 Gb Total Space | 12.87 Gb Free Space | 5.91% Space Free | Partition Type: NTFS

Computer Name: NICOLE25 | User Name: Nicole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06E1F610-8324-41EA-811E-11B4BB8944B9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{299A07D0-F410-4F1C-AD45-C3D1A142D2D1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2F46F7F0-409A-490E-9234-E84B7A04F7D5}" = rport=10243 | protocol=6 | dir=out | app=system |
"{333E1B16-A475-4B73-A4C3-C8C211E97BDF}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{39517367-6CFA-4037-B279-8B32BB01E99F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{3A900D3E-D6D0-40C7-AF75-AFA3158FED91}" = lport=2869 | protocol=6 | dir=in | app=system |
"{471B6D48-1499-47AC-8778-A9039C974AC3}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{59CC3C73-05C6-47C0-A01D-5ABF8C880775}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6C285F9D-F6FA-4955-9EA0-DC410CE1D4C7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8D4E0C48-BA96-425F-ACF3-5C787453A70C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A9CB6AAA-0623-415F-A8C7-0B5F782A27D9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C7C8B363-867A-4018-B87E-BC48885FEC9E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D8CBD3AF-B4DE-41BE-90F0-F9757CD53A1E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{040BF66A-A5C0-48C3-AA3D-6C5B5C1AFA22}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{0A490FAC-6A9E-4AD3-B132-A6D8894E1DBF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1B31ABFD-AE9C-417F-AFB5-36398D4856BF}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{1B497B3D-5FCE-4177-B606-9FA08F361744}" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"{258F121F-8C78-4469-9734-A9AE8F59F737}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{34983104-18B3-48CD-BB72-3877ED19BC6F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3B1B4808-E20B-4A3E-9610-40F4BBC47641}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{401E0F17-AB8E-48EA-8C07-9CCDB5F16BF6}" = protocol=6 | dir=in | app=c:\users\nicole\appdata\local\temp\update_3657.exe |
"{42259A27-ADFA-4B74-AB25-EF8ED984B050}" = protocol=17 | dir=in | app=c:\program files\frostwire 5\frostwire.exe |
"{4A597EF8-26A3-4F55-A531-E793AAD44A04}" = protocol=17 | dir=in | app=c:\users\nicole\appdata\local\temp\update_3657.exe |
"{5CCCEB0E-B90A-4F82-9CE1-596C16DC1365}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{67459A30-4B71-4C14-B35E-2C9DB3CDDB51}" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"{684BC847-2E51-467E-985B-D36A6A3C9575}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6C9F9E1A-4CE4-41B4-8DB5-765F779FA59B}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{7620A802-6C3E-47C8-9E46-E5C328885EA3}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{782E3E70-A9BA-45CD-91A8-2CC525558B1D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{795D18A4-DBC5-4667-8DCA-05733A0C465B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{876EC7EB-CFD4-479C-8B0E-D721BCD01F61}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{8D40B705-D0E5-4A0B-AE5B-D676A20C2478}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{92B96F08-4EA5-46DA-BC36-78179612DC08}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{9769F159-75E8-4B8E-B649-420C7BDDFBC5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B2BF7269-8879-48CE-BB3D-ECE8E151922E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BB97524A-3F43-418D-B6B4-BE0EA5F758D0}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{CD30198A-08A9-427E-B553-51A0E1803FFD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D0456DC8-56CA-4AC2-A15B-AB58606C518A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D716EB65-7055-460B-8FF0-5A61C01BC151}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D9A1725C-6894-42D5-8BBD-E2B2E4278BCA}" = protocol=6 | dir=out | app=system |
"{E4266075-3B8A-4AB8-BEB5-5D1441D6B97D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{E71BE0C7-9034-4031-B142-AA942597A00F}" = dir=in | app=c:\users\nicole\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{E7F0312C-CFEB-4236-BF82-700F5A10433C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{F152CDA2-05B6-4246-AC85-2B63C603D575}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FE492D43-28F3-4548-9496-F677D4374749}" = protocol=6 | dir=in | app=c:\program files\frostwire 5\frostwire.exe |
"TCP Query User{34315B12-4390-4C13-A2CF-564D40B0E0A3}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{44A118C8-9B41-4B25-B623-7CFE6312345A}C:\program files\frostwire 5\frostwire.exe" = protocol=6 | dir=in | app=c:\program files\frostwire 5\frostwire.exe |
"TCP Query User{5B1E581F-DEDD-4071-9877-AAC746AC9E14}C:\windows\kmsemulator.exe" = protocol=6 | dir=in | app=c:\windows\kmsemulator.exe |
"UDP Query User{0DCB2DC0-DDCB-40EC-8D82-8617296CBFB8}C:\windows\kmsemulator.exe" = protocol=17 | dir=in | app=c:\windows\kmsemulator.exe |
"UDP Query User{28CADBF7-8103-4575-A1B5-EA1583476808}C:\program files\frostwire 5\frostwire.exe" = protocol=17 | dir=in | app=c:\program files\frostwire 5\frostwire.exe |
"UDP Query User{52E9EBE2-6E22-4792-87F6-92D8683AEEC2}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0FFEA8EE-7BC7-4C9D-8CC6-5B8C891BA3F2}" = Windows Live Essentials
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{17780F99-A9DF-450B-81B3-6781B20A17A8}" = FontResizer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Ferramenta de Carregamento do Windows Live
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 24
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{38E5A3B1-ADF1-47E0-8024-76310A30EB36}" = LiveUpdate
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4869414E-7AEA-4C8E-BE1C-8D40977FD517}" = Adobe Illustrator CS6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B5092B6-F231-4D18-83BC-2618B729CA45}" = CapsHook
"{4FCBCF89-1823-4D97-A6F2-0E8DD66E273A}" = Broadcom Wireless Network Adapter
"{51A9E3DD-37B8-47BB-8E67-5B76B3EFBC48}" = Assistente de Conexão do Windows Live
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC
"{590035D9-BFA0-406A-A7F0-479C72C0DDB2}" = Windows Live Call
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6333FC29-BFE5-4024-AC78-958A1A7555D1}" = EeeSplendid
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security
"{71C0E38E-09F2-4386-9977-404D4F6640CD}" = Hotkey Service
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{859D40CF-8491-44AD-8FA8-7389CB418C64}" = 32 Bit HP CIO Components Installer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}" = Ralink RT2860 Wireless LAN Card
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-0015-0416-0000-0000000FF1CE}" = Microsoft Office Access MUI (Portuguese (Brazil)) 2010
"{90140000-0015-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0416-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Portuguese (Brazil)) 2010
"{90140000-0016-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0416-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010
"{90140000-0018-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0416-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010
"{90140000-0019-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0416-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010
"{90140000-001A-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0416-0000-0000000FF1CE}" = Microsoft Office Word MUI (Portuguese (Brazil)) 2010
"{90140000-001B-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2010
"{90140000-001F-0416-0000-0000000FF1CE}_Office14.SingleImage_{A7200E61-DC93-42E0-BB74-EE59021016EA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0416-0000-0000000FF1CE}" = Microsoft Office Proofing (Portuguese (Brazil)) 2010
"{90140000-002C-0416-0000-0000000FF1CE}_Office14.SingleImage_{13291F79-D997-49AD-9F31-5FAEE1F0FCF5}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0416-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Portuguese (Brazil)) 2010
"{90140000-006E-0416-0000-0000000FF1CE}_Office14.SingleImage_{2134F8C8-2AD8-44EE-B86B-1B577FBD8D0E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0416-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010
"{90140000-00A1-0416-0000-0000000FF1CE}_Office14.SingleImage_{8E0FD78B-F726-43C8-8D53-44A7E495F3D2}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{912B04B3-7C7C-4929-AE68-EC2A4CCB4E73}" = Microsoft Mouse and Keyboard Center
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9ADC3E4F-34DA-48CD-8727-BB26D90257BD}" = Windows Live Messenger
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D2B0322-44AE-460E-9283-4D2D7A9205AE}" = Trend Micro Internet Security
"{A4ED5E53-7AA0-11E1-BF04-B2D4D4A5360E}" = Adobe Dreamweaver CS6
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{AC76BA86-7AD7-1046-7B44-AB0000000001}" = Adobe Reader XI - Português
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BD5669B5-49FF-4490-B956-E9D7CB9B0ADC}" = Adobe Flash Professional CS6
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CFB770D7-8D43-1014-922B-CC2715FADE3F}" = Adobe InDesign CS6
"{D802DD00-16A8-4A58-AFC9-020C2380ECDA}" = EeeSplendid
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}" = SRS Premium Sound Control Panel
"{EA5F34F3-3911-B4DB-63CA-1E44B2AB13A1}" = Adobe Download Assistant
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}" = LocaleMe
"Add/Remove Pro (Freeware)_is1" = Add/Remove Pro (Freeware)
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Ad-Remover" = Ad-Remover par C_XX
"ASUS VIBE" = ASUS VIBE
"avast" = avast! Free Antivirus
"BSPlayerf" = BS.Player FREE
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"Eee Docking_is1" = Eee Docking 3.7.0
"Elantech" = ETDWare PS/2-x86 7.0.5.11_WHQL
"FrostWire 5" = FrostWire 5.2.11
"HDMI" = Intel® Graphics Media Accelerator Driver
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}" = FontResizer
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware versão 1.65.1.1000
"Messenger Plus!" = Messenger Plus! 5
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Mouse and Keyboard Center" = Microsoft Mouse and Keyboard Center
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"OOBERegBackup_is1" = OOBERegBackup
"Origin" = Origin
"PhotoScape" = PhotoScape
"qt7lite_is1" = QT Lite 3.1.1
"RealAlt_is1" = Real Alternative 2.0.2 Lite
"RealPlayer 15.0" = RealPlayer
"ScreenSaverPatch_is1" = ScreenSaverPatch
"StarterBackgroundChanger" = StarterBackgroundChanger
"tuto4pcmaj 1.1_is1" = tuto4pcmaj 1.1
"uTorrent" = µTorrent
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = Arquivo do WinRAR

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/28/2012 3:27:53 PM | Computer Name = Nicole25 | Source = Application Error | ID = 1000
Description = Faulting application name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Faulting module name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Exception code: 0x80000003 Fault offset: 0x000a0b03 Faulting
process id: 0xe50 Faulting application start time: 0x01cd6cf70be80b61 Faulting application
path: C:\Program Files\Tuto4pc\tutoriaisslimba.exe Faulting module path: C:\Program
Files\Tuto4pc\tutoriaisslimba.exe Report Id: 52ebd4a8-d8ea-11e1-83ee-485b396ad97c

Error - 7/28/2012 6:27:11 PM | Computer Name = Nicole25 | Source = Google Update | ID = 20
Description =

Error - 7/28/2012 6:36:15 PM | Computer Name = Nicole25 | Source = Application Error | ID = 1000
Description = Faulting application name: RealPlay.exe, version: 15.0.5.109, time
stamp: 0x4fe37037 Faulting module name: RealPlay.exe, version: 15.0.5.109, time
stamp: 0x4fe37037 Exception code: 0xc0000005 Fault offset: 0x0000c0f7 Faulting process
id: 0x45c Faulting application start time: 0x01cd6d10de68909f Faulting application
path: C:\Program Files\Real\RealPlayer\RealPlay.exe Faulting module path: C:\Program
Files\Real\RealPlayer\RealPlay.exe Report Id: a3554883-d904-11e1-83ee-485b396ad97c

Error - 7/28/2012 10:20:37 PM | Computer Name = Nicole25 | Source = Application Error | ID = 1000
Description = Faulting application name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Faulting module name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Exception code: 0x80000003 Fault offset: 0x000a0b03 Faulting
process id: 0xf68 Faulting application start time: 0x01cd6d30a15fee07 Faulting application
path: C:\Program Files\Tuto4pc\tutoriaisslimba.exe Faulting module path: C:\Program
Files\Tuto4pc\tutoriaisslimba.exe Report Id: f9000b81-d923-11e1-a6cb-485b396ad97c

Error - 7/29/2012 10:50:55 AM | Computer Name = Nicole25 | Source = Application Error | ID = 1000
Description = Faulting application name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Faulting module name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Exception code: 0x80000003 Fault offset: 0x000a0b03 Faulting
process id: 0xe40 Faulting application start time: 0x01cd6d9984ac5054 Faulting application
path: C:\Program Files\Tuto4pc\tutoriaisslimba.exe Faulting module path: C:\Program
Files\Tuto4pc\tutoriaisslimba.exe Report Id: cc42d47a-d98c-11e1-a620-485b396ad97c

Error - 7/29/2012 1:52:59 PM | Computer Name = Nicole25 | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 7/29/2012 3:29:18 PM | Computer Name = Nicole25 | Source = Google Update | ID = 20
Description =

Error - 7/29/2012 6:27:13 PM | Computer Name = Nicole25 | Source = Google Update | ID = 20
Description =

Error - 7/29/2012 11:20:53 PM | Computer Name = Nicole25 | Source = Application Error | ID = 1000
Description = Faulting application name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Faulting module name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Exception code: 0x80000003 Fault offset: 0x000a0b03 Faulting
process id: 0xdc4 Faulting application start time: 0x01cd6e024a3606b8 Faulting application
path: C:\Program Files\Tuto4pc\tutoriaisslimba.exe Faulting module path: C:\Program
Files\Tuto4pc\tutoriaisslimba.exe Report Id: 9178ad5b-d9f5-11e1-bd48-485b396ad97c

Error - 7/30/2012 11:06:07 AM | Computer Name = Nicole25 | Source = Application Error | ID = 1000
Description = Faulting application name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Faulting module name: tutoriaisslimba.exe, version: 1.0.0.1,
time stamp: 0x4f7c0522 Exception code: 0x80000003 Fault offset: 0x000a0b03 Faulting
process id: 0xde4 Faulting application start time: 0x01cd6e64d2a5fbb8 Faulting application
path: C:\Program Files\Tuto4pc\tutoriaisslimba.exe Faulting module path: C:\Program
Files\Tuto4pc\tutoriaisslimba.exe Report Id: 163d3d79-da58-11e1-8377-485b396ad97c

[ System Events ]
Error - 11/29/2012 9:58:02 AM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 11/29/2012 7:48:23 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7000
Description = The tmcomm service failed to start due to the following error: %%1305

Error - 11/29/2012 7:48:42 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 11/30/2012 5:36:47 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7000
Description = The tmcomm service failed to start due to the following error: %%1305

Error - 11/30/2012 5:36:59 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 11/30/2012 5:49:37 PM | Computer Name = Nicole25 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition
1.141.795.0).

Error - 11/30/2012 10:17:12 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7000
Description = The tmcomm service failed to start due to the following error: %%1305

Error - 11/30/2012 10:17:31 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 11/30/2012 10:39:23 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7000
Description = The tmcomm service failed to start due to the following error: %%1305

Error - 11/30/2012 10:39:37 PM | Computer Name = Nicole25 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom


< End of report >

#7
GiovaneMartins

GiovaneMartins

    Geek

  • Membro
  • PipPipPipPip
  • 2.058 posts
1)

Clique em Iniciar <-> Painel de Controle <-> Programas <-> Desinstalar um Programa. Procure e desinstale o (s) programa (s) abaixo:

tuto4pcmaj 1.1

2)

Selecione e copie o texto dentro do code, clique com o direito sobre a seleção e escolha a opção copiar:

OBS: Certifique-se de copiar começando pelo sinal de dois pontos antes do OTL.
:OTL
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmood...D&cr=1693381917
IE - HKCU\..\SearchScopes\{F3794AF9-1D1C-4730-9376-A41721BE3E39}: "URL" = http://start.funmood...D&cr=1693381917
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [tutoriaisup] C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe ()
O4 - HKCU..\Run: [AdobeBridge]  File not found
O32 - AutoRun File - [2009/06/10 19:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{d9a25252-46db-11e1-8bfb-485b396ad97c}\Shell - "" = AutoRun
O33 - MountPoints2\{d9a25252-46db-11e1-8bfb-485b396ad97c}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\Shell - "" = AutoRun
O33 - MountPoints2\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe
:Services

:Reg

:Files

:Commands
[createrestorepoint]
[purity]
[emptytemp]
[EMPTYFLASH]


** Usuários do Windows Vista e Windows 7:
Clique com o direito sobre o arquivo OTL.exe, depois clique em Imagem Postada
.

Clique com o botão direito em qualquer parte branca, da sessão Imagem Postada e escolha a opção colar

Feche TODAS as janelas (exceto o próprio OTL).

Clique no botão Imagem Postada
O programa executará o script e reiniciará o seu computador.
Quando o Windows for carregado, o OTL será executado automaticamente. Permita a sua execução.
Um bloco de notas será aberto, contendo algumas informações.
Copie TODO o conteúdo deste bloco de notas e cole na sua resposta.

Uma cópia deste log ficará armazenado na pasta C:\_OTL\MovedFiles com o nome no seguinte formato data_hora.log.

Exemplo: 03142010_145545.log

3)

Exclua os arquivos temporários da internet, como as seguintes instruções:

http://support.micro...kb/260897/pt-br
[Linha Defensiva no Twitter] [Linha Defensiva no Facebook]

Imagem Postada
Retribua a nossa ajuda não abandonando seu tópico. Obrigado.
Blog do Giovane | Twitter - @giovane_vaz

#8
nicole25

nicole25

    Novato

  • Membro
  • Pip
  • 6 posts
Bom dia,

Eu tentei seguir os passos, mas acontece que o programa tuto4pcmaj 1. não existe na lista de programas. Como recentemente eu excluí alguns programas, já que estava quase lotado, achei que poderia ter excluído e não me lembrar. Então fui pro OTL e copiei exatamente o que foi pedido, segui os passos, mas ao reiniciar o programa não abriu sozinho, nem abriu o bloco de notas com o log. Procurei na pasta Moved Files e também não há nenhum arquivo com o log lá, não tem a pasta data_hora.log. Os arquivos temporários da internet foram excluídos

Aguardo resposta.

Editado por nicole25, 11 dezembro 2012 - 10:43.


#9
GiovaneMartins

GiovaneMartins

    Geek

  • Membro
  • PipPipPipPip
  • 2.058 posts

Então fui pro OTL e copiei exatamente o que foi pedido, segui os passos, mas ao reiniciar o programa não abriu sozinho, nem abriu o bloco de notas com o log. Procurei na pasta Moved Files e também não há nenhum arquivo com o log lá, não tem a pasta data_hora.log. Os arquivos temporários da internet foram excluídos


Nesse caso, repita o procedimento com o OTL, e verifique se dessa vez o log aparece na reinicialização. :legal:

As páginas de publicidade ainda são exibidas?
[Linha Defensiva no Twitter] [Linha Defensiva no Facebook]

Imagem Postada
Retribua a nossa ajuda não abandonando seu tópico. Obrigado.
Blog do Giovane | Twitter - @giovane_vaz

#10
nicole25

nicole25

    Novato

  • Membro
  • Pip
  • 6 posts
Dessa vez o log apareceu:


All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F3794AF9-1D1C-4730-9376-A41721BE3E39}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3794AF9-1D1C-4730-9376-A41721BE3E39}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tutoriaisup not found.
File C:\Users\Nicole\AppData\Local\tutoriaisup\tutoriaisup.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge not found.
File C:\autoexec.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9a25252-46db-11e1-8bfb-485b396ad97c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9a25252-46db-11e1-8bfb-485b396ad97c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9a25252-46db-11e1-8bfb-485b396ad97c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9a25252-46db-11e1-8bfb-485b396ad97c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d9a2526f-46db-11e1-8bfb-485b396ad97c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\AutoRun.exe not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Nicole
->Temp folder emptied: 1837515761 bytes
->Temporary Internet Files folder emptied: 143755329 bytes
->Java cache emptied: 13488 bytes
->Google Chrome cache emptied: 284135311 bytes
->Flash cache emptied: 57338 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 745600 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 443925399 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2,585.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Nicole
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 12192012_135845

Files\Folders moved on Reboot...
File\Folder C:\windows\temp\_avast_\unp147895676.tmp not found!
File\Folder C:\windows\temp\_avast_\unp201646987.tmp not found!
File\Folder C:\windows\temp\_avast_\unp224491679.tmp not found!
File\Folder C:\windows\temp\_avast_\unp245489763.tmp not found!
File move failed. C:\windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
C:\windows\temp\HS.log moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...



E reparei que os problemas com as páginas de publicidade também sumiram.

Obrigada

#11
GiovaneMartins

GiovaneMartins

    Geek

  • Membro
  • PipPipPipPip
  • 2.058 posts
Olá,

O log está limpo. ^_^

Finalizando:

1º) Abra o OTL e clique no botão Imagem Postada.

Permita que o programa reinicie o sistema.

2º)Imagem Postada Versões antigas do Java, têm vunerabilidades que alguns malwares podem usar para infectar seu sistema. Verifique se o seu sistema tem a última versão instalada:

Baixe o JavaRa.

  • Dê um duplo-clique no JavaRa.exe.
  • Depois clique em Search For Updates
  • Clique então no botão Search.

Se estiver atualizado, o programa emitirá um aviso de que a última versão já está instalada. Caso contrário, aguarde a nova versão do Java ser baixada e instalada. Depois clique no botão Remove Older Versions para que as versões antigas que existirem no PC sejam desinstaladas.

3º) Imagem Postada Atualize o Adobe Reader. Versões antigas contém vulnerabilidades que são exploradas por malwares.

Remova a versão mais antiga e clique aqui para instalar a mais nova versão.

4º) Desative e ative novamente a Restauração do Sistema.

5º) Leia o artigo Proteja seu PC para mais informações de como se proteger na internet.

6º) Se não tiver mais problemas, clique no botão Imagem Postada e peça para fecharem o tópico.

Caso tenha alguma dúvida relacionada a informática e tecnologia, sinta-se a vontade para postar nas outras áreas do fórum.
[Linha Defensiva no Twitter] [Linha Defensiva no Facebook]

Imagem Postada
Retribua a nossa ajuda não abandonando seu tópico. Obrigado.
Blog do Giovane | Twitter - @giovane_vaz

#12
LUA

LUA

    Administradora

  • Administrador
  • 4.355 posts
PROBLEMA RESOLVIDO
 
Caso queira solicitar a reabertura do tópico, utilize o botão Denunciar para entrar em contato com a moderação.

Nota: Somente o autor pode realizar essa solicitação na área Remoção de Malware.
Luciana Leme

Imagem Postada
__________________________________________________
Respeite quem o ajuda, não abandone o seu tópico.
Leia as Regras do Fórum - Veja como se tornar um Aprendiz
Linha Defensiva no Twitter! - Linha Defensiva no Facebook!