************************************************************************************
ISeeYouXP v2.0 Beta 14
ISeeYouXP v1.3.0-v2.0 Beta 14 Copyright - ShadowPuterDude
ISeeYouXP v1.2.9 and earlier Copyright - PhilliePhan
------------------------------------------------------------------------------------
**** PLEASE NOTE THAT MOST (if not ALL) OF THE ITEMS BELOW ARE NOT BADDIES! ****
**** PLEASE CONSULT A KNOWLEDGEABLE PERSON BEFORE TAKING ANY ACTION. ****
************************************************************************************
Windows/Browser/Java Versions:
Microsoft (R) Windows Script Host Verso 5.7
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Microsoft Windows XP Professional
Version: 5.1.2600
Service Pack: 3.0
Windows Directory: C:\WINDOWS
Microsoft (R) Windows Script Host Verso 5.7
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Internet Explorer
Version: 7.0.5730.13
Build: 75730
Language: Ingls (Estados Unidos)
Path: C:\Arquivos de programas\Internet Explorer
Microsoft (R) Windows Script Host Verso 5.7
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Boot State: Normal boot
Scan done at 8:30:54,90, 31/10/2008
------------------------------------------------------------------------------------
ISeeYouXP installation folder and files
"C:\ISeeYouXP\"
bootst~1.vbs 28 May 2007 359 "bootstate.vbs"
change.log 8 Jun 2008 5012 "change.log"
chodefix.bat 18 Apr 2007 5387 "chodefix.bat"
fixchode.reg 18 Apr 2007 528 "fixChode.reg"
fixexp~1.bat 24 Feb 2007 487 "FixExplorerPolicies.bat"
getunk~1.bat 12 Aug 2006 1478 "GetUnKeys.bat"
grep.exe 24 Dec 2004 160768 "grep.exe"
hideit.bat 17 Oct 2007 1072 "HideIT.bat"
ieinfo.vbs 28 May 2007 514 "ieinfo.vbs"
iesecu~1.bat 28 Oct 2007 72 "IESecurityZones.bat"
iesecu~1.vbs 8 Nov 2007 2399 "IESecurityZones.vbs"
iseeyo~1.bat 8 Jun 2008 211377 "ISeeYouXP.bat"
libico~1.dll 16 Mar 2004 898048 "libiconv2.dll"
libintl3.dll 9 Oct 2004 101888 "libintl3.dll"
locate.com 14 Jan 2005 11254 "locate.com"
md5sum.exe 5 Aug 2007 49152 "md5sum.exe"
msconf~1.bat 24 Feb 2007 578 "MSConfigFix.bat"
osinfo.vbs 28 May 2007 598 "osinfo.vbs"
pcbutts.txt 25 Mar 2007 5167 "PCBUTTS.TXT"
pcre.dll 14 Nov 2004 183313 "pcre.dll"
pv.exe 3 Mar 2006 73728 "pv.exe"
regedi~1.bat 30 Mar 2007 650 "RegEditFix.bat"
regfix.bat 18 Apr 2007 145 "Regfix.bat"
servic~1.vbs 28 May 2007 672 "servicesinfo.vbs"
showit.bat 17 Oct 2007 1013 "ShowIT.bat"
swreg.exe 5 Apr 2007 139776 "swreg.exe"
system~1.bat 28 Feb 2007 369 "SystemRestoreFix.bat"
taskmg~1.bat 24 Feb 2007 288 "TaskMgrFix.bat"
28 items found: 28 files, 0 directories.
Total of file sizes: 1.856.092 bytes 1,77 M
------------------------------------------------------------------------------------
System Environment Variables
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\User\Dados de aplicativos
CLIENTNAME=Console
CommonProgramFiles=C:\Arquivos de programas\Arquivos comuns
COMPUTERNAME=VIVIANE
ComSpec=C:\WINDOWS\system32\cmd.exe
errcode=0
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\User
LOGONSERVER=\\VIVIANE
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0409
ProgramFiles=C:\Arquivos de programas
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\User\CONFIG~1\Temp
TMP=C:\DOCUME~1\User\CONFIG~1\Temp
USERDOMAIN=VIVIANE
USERNAME=User
USERPROFILE=C:\Documents and Settings\User
windir=C:\WINDOWS
------------------------------------------------------------------------------------
Showing any Pocket Killbox backup files
No matches found.
------------------------------------------------------------------------------------
Displaying BOOT.INI:
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
------------------------------------------------------------------------------------
Displaying SYSTEM.INI:
; for 16-bit app support
[drivers]
wave=mmdrv.dll
timer=timer.drv
[mci]
[driver32]
[386enh]
woafont=app850.FON
EGA80WOA.FON=EGA80850.FON
EGA40WOA.FON=EGA40850.FON
CGA80WOA.FON=CGA80850.FON
CGA40WOA.FON=CGA40850.FON
[TTFontDimenCacheDBCS]
0 4=2 4
0 5=3 5
0 6=4 6
0 7=4 7
0 8=5 8
0 9=5 9
0 10=6 10
0 11=7 11
0 12=7 12
0 13=8 13
0 14=8 14
0 15=9 15
0 16=10 16
0 18=11 18
0 20=12 20
0 22=13 22
------------------------------------------------------------------------------------
Displaying WIN.INI:
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMCDLLNAME=mapi.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo
asx=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo
wm=MPEGVideo
wma=MPEGVideo
wmv=MPEGVideo
wmx=MPEGVideo
wpl=MPEGVideo
wvx=MPEGVideo
m2v=MPEGVideo
mod=MPEGVideo
------------------------------------------------------------------------------------
Displaying AUTOEXEC.BAT:
------------------------------------------------------------------------------------
Displaying CONFIG.SYS:
------------------------------------------------------------------------------------
Displaying Running Processes:
PROCESS PID PRIO PATH
smss.exe 844 Normal C:\WINDOWS\System32\smss.exe
csrss.exe 892 Normal C:\WINDOWS\system32\csrss.exe
winlogon.exe 916 High C:\WINDOWS\system32\winlogon.exe
services.exe 960 Normal C:\WINDOWS\system32\services.exe
lsass.exe 972 Normal C:\WINDOWS\system32\lsass.exe
svchost.exe 1144 Normal C:\WINDOWS\system32\svchost.exe
svchost.exe 1232 Normal C:\WINDOWS\system32\svchost.exe
svchost.exe 1360 Normal C:\WINDOWS\System32\svchost.exe
svchost.exe 1476 Normal C:\WINDOWS\system32\svchost.exe
svchost.exe 1608 Normal C:\WINDOWS\system32\svchost.exe
sched.exe 1864 Normal C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe
avguard.exe 248 Normal C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe
IBGuard.EXE 292 Normal C:\Arquivos de programas\CAIXA\SEFIP\IB6\Bin\IBGuard.EXE
jqs.exe 308 Idle C:\Arquivos de programas\Java\jre6\bin\jqs.exe
MDM.EXE 348 Normal C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
Explorer.EXE 1332 Normal C:\WINDOWS\Explorer.EXE
SOUNDMAN.EXE 1604 Normal C:\WINDOWS\SOUNDMAN.EXE
VTTimer.exe 1628 Normal C:\WINDOWS\system32\VTTimer.exe
VTtrayp.exe 1672 Normal C:\WINDOWS\system32\VTtrayp.exe
GrooveMonitor.exe 1692 Normal C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe
jusched.exe 1916 Normal C:\Arquivos de programas\Java\jre6\bin\jusched.exe
ctfmon.exe 1940 Normal C:\WINDOWS\system32\ctfmon.exe
IBServer.exe 2000 Normal C:\Arquivos de programas\CAIXA\SEFIP\IB6\Bin\IBServer.exe
alg.exe 624 Normal C:\WINDOWS\System32\alg.exe
svchost.exe 544 Normal C:\WINDOWS\system32\svchost.exe
spoolsv.exe 1288 Normal C:\WINDOWS\system32\spoolsv.exe
lxbmcoms.exe 4076 High C:\WINDOWS\system32\lxbmcoms.exe
lxbmmon.exe 2016 Normal C:\Arquivos de programas\Lexmark 4200 Series\lxbmmon.exe
avgnt.exe 3320 Normal C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe
iexplore.exe 2856 Normal C:\Arquivos de programas\Internet Explorer\iexplore.exe
WLLoginProxy.exe 3172 Normal C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe
cmd.exe 128 Normal C:\WINDOWS\system32\cmd.exe
ntvdm.exe 1308 Normal C:\WINDOWS\system32\ntvdm.exe
wmiprvse.exe 3224 Normal C:\WINDOWS\system32\wbem\wmiprvse.exe
pv.exe 2896 Normal C:\ISEEYO~1\pv.exe
------------------------------------------------------------------------------------
Displaying Windows Services:
Microsoft (R) Windows Script Host Verso 5.7
Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados.
Name: Alerter
Display Name: Alerta
Description: Notifica os usurios e computadores selecionados de alertas administrativos. Se o servio for interrompido, os programas que usam alertas administrativos no os recebero. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados.
Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Disabled
State: Stopped
Name: ALG
Display Name: Servio 'Gateway de camada de aplicativo'
Description: Fornece suporte a plug-ins de protocolos de terceiros para o Compartilhamento de Conexo com a Internet e o Firewall do Windows.
Path Name: C:\WINDOWS\System32\alg.exe
Start Mode: Manual
State: Running
Name: AntiVirScheduler
Display Name: Avira AntiVir Personal - Free Antivirus Scheduler
Description: Service to schedule Avira AntiVir Personal - Free Antivirus jobs and updates.
Path Name: "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe"
Start Mode: Auto
State: Running
Name: AntiVirService
Display Name: Avira AntiVir Personal - Free Antivirus Guard
Description: Offers permanent protection against viruses and malware with the AntiVir search engine.
Path Name: "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe"
Start Mode: Auto
State: Running
Name: AppMgmt
Display Name: Gerenciamento de aplicativo
Description: Fornece servios de instalao de software como 'Atribuir', 'Publicar' e 'Remover'.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: AudioSrv
Display Name: udio do Windows
Description: Gerencia dispositivos de udio para programas baseados em Windows. Se este servio for interrompido, os dispositivos de udio e efeitos no funcionaro adequadamente. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: BITS
Display Name: Servio de transferncia inteligente de plano de fundo
Description: Transfere arquivos em segundo plano usando largura de banda de rede ociosa. Se o servio for parado, recursos como o Windows Update e o MSN Explorer no podero fazer o download automtico de programas e outras informaes. Se este servio for desativado, os servios que dependerem dele explicitamente talvez no transfiram arquivos, se no tiverem um mecanismo seguro para transferir arquivos diretamente pelo IE, caso o BITS tenha sido desativado.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: Browser
Display Name: Localizador de computadores
Description: Mantm uma lista atualizada de computadores na rede e fornece a computadores designados navegadores. Se este servio for interrompido, esta lista no ser atualizada ou mantida. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: CiSvc
Display Name: Indexing Service
Description: Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.
Path Name: C:\WINDOWS\system32\cisvc.exe
Start Mode: Manual
State: Stopped
Name: ClipSrv
Display Name: rea de armazenamento
Description: Permite que o 'Visualizador da rea de armazenamento' armazene informaes e compartilhe-as com computadores remotos. Se o servio for parado, o 'Visualizador da rea de armazenamento' no poder compartilhar informaes com computadores remotos. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\clipsrv.exe
Start Mode: Disabled
State: Stopped
Name: COMSysApp
Display Name: Aplicativo de sistema COM+
Description: Gerencia a configurao e o controle dos componentes baseados no modelo de objeto componente (COM)+. Se o servio parar, a maioria dos componentes baseados no COM+ no funcionar adequadamente. Se o servio for desativado, qualquer servio explicitamente dependente dele falhar ao ser iniciado.
Path Name: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Start Mode: Manual
State: Stopped
Name: CryptSvc
Display Name: Servios de criptografia
Description: Fornece trs servios de gerenciamento: servio de banco de dados de catlogo, que confirma as assinaturas dos arquivos do Windows; servio de raiz protegida, que adiciona e remove certificados de autoridades de certificao raiz deste computador, e o servio de chave, que ajuda a registrar este computador para certificados. Se este servio for interrompido, esses servios de gerenciamento no funcionaro adequadamente. Se este servio for desativado, quaisquer servios que dele dependam diretamente deixaro de ser iniciados.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: DcomLaunch
Display Name: Inicializador de Processo de Servidor DCOM
Description: Fornece funcionalidade de inicializao para servios DCOM.
Path Name: C:\WINDOWS\system32\svchost -k DcomLaunch
Start Mode: Auto
State: Running
Name: Dhcp
Display Name: Cliente DHCP
Description: Gerencia a configurao de rede registrando e atualizando endereos IP e nomes DNS.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: dmadmin
Display Name: Servio administrativo do gerenciador de disco lgico
Description: Configura volumes e unidades de disco rgido. O servio executado apenas para processos de configurao e depois pra.
Path Name: C:\WINDOWS\System32\dmadmin.exe /com
Start Mode: Manual
State: Stopped
Name: dmserver
Display Name: Gerenciador de discos lgicos
Description: Detecta e monitora novas unidades de disco rgido e envia as informaes de volume de disco para o servio administrativo de gerenciador de discos lgicos para configurao. Se este servio for parado, o status de disco dinmico e as informaes de configurao podem se tornar obsoletos. Se este servio for desativado, os servios que dependerem dele explicittamente no sero iniciados.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: Dnscache
Display Name: Cliente DNS
Description: Resolve e armazena em cache nomes Domain Name System (DNS) para este computador. Se este servio for parado, o computador no poder resolver nomes DNS nem localizador controladores de domnio do Active Directory. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\svchost.exe -k NetworkService
Start Mode: Auto
State: Running
Name: Dot3svc
Display Name: Configurao Automtica com Fio
Description: Este servio realiza uma autenticao IEEE 802.1X em interfaces Ethernet
Path Name: C:\WINDOWS\System32\svchost.exe -k dot3svc
Start Mode: Manual
State: Stopped
Name: EapHost
Display Name: Servio de EAP (Extensible Authentication Protocol)
Description: Fornece a clientes Windows o Servio de EAP (Extensible Authentication Protocol)
Path Name: C:\WINDOWS\System32\svchost.exe -k eapsvcs
Start Mode: Manual
State: Stopped
Name: ERSvc
Display Name: Error Reporting Service
Description: Allows error reporting for services and applictions running in non-standard environments.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: Eventlog
Display Name: Log de eventos
Description: Registra mensagens de eventos emitidas por Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.
Path Name: C:\WINDOWS\system32\services.exe
Start Mode: Auto
State: Running
Name: EventSystem
Display Name: Sistema de eventos COM+
Description: D suporte para o servio de notificao de eventos do sistema (SENS), o qual fornece distribuio automtica dos eventos para inscrever componentes do modelo de objeto componente (COM). Se o servio for interrompido, o SENS ser fechado e no poder fornecer notificaes de logon e logoff. Se o servio for desativado, qualquer servio explicitamente dependente dele ir falhar ao ser iniciado.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running
Name: FastUserSwitchingCompatibility
Display Name: Compatibilidade com 'Troca rpida de usurio'
Description: Fornece gerenciamento de aplicativos que exigem assistncia em um ambiente de vrios usurios.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running
Name: helpsvc
Display Name: Ajuda e suporte
Description: Permite que o 'Centro de ajuda e suporte' seja executado neste computador. Se esse servio for interrompido, o 'Centro de ajuda e suporte' no estar disponvel. Se esse servio for desativado, haver falha na inicializao de todos os servios que dependem dele de forma explcita.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: HidServ
Display Name: Acesso a dispositivo de interface humana
Description: Permite acesso de entrada genrica a dispositivos de interface humana (Human Interface Devices, HID), que ativam e mantm o uso de botes ativados predefinidos em teclados, controles remotos e outros dispositivos de multimdia. Se este servio for parado, os botes ativados controlados pelo servio deixaro de funcionar. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Disabled
State: Stopped
Name: hkmsvc
Display Name: Servio de Gerenciamento de Certificados e Chaves de Integridade
Description: Gerencia chaves e certificados de integridade (utilizado pelo NAP)
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: HTTPFilter
Display Name: HTTP SSL
Description: Este servio implementa o protocolo de transferncia segura de hipertexto (HTTPS) para o servio HTTP, usando a camada de soquete seguro (SSL). Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\System32\svchost.exe -k HTTPFilter
Start Mode: Manual
State: Stopped
Name: ImapiService
Display Name: IMAPI CD-Burning COM Service
Description: Gerencia a gravao de CDs por meio da interface IMAPI. Se esse servio for interrompido, o computador no poder gravar CDs. Se o servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados.
Path Name: C:\WINDOWS\system32\imapi.exe
Start Mode: Manual
State: Stopped
Name: InterbaseGuardian
Display Name: InterbaseGuardian
Description:
Path Name: C:\Arquivos de programas\CAIXA\SEFIP\IB6\Bin\IBGuard.EXE -s
Start Mode: Auto
State: Running
Name: InterbaseServer
Display Name: InterbaseServer
Description:
Path Name: C:\Arquivos de programas\CAIXA\SEFIP\IB6\Bin\IBServer.exe -s -g
Start Mode: Manual
State: Running
Name: JavaQuickStarterService
Display Name: Java Quick Starter
Description: Prefetches JRE files for faster startup of Java applets and applications
Path Name: "C:\Arquivos de programas\Java\jre6\bin\jqs.exe" -service -config "C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\jqs.conf"
Start Mode: Auto
State: Running
Name: lanmanserver
Display Name: Servidor
Description: Oferece suporte a compartilhamento na rede de arquivo, impresso e pipes nomeados para este computador. Se este servio for interrompido, quaisquer servios que dele dependam diretamente no sero inicializados.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: lanmanworkstation
Display Name: Estao de trabalho
Description: Cria e mantm conexes de rede de cliente com servidores remotos. Se este servio for interrompido, essas conexes no estaro disponveis. Se este servio for desativado, quaisquer servios que dele dependam no sero inicializados.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: LmHosts
Display Name: Auxiliar NetBIOS TCP/IP
Description: Ativa o suporte a NetBIOS atravs do servio TCP/IP (NetBT) e da resoluo de nomes NetBIOS.
Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Auto
State: Running
Name: MDM
Display Name: Machine Debug Manager
Description: Oferece suporte depurao local e remota a depuradores de script e ao Visual Studio. Se o servio for interrompido, os depuradores no funcionaro corretamente.
Path Name: "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE"
Start Mode: Auto
State: Running
Name: Messenger
Display Name: Mensageiro
Description: Transmite mensagens net send e do servio 'Alerta' entre clientes e servidores. Este servio no est relacionado ao Windows Messenger. Se este servio for interrompido, as mensagens do servio 'Alerta' no sero transmitidas. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Disabled
State: Stopped
Name: Microsoft Office Groove Audit Service
Display Name: Microsoft Office Groove Audit Service
Description:
Path Name: "C:\Arquivos de programas\Microsoft Office\Office12\GrooveAuditService.exe"
Start Mode: Manual
State: Stopped
Name: mnmsrvc
Display Name: Compartilhamento remoto da rea de trabalho do NetMeeting
Description: Habilita um usurio autorizado a acessar este computador remotamente por meio do NetMeeting em uma intranet corporativa. Se este servio for interrompido, o compartilhamento da rea de trabalho remota no estar disponvel. Se este servio for desabilitado, quaisquer servios que dele dependam no sero iniciados.
Path Name: C:\WINDOWS\system32\mnmsrvc.exe
Start Mode: Manual
State: Stopped
Name: MSDTC
Display Name: Coordenador de transaes distribudas
Description: Coordena transaes que abrangem mltiplos gerenciadores de recursos, tais como bancos de dados, filas de mensagens e sistemas de arquivos. Se este servio for interrompido, essas transaes no ocorrero. Se este servio for desativado, os servios que dependem explicitamente dele falharo ao serem iniciados.
Path Name: C:\WINDOWS\system32\msdtc.exe
Start Mode: Manual
State: Stopped
Name: MSIServer
Display Name: Windows Installer
Description: Adiciona, modifica e remove aplicativos fornecidos como um pacote do Windows Installer (*.msi). Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\msiexec.exe /V
Start Mode: Manual
State: Stopped
Name: napagent
Display Name: Agente de Proteo de Acesso Rede
Description: Permite que clientes Windows participem da Proteo de Acesso Rede
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: NBService
Display Name: NBService
Description: Nero BackItUp Service is responsible to control all jobs created using Nero BackItUp. These jobs can create backups of selected files/folders/partitions or complete hard disk to hard disk, network drive, CD/DVD or FTP.
Path Name: C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
Start Mode: Manual
State: Stopped
Name: NetDDE
Display Name: DDE de rede
Description: Fornece transporte e segurana de rede para Dynamic Data Exchange (DDE) para programas executados no mesmo computador ou em computadores diferentes. Se este servio for parado, o transporte e segurana DDE no estaro disponveis. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\netdde.exe
Start Mode: Disabled
State: Stopped
Name: NetDDEdsdm
Display Name: DSDM de DDE de rede
Description: Gerencia compartilhamentos de rede do tipo DDE (Dynamic Data Exchange). Se este servio for parado, os compartilhamentos de rede DDE no estaro disponveis. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\netdde.exe
Start Mode: Disabled
State: Stopped
Name: Netlogon
Display Name: Logon de rede
Description: D suporte autenticao de passagem de eventos de logon de contas para os computadores de um domnio.
Path Name: C:\WINDOWS\system32\lsass.exe
Start Mode: Manual
State: Stopped
Name: Netman
Display Name: Conexes de rede
Description: Gerencia objetos da pasta de conexes de rede e Dial-Up, na qual voc pode exibir conexes remotas e de rede local.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running
Name: Nla
Display Name: Reconhecimento de local da rede (NLA)
Description: Rene e armazena informaes sobre configuraes e locais da rede, bem como notifica os aplicativos quando essas informaes so alteradas.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running
Name: NtLmSsp
Display Name: Fornecedor de suporte de segurana NT LM
Description: Fornece segurana a programas de chamada de procedimento remoto (remote procedure call, RPC) que usam transportes que no pipes nomeados.
Path Name: C:\WINDOWS\system32\lsass.exe
Start Mode: Manual
State: Stopped
Name: NtmsSvc
Display Name: Armazenamento removvel
Description:
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: NVSvc
Display Name: NVIDIA Display Driver Service
Description: Provides system and desktop level support to the NVIDIA display driver
Path Name: C:\WINDOWS\system32\nvsvc32.exe
Start Mode: Auto
State: Stopped
Name: odserv
Display Name: Microsoft Office Diagnostics Service
Description: Executar partes do Diagnstico do Microsoft Office.
Path Name: "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\ODSERV.EXE"
Start Mode: Manual
State: Stopped
Name: ose
Display Name: Office Source Engine
Description: Salva os arquivos de instalao utilizados em atualizaes e reparos. necessrio para o download das atualizaes de instalao e dos relatrios de erro do Watson.
Path Name: "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE"
Start Mode: Manual
State: Stopped
Name: PlugPlay
Display Name: Plug and Play
Description: Permite que um computador reconhea e se adapte a alteraes de hardware com pouca ou nenhuma interveno do usurio. Se este servio for parado ou desativado, o sistema se tornar instvel.
Path Name: C:\WINDOWS\system32\services.exe
Start Mode: Auto
State: Running
Name: PolicyAgent
Display Name: Servios IPSEC
Description: Gerencia a diretiva de segurana IP e inicia o ISAKMP/Oakley (IKE) e o driver de segurana IP.
Path Name: C:\WINDOWS\system32\lsass.exe
Start Mode: Auto
State: Running
Name: ProtectedStorage
Display Name: Armazenamento protegido
Description: Fornece o armazenamento protegido para dados sensveis, como chaves privadas, para evitar o acesso de servios, processos ou usurios sem autorizao.
Path Name: C:\WINDOWS\system32\lsass.exe
Start Mode: Auto
State: Running
Name: RasAuto
Display Name: Gerenciador de conexo de acesso remoto automtico
Description: Cria uma conexo a uma rede remota sempre que um programa faz referncia a um nome ou endereo remoto DNS ou NetBios.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: RasMan
Display Name: Gerenciador de conexo de acesso remoto
Description: Cria uma conexo de rede.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running
Name: RDSessMgr
Display Name: Gerenciador de sesso de ajuda de rea de trabalho remota
Description: Gerencia e controla a 'Assistncia remota'. Se esse servio for interrompido, a 'Assistncia remota' ficar indisponvel. Antes de interromper esse servio, consulte a guia 'Dependncias' da caixa de dilogo 'Propriedades'.
Path Name: C:\WINDOWS\system32\sessmgr.exe
Start Mode: Manual
State: Stopped
Name: RemoteAccess
Display Name: Roteamento e acesso remoto
Description: Oferece servios de roteamento a empresas em ambientes de rede local e de longa distncia.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Disabled
State: Stopped
Name: RemoteRegistry
Display Name: Registro remoto
Description: Permite que usurios remotos modifiquem configuraes do Registro neste computador. Se este servio for parado, o Registro s poder ser modificado por usurios deste computador. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Auto
State: Running
Name: RpcLocator
Display Name: Alocador Remote Procedure Call (RPC)
Description: Gerencia o banco de dados do servio de nomes RPC.
Path Name: C:\WINDOWS\system32\locator.exe
Start Mode: Manual
State: Stopped
Name: RpcSs
Display Name: Chamada de procedimento remoto (RPC)
Description: Fornece o mapeador de ponto de extremidade e outros servios RPC variados.
Path Name: C:\WINDOWS\system32\svchost -k rpcss
Start Mode: Auto
State: Running
Name: RSVP
Display Name: QoS RSVP
Description: Fornece a funcionalidade de sinalizao de rede e configurao do controle do trfego local para programas compatveis com QoS e miniaplicativos de controle.
Path Name: C:\WINDOWS\system32\rsvp.exe
Start Mode: Manual
State: Stopped
Name: SamSs
Display Name: Gerenciador de contas de segurana
Description: Armazena informaes sobre segurana para contas de usurio local.
Path Name: C:\WINDOWS\system32\lsass.exe
Start Mode: Auto
State: Running
Name: SCardSvr
Display Name: Carto inteligente
Description: Gerencia o acesso a leitores de carto inteligente por este computador. Se este servio for parado, o computador no poder ler cartes inteligentes. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\System32\SCardSvr.exe
Start Mode: Manual
State: Stopped
Name: Schedule
Display Name: Agendador de tarefas
Description: Permite que um usurio configure e agende tarefas automatizadas no computador. Se este servio for interrompido, essas tarefas no sero executadas nos horrios agendados. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: seclogon
Display Name: Logon secundrio
Description: Ativa a inicializao de processos sob credenciais alternadas. Se este servio for interrompido, este tipo de acesso por logon no estar disponvel. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: SENS
Display Name: Notificao de eventos de sistema
Description: Rastreia eventos do sistema como eventos de logon do Windows, rede e energia. Notifica assinantes do Sistema de evento COM+ destes eventos.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: SharedAccess
Display Name: Firewall do Windows/Compartilhamento de Conexo com a Internet (ICS)
Description: Fornece servios de converso de endereos de rede, endereamento e resoluo de nomes e/ou preveno de invaso para uma rede domstica ou de pequena empresa.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: ShellHWDetection
Display Name: Deteco do hardware do shell
Description: Fornece notificaes de eventos de hardware 'Reproduo automtica'.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: Spooler
Display Name: Spooler de impresso
Description: Carrega arquivos na memria para impresso posterior.
Path Name: C:\WINDOWS\system32\spoolsv.exe
Start Mode: Auto
State: Running
Name: srservice
Display Name: Servio de restaurao do sistema
Description: Executa funes de restaurao do sistema. Para interromper o servio, desative a 'Restaurao do sistema' na guia 'Restaurao do sistema' em 'Meu computador' -> 'Propriedades'
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Stopped
Name: SSDPSRV
Display Name: Servio de descoberta SSDP
Description: Ativa a descoberta de dispositivos UPnP na rede domstica.
Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Manual
State: Running
Name: stisvc
Display Name: Assistente de aquisio de imagens do Windows (WIA)
Description: Fornece servios de aquisio de imagens para scanners e cmeras
Path Name: C:\WINDOWS\system32\svchost.exe -k imgsvc
Start Mode: Auto
State: Running
Name: SwPrv
Display Name: MS Software Shadow Copy Provider
Description: Gerencia cpias de sombra de volume baseadas em software obtidas pelo servio de cpias de sombra de volume. Se o servio for interrompido, as cpias de sombra baseadas em software no podero ser gerenciadas. Se o servio for desativado, os servios que dependerem dele diretamente no sero iniciados.
Path Name: C:\WINDOWS\system32\dllhost.exe /Processid:{386AF2D7-CF89-4461-8655-1175F206CB57}
Start Mode: Manual
State: Stopped
Name: SysmonLog
Display Name: Logs e alertas de desempenho
Description: Coleta dados de desempenho de computadores locais ou remotos com base em parmetros de agendamento pr-configurados; em seguida, grava os dados em um log ou dispara um alerta. Se este servio for parado, as informaes de desempenho no sero coletadas. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\smlogsvc.exe
Start Mode: Manual
State: Stopped
Name: TapiSrv
Display Name: Telefonia
Description: Fornece suporte telefonia API (TAPI) para programas que controlam dispositivos de telefonia e conexes de voz baseadas em IP no computador local e, atravs da rede local, em servidores que tambm esto executando o servio.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running
Name: TermService
Display Name: Servios de terminal
Description: Permite que vrios usurios sejam conectados interativamente a um computador e que as reas de trabalho e os aplicativos sejam exibidos a computadores remotos. A base da rea de trabalho remota (inclusive a rea de trabalho remota para administradores), da opo de alternar-se rapidamente entre usurios, da assistncia remota e do Terminal Server.
Path Name: C:\WINDOWS\System32\svchost -k DComLaunch
Start Mode: Manual
State: Running
Name: Themes
Display Name: Temas
Description: Fornece gerenciamento de temas para experincia do usurio.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: TlntSvr
Display Name: Telnet
Description: Permite que um usurio remoto faa logon neste computador e execute programas. Fornece suporte a vrios clientes Telnet TCP/IP, inclusive computadores baseados em UNIX e Windows. Se este servio for parado, o acesso de usurios remotos a programas poder no estar disponvel. Se este servio for desativado, os servios que dependem dele explicitamente no sero iniciados.
Path Name: C:\WINDOWS\system32\tlntsvr.exe
Start Mode: Disabled
State: Stopped
Name: TrkWks
Display Name: Cliente de rastreamento de link distribudo
Description: Mantm vnculos entre arquivos NTFS em um computador ou entre computadores em um domnio de rede.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: upnphost
Display Name: Host de dispositivo Plug and Play universal
Description: Oferece suporte para hospedar dispositivos Plug and Play universais.
Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Manual
State: Stopped
Name: UPS
Display Name: Uninterruptible Power Supply
Description: Manages an uninterruptible power supply (UPS) connected to the computer.
Path Name: C:\WINDOWS\System32\ups.exe
Start Mode: Manual
State: Stopped
Name: usnjsvc
Display Name: Servio de Compartilhamento de Pastas Messenger do USN Journal Reader
Description: Servio instalado pelo Messenger para habilitar cenrios de compartilhamento
Path Name: "C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe"
Start Mode: Manual
State: Stopped
Name: VSS
Display Name: Cpia de volume em memria
Description: Gerencia e implementa cpias de volume em memria usados para o backup e outros propsitos. Se este servio for interrompido, as cpias em memria no estaro disponveis para backup e o backup pode falhar. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados.
Path Name: C:\WINDOWS\System32\vssvc.exe
Start Mode: Manual
State: Stopped
Name: W32Time
Display Name: Horrio do Windows
Description: Mantm sincronizao de data e hora em todos os clientes e servidores da rede. Se este servio for interrompido, a sincronizao no ficar disponvel. Se este servio for desativado, os servios que dele dependem explicitamente no sero iniciados.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: WebClient
Display Name: Cliente da Web
Description: Permite que programas baseados em Windows criem, acessem e modifiquem arquivos baseados na Internet. Se este servio for interrompido, essas funes no estaro disponveis. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados.
Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Auto
State: Running
Name: winmgmt
Display Name: Testador de instrumentao de gerenciam. do Windows
Description: Fornece uma interface comum e um modelo de objeto para o acesso a informaes de gerenciamento sobre o sistema operacional, dispositivos, aplicativos e servios. Se esse servio for parado, a maioria dos itens de software baseados no Windows no funcionar corretamente. Se este servio for desativado, os servios que dependerem explicitamente dele no sero iniciados.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: WLSetupSvc
Display Name: Windows Live Setup Service
Description: Windows Live Setup Service
Path Name: "C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe"
Start Mode: Manual
State: Stopped
Name: WmdmPmSN
Display Name: Servio de Nmero de Srie de Mdia Porttil
Description: Recupera o nmero de srie de qualquer player de mdia porttil conectado a seu computador. Se este servio for interrompido, o contedo protegido pode no ser baixado para o dispositivo.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: Wmi
Display Name: Extenses de driver de instrum. gerenc. do Windows
Description: Fornece informaes sobre gerenciamento de sistemas para drivers e de drivers.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: WmiApSrv
Display Name: Adaptador de desempenho WMI
Description: Fornece informaes da biblioteca de desempenho dos provedores HiPerf WMI.
Path Name: C:\WINDOWS\system32\wbem\wmiapsrv.exe
Start Mode: Manual
State: Stopped
Name: WMPNetworkSvc
Display Name: Servio de Compartilhamento de Rede do Windows Media Player
Description: Compartilha bibliotecas do Windows Media Player com outros players e dispositivos de mdia da rede por meio de Universal Plug and Play
Path Name: "C:\Arquivos de programas\Windows Media Player\WMPNetwk.exe"
Start Mode: Manual
State: Stopped
Name: wscsvc
Display Name: Central de Segurana
Description: Monita as definies e configuraes de segurana do sistema.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: wuauserv
Display Name: Atualizaes Automticas
Description: Ativa o download e instalao das atualizaes do site Windows Update. Se o servio for desativado, o computador no poder usar o recurso Atualizaes automticas do site Windows Update.
Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: WudfSvc
Display Name: Windows Driver Foundation - User-mode Driver Framework
Description: Manages user-mode driver host processes
Path Name: C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
Start Mode: Manual
State: Stopped
Name: WZCSVC
Display Name: Configurao zero sem fio
Description: Fornece configurao automtica para os adaptadores 802.11
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running
Name: xmlprov
Display Name: Servio de Configurao de Rede
Description: Gerencia arquivos de configurao XML por domnio para configurao automtica de rede.
Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped
Name: lxbm_device
Display Name: lxbm_device
Description:
Path Name: C:\WINDOWS\system32\lxbmcoms.exe -service
Start Mode: Auto
State: Running
------------------------------------------------------------------------------------
Displaying LOG for Microsoft Windows Malicious Software Removal Tool:
---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v1.42, June 2008
Started On Fri Jun 20 10:07:29 2008
Results Summary:
----------------
No infection found.
Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Fri Jun 20 10:08:46 2008
---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v2.0, July 2008
Started On Mon Jul 21 11:36:42 2008
Results Summary:
----------------
No infection found.
Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Mon Jul 21 11:37:17 2008
---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v2.1, August 2008
Started On Thu Aug 14 09:06:01 2008
Results Summary:
----------------
No infection found.
Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Aug 14 09:06:57 2008
---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v2.2, September 2008
Started On Thu Sep 11 08:58:00 2008
Results Summary:
----------------
No infection found.
Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Thu Sep 11 08:58:59 2008
----------------------------------------------------------------------------
Listing HKCU Explorer\Advanced//Hidden and SuperHidden Registry Keys
if Hidden = 0 then Hidden Files and Folders are not shown
if SuperHidden = 1 is the desired default value.
if ShowSuperHidden = 0 then System Files are not shown
if HideFileExt = 1 then File Extension are not shown
We want their values to be (from top to bottom) 1,1,1,0
----------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced
Hidden REG_DWORD 1 (0x1)
SuperHidden REG_DWORD 1 (0x1)
ShowSuperHidden REG_DWORD 1 (0x1)
HideFileExt REG_DWORD 0 (0x0)
************************************************************************************
Examining Select Windows Registry Keys
------------------------------------------------------------------------------------
--------------------------------------------------------------------------
Items Found in ZoneMap\Domains:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains
<NO NAME> REG_SZ
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains\msn.com
----------------------------------------------------------------------------
Current User ZoneMap ProtocolDefaults
----------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\protocoldefaults
<NO NAME> REG_SZ
http REG_DWORD 3 (0x3)
https REG_DWORD 3 (0x3)
ftp REG_DWORD 3 (0x3)
file REG_DWORD 3 (0x3)
@ivt REG_DWORD 1 (0x1)
shell REG_DWORD 0 (0x0)
----------------------------------------------------------------------------
Default URL Prefix Keys
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\DefaultPrefix
<NO NAME> REG_SZ http://
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\Prefixes
ftp REG_SZ ftp://
gopher REG_SZ gopher://
home REG_SZ http://
mosaic REG_SZ http://
www REG_SZ http://
--------------------------------------------------------------------------
Startup Items Disabled via MSCONFIG:
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Select AutoRun Registry Keys:
--------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
SoundMan REG_SZ SOUNDMAN.EXE
VTTimer REG_SZ VTTimer.exe
VTTrayp REG_SZ VTtrayp.exe
Adobe Reader Speed Launcher REG_SZ "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
GrooveMonitor REG_SZ "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"
avgnt REG_SZ "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
SunJavaUpdateSched REG_SZ "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"
lxbmmon.exe REG_SZ "C:\Arquivos de programas\Lexmark 4200 Series\lxbmmon.exe"
Lexmark 4200 Series Fax Server REG_SZ "C:\Arquivos de programas\Lexmark 4200 Series\fm3032.exe" /s
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce
HKEY_USERS\.default\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce
HKEY_USERS\s-1-5-19\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
HKEY_USERS\s-1-5-20\software\microsoft\windows\currentversion\run
CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE
--------------------------------------------------------------------------
WinLogon Notify Registry Key:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain
Asynchronous REG_DWORD 0 (0x0)
Impersonate REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ crypt32.dll
Logoff REG_SZ ChainWlxLogoffEvent
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet
Asynchronous REG_DWORD 0 (0x0)
Impersonate REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ cryptnet.dll
Logoff REG_SZ CryptnetWlxLogoffEvent
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll
DLLName REG_SZ cscdll.dll
Logon REG_SZ WinlogonLogonEvent
Logoff REG_SZ WinlogonLogoffEvent
ScreenSaver REG_SZ WinlogonScreenSaverEvent
Startup REG_SZ WinlogonStartupEvent
Shutdown REG_SZ WinlogonShutdownEvent
StartShell REG_SZ WinlogonStartShellEvent
Impersonate REG_DWORD 0 (0x0)
Asynchronous REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy
Asynchronous REG_DWORD 1 (0x1)
DllName REG_EXPAND_SZ %SystemRoot%\System32\dimsntfy.dll
Startup REG_SZ WlDimsStartup
Shutdown REG_SZ WlDimsShutdown
Logon REG_SZ WlDimsLogon
Logoff REG_SZ WlDimsLogoff
StartShell REG_SZ WlDimsStartShell
Lock REG_SZ WlDimsLock
Unlock REG_SZ WlDimsUnlock
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp
DLLName REG_SZ wlnotify.dll
Logon REG_SZ SCardStartCertProp
Logoff REG_SZ SCardStopCertProp
Lock REG_SZ SCardSuspendCertProp
Unlock REG_SZ SCardResumeCertProp
Enabled REG_DWORD 1 (0x1)
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule
Asynchronous REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ wlnotify.dll
Impersonate REG_DWORD 0 (0x0)
StartShell REG_SZ SchedStartShell
Logoff REG_SZ SchedEventLogOff
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy
Logoff REG_SZ WLEventLogoff
Impersonate REG_DWORD 0 (0x0)
Asynchronous REG_DWORD 1 (0x1)
DllName REG_EXPAND_SZ sclgntfy.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn
DLLName REG_SZ WlNotify.dll
Lock REG_SZ SensLockEvent
Logon REG_SZ SensLogonEvent
Logoff REG_SZ SensLogoffEvent
Safe REG_DWORD 1 (0x1)
MaxWait REG_DWORD 600 (0x258)
StartScreenSaver REG_SZ SensStartScreenSaverEvent
StopScreenSaver REG_SZ SensStopScreenSaverEvent
Startup REG_SZ SensStartupEvent
Shutdown REG_SZ SensShutdownEvent
StartShell REG_SZ SensStartShellEvent
PostShell REG_SZ SensPostShellEvent
Disconnect REG_SZ SensDisconnectEvent
Reconnect REG_SZ SensReconnectEvent
Unlock REG_SZ SensUnlockEvent
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv
Asynchronous REG_DWORD 0 (0x0)
DllName REG_EXPAND_SZ wlnotify.dll
Impersonate REG_DWORD 0 (0x0)
Logoff REG_SZ TSEventLogoff
Logon REG_SZ TSEventLogon
PostShell REG_SZ TSEventPostShell
Shutdown REG_SZ TSEventShutdown
StartShell REG_SZ TSEventStartShell
Startup REG_SZ TSEventStartup
MaxWait REG_DWORD 600 (0x258)
Reconnect REG_SZ TSEventReconnect
Disconnect REG_SZ TSEventDisconnect
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon
Logon REG_SZ WLEventLogon
Logoff REG_SZ WLEventLogoff
Startup REG_SZ WLEventStartup
Shutdown REG_SZ WLEventShutdown
StartScreenSaver REG_SZ WLEventStartScreenSaver
StopScreenSaver REG_SZ WLEventStopScreenSaver
Lock REG_SZ WLEventLock
Unlock REG_SZ WLEventUnlock
StartShell REG_SZ WLEventStartShell
PostShell REG_SZ WLEventPostShell
Disconnect REG_SZ WLEventDisconnect
Reconnect REG_SZ WLEventReconnect
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 0 (0x0)
SafeMode REG_DWORD 1 (0x1)
MaxWait REG_DWORD -1 (0xffffffff)
DllName REG_EXPAND_SZ WgaLogon.dll
Event REG_DWORD 0 (0x0)
EulaAccepted REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings
Data REG_BINARY 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d986e588a9a3cb46affac3e8de1ad05e04000000040000005300000003660000a8000000100000002c2f4d014b8e778635efc220212058b20000000004800000a000000010000000277653644e522333565aca8a48a64819b0010000975129325631110f7aeeabf8b5960556605939dd8acc76863a3b7080421ab5ff301b821fa6afbe00d9abe9372bbad1fd854123c7801f57a9aa78ed8ebb4ce3b0241d9ae4ba5b10b09d08dbec7e7c6c4b838c273effcfb1413d5c7154230d153a8472442b15022e68212d76e9c7d2a3b937e08459d8c24d5c6e7da44522bff3a5704a48c17eea0ce9f8ff1ad6236944d3930cdc70cb1a1799132bb70645608a93d079505c744acdc7644a27a354cdaf90e00ec7e496eb56edf777b1111e355f44db7069519f37815bba8db113292eca11760446fdecfbe27790d96db5b6b0062e3f231495a0ff8f293f7471b12f0fd06ab493f32d2d4f7b1fac58814db4d18a3036ae29efc348e46dd8a2b4f65ffc37f8bade28d2a803bc7293da7652052351bdfc3bb3a2ff878285f56d63858c81889601638ef7ed1e14a42a91e12746a211b621899a829074588a1aad7a67d426fb59e5e04b4cad9cb618cb56ee4f0416978aa7f051038d63911d11858a47a19104ce1b45fab367efbec097eec11d282fff219edc1a9770ad7733aaaaae6ab91d55b11ec5dc3cc432428de41288678ebbe067118a2fa63d43a9ff63ada91c3930eee71400000045d054cb71205544282e0ab7576dbd71bf60e919
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon
DLLName REG_SZ wlnotify.dll
Logon REG_SZ RegisterTicketExpiredNotificationEvent
Logoff REG_SZ UnregisterTicketExpiredNotificationEvent
Impersonate REG_DWORD 1 (0x1)
Asynchronous REG_DWORD 1 (0x1)
--------------------------------------------------------------------------
Shared Task Scheduler Registry Items:
--------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler
{438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Pr-carregador Browseui
{8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Daemon de cache de categorias de componente
--------------------------------------------------------------------------
Scheduled Tasks:
--------------------------------------------------------------------------
O volume na unidade C no tem nome.
O nmero de srie do volume F8F7-868A
Pasta de C:\WINDOWS\tasks
25/08/2008 12:00 <DIR> .
25/08/2008 12:00 <DIR> ..
28/10/2001 15:07 65 desktop.ini
31/10/2008 07:57 6 SA.DAT
2 arquivo(s) 71 bytes
Total de arquivos na lista:
2 arquivo(s) 71 bytes
2 pasta(s) 68.033.216.512 bytes disponveis
HR C:\WINDOWS\tasks\desktop.ini
A H C:\WINDOWS\tasks\SA.DAT
----------------------------------------------------------------------------
ShellExecuteHooks Registry Keys
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} REG_SZ Groove GFS Stub Execution Hook
----------------------------------------------------------------------------
ShellServiceObjectDelayLoad Registry Keys
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload
PostBootReminder REG_SZ {7849596a-48ea-486e-8937-a2a3009f31a9}
CDBurn REG_SZ {fbeb8a05-beee-4442-804e-409d6c4515e9}
WebCheck REG_SZ {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
SysTray REG_SZ {35CEC8A3-2BE6-11D2-8773-92E220524153}
WPDShServiceObj REG_SZ {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
----------------------------------------------------------------------------
ModuleUsage Registry Keys:
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/zylomgamesplayer.dll
.Owner REG_SZ {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} REG_SZ
----------------------------------------------------------------------------
BHO Registry Keys:
----------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer
<NO NAME> REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
<NO NAME> REG_SZ
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
<NO NAME> REG_SZ
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
NoExplorer REG_DWORD 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}
<NO NAME> REG_SZ
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}
--------------------------------------------------------------------------
Select Policy Keys:
--------------------------------------------------------------------------
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer
NoDrives REG_DWORD 0 (0x0)
NoSaveSettings REG_DWORD 0 (0x0)
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system
HideLegacyLogonScripts REG_DWORD 0 (0x0)
HideLogoffScripts REG_DWORD 0 (0x0)
HideStartupScripts REG_DWORD 0 (0x0)
RunLogonScriptSync REG_DWORD 1 (0x1)
RunStartupScriptSync REG_DWORD 0 (0x0)
HKEY_CURRENT_USER\software\policies\microsoft\internet explorer
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer
NoDriveTypeAutoRun REG_DWORD 227 (0xe3)
NoDrives REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
HideLegacyLogonScripts REG_DWORD 0 (0x0)
HideLogoffScripts REG_DWORD 0 (0x0)
RunLogonScriptSync REG_DWORD 1 (0x1)
RunStartupScriptSync REG_DWORD 0 (0x0)
HideStartupScripts REG_DWORD 0 (0x0)
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\Explorer
HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run
HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system
************************************************************************************
Checking File System for suspicious Files
--------------------------------------------------------------------------
Items in the Root Directory:
--------------------------------------------------------------------------
Locating all files created in C:\
"C:\"
0478BC~1 6 May 2008 "0478bcec9febbfbe5329b11f57"
ACDSEE~1 23 May 2008 "AcdseePro"
acesso.dbf 26 May 2008 451 "ACESSO.DBF"
ACROBAT8 23 May 2008 "Acrobat8"
ARQUIV~1 5 May 2008 "Arquivos de programas"
autoexec.bat 6 May 2008 0 "AUTOEXEC.BAT"
boot.bak 5 May 2008 223 "Boot.bak"
boot.ini 21 Oct 2008 293 "boot.ini"
bootfont.bin 28 Oct 2001 4952 "Bootfont.bin"
CAGED 23 May 2008 "CAGED"
CAIXA 26 May 2008 "caixa"
CERTIF~1 23 May 2008 "Certificados Conectividade"
CLONECD 23 May 2008 "CloneCD"
CMDCONS 21 Oct 2008 "cmdcons"
cmldr 3 Aug 2004 261856 "cmldr"
COMBOFIX 28 Oct 2008 "ComboFix"
combofix.exe 29 Apr 2008 1778983 "ComboFix.exe"
combofix.txt 24 Oct 2008 7060 "ComboFix.txt"
config.001 28 Nov 2007 0 "CONFIG.001"
config.sys 6 May 2008 0 "CONFIG.SYS"
cor.dbf 26 May 2008 576 "COR.DBF"
DATABASE 23 May 2008 "database"
DOCUME~1 5 May 2008 "Documents and Settings"
EASYCL~1 23 May 2008 "EasyCleaner"
EVEREST 23 May 2008 "Everest"
flpg.txt 26 May 2008 67 "FLPG.TXT"
FOTOS 23 May 2008 "Fotos"
GDRAIS~1 23 May 2008 "GDRais2007"
GDRAIS~2 9 Sep 2008 "GDRaisGenerico76_06"
gtb.cab 9 Sep 2008 1091496 "GTB.cab"
HIJACK~1 16 Oct 2008 "hijackthis"
io.sys 6 May 2008 0 "IO.SYS"
ISEEYO~1 31 Oct 2008 "ISeeYouXP"
kav70p~1.pdf 5 Sep 2007 2684884 "kav7.0pb.pdf"
kavbr~1.msi 3 Mar 2008 31896064 "kav.br.msi"
LEI 23 May 2008 "Lei"
listafol.dbf 26 May 2008 163 "LISTAFOL.DBF"
LIXO 23 May 2008 "Lixo"
msdos.sys 6 May 2008 0 "MSDOS.SYS"
MSJVM 23 May 2008 "MSJVM"
MSNCLE~1 29 Oct 2008 "MsnCleaner"
MSOCACHE 5 May 2008 "MSOCache"
MYSHAR~1 23 May 2008 "My Shared Folder"
NAV2007 23 May 2008 "Nav2007"
NERO7~1 23 May 2008 "Nero 7"
ntdetect.com 3 Aug 2004 47564 "NTDETECT.COM"
ntldr 9 Sep 2008 251696 "ntldr"
OFFICE~1 23 May 2008 "Office2000"
pagefile.sys 31 Oct 2008 1559171072 "pagefile.sys"
pdoxusrs.net 8 Jan 2008 13030 "PDOXUSRS.NET"
playgr~1.log 22 Oct 2008 601 "playground.log"
PROJETOZ 23 May 2008 "ProjetoZ"
prox.log 30 Oct 2008 25275736 "prox.log"
QOOBOX 21 Oct 2008 "Qoobox"
RAISNE~1 23 May 2008 "RaisNet2007"
RECYCLER 24 Oct 2008 "RECYCLER"
REGDOC~1 23 May 2008 "RegDoctor"
rhdsetup.log 5 May 2008 583 "RHDSetup.log"
safebo~1.txt 23 Oct 2008 14621 "SAFEBOOT_REPAIR.TXT"
setup.reg 3 Jul 2008 646 "setup.reg"
SICALCP 23 May 2008 "Sicalcp"
SPYBOT 23 May 2008 "Spybot"
sq2fa0~1.sqm 30 Sep 2008 244 "sqmnoopt06.sqm"
sq2fa4~1.sqm 16 Oct 2008 244 "sqmnoopt07.sqm"
sq2fa8~1.sqm 12 Sep 2008 244 "sqmnoopt04.sqm"
sq2fac~1.sqm 12 Sep 2008 244 "sqmnoopt05.sqm"
sqa37a~1.sqm 12 Sep 2008 268 "sqmdata04.sqm"
sqa77a~1.sqm 12 Sep 2008 268 "sqmdata05.sqm"
sqab7a~1.sqm 30 Sep 2008 268 "sqmdata06.sqm"
sqaf7a~1.sqm 16 Oct 2008 232 "sqmdata07.sqm"
sqmdat~1.sqm 5 May 2008 268 "sqmdata00.sqm"
sqmdat~2.sqm 26 May 2008 268 "sqmdata01.sqm"
sqmdat~3.sqm 13 Jun 2008 268 "sqmdata02.sqm"
sqmdat~4.sqm 27 Jun 2008 268 "sqmdata03.sqm"
sqmnoo~1.sqm 5 May 2008 244 "sqmnoopt00.sqm"
sqmnoo~2.sqm 26 May 2008 244 "sqmnoopt01.sqm"
sqmnoo~3.sqm 13 Jun 2008 244 "sqmnoopt02.sqm"
sqmnoo~4.sqm 27 Jun 2008 244 "sqmnoopt03.sqm"
SYSTEM~1 5 May 2008 "System Volume Information"
WINDOWS 5 May 2008 "WINDOWS"
WINZIP 23 May 2008 "Winzip"
XTRATO~1 23 May 2008 "XtraTools"
_ISTMP1.DIR 23 May 2008 "_ISTMP1.DIR"
83 items found: 43 files (24 H/S), 40 directories (4 H/S).
Total of file sizes: 1.622.506.677 bytes 1,51 G
--------------------------------------------------------------------------
Locating all Backup files on C:
--------------------------------------------------------------------------
Locating all *.BAK* files
"C:\"
boot.bak 5 May 2008 223 "Boot.bak"
"C:\WINDOWS\"
imsins.bak 11 Sep 2008 1374 "imsins.BAK"
"C:\Arquivos de programas\eMule\"
downlo~1.bak 16 Sep 2008 584 "downloads.bak"
"C:\Arquivos de programas\LG SyncAgent\"
aboutv~1.bak 16 Mar 2006 184 "About.ver.bak"
"C:\Arquivos de programas\eMule\config\"
client~1.bak 18 Aug 2008 8335 "clients.met.bak"
"C:\WINDOWS\Debug\Setup\"
updsh.bak 9 Sep 2008 660122 "UpdSh.bak"
"C:\WINDOWS\Debug\UserMode\"
userenv.bak 27 Aug 2008 308336 "userenv.bak"
"C:\WINDOWS\system32\config\"
default.bak 24 Oct 2008 286720 "default.bak"
sam.bak 24 Oct 2008 24576 "SAM.bak"
security.bak 24 Oct 2008 45056 "SECURITY.bak"
software.bak 24 Oct 2008 29876224 "software.bak"
system.bak 24 Oct 2008 6291456 "system.bak"
"C:\WINDOWS\Debug\Setup\Backup\"
hdaudi~1.bak 9 Sep 2008 0 "HDAUDIO_Backup.bak"
ie7_ba~1.bak 9 Sep 2008 0 "IE7_Backup.bak"
intppm~1.bak 9 Sep 2008 4 "INTPPM_Backup.bak"
"C:\WINDOWS\pchealth\helpctr\Config\Cache\"
profes~1.bak 27 May 2008 181254 "Professional_32_1046.dat.bak"
"C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\OFFICE\DATA\"
opa11.bak 17 Oct 2002 8200 "OPA11.BAK"
opa12.bak 17 Oct 2002 8200 "OPA12.BAK"
18 items found: 18 files, 0 directories.
Total of file sizes: 37.700.848 bytes 35,95 M
--------------------------------------------------------------------------
Locating all copies of Internet Explorer on C:
--------------------------------------------------------------------------
Locating all copies of Internet Explorer
"C:\Arquivos de programas\Internet Explorer\"
iexplore.exe 23 Jun 2008 625664 "iexplore.exe"
"C:\WINDOWS\ie7\"
iexplore.exe 3 Aug 2004 93184 "iexplore.exe"
"C:\WINDOWS\ie7updates\KB950759-IE7\"
iexplore.exe 13 Aug 2007 622080 "iexplore.exe"
"C:\WINDOWS\ie7updates\KB953838-IE7\"
iexplore.exe 22 Apr 2008 625664 "iexplore.exe"
"C:\WINDOWS\ServicePackFiles\i386\"
iexplore.exe 14 Apr 2008 93184 "iexplore.exe"
"C:\WINDOWS\system32\dllcache\"
iexplore.exe 23 Jun 2008 625664 "iexplore.exe"
"C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\"
iexplore.exe 22 Apr 2008 625664 "iexplore.exe"
"C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\"
iexplore.exe 23 Jun 2008 625664 "iexplore.exe"
8 items found: 8 files, 0 directories.
Total of file sizes: 3.936.768 bytes 3,75 M
--------------------------------------------------------------------------
Locating all copies of beep.sy_ on C:
--------------------------------------------------------------------------
Locating all copies of Internet Explorer
No matches found.
--------------------------------------------------------------------------
Locating all copies of beep.sys on C:
--------------------------------------------------------------------------
Locating all copies of Internet Explorer
"C:\WINDOWS\system32\dllcache\"
beep.sys 28 Oct 2001 4224 "beep.sys"
"C:\WINDOWS\system32\drivers\"
beep.sys 28 Oct 2001 4224 "beep.sys"
2 items found: 2 files, 0 directories.
Total of file sizes: 8.448 bytes 8,25 K
--------------------------------------------------------------------------
Locating all copies of Windows Explorer on C:
--------------------------------------------------------------------------
Locating all copies of Windows Explorer
"C:\WINDOWS\"
explorer.exe 14 Apr 2008 1035776 "explorer.exe"
"C:\WINDOWS\$NtUninstallKB938828$\"
explorer.exe 3 Aug 2004 1034240 "explorer.exe"
"C:\WINDOWS\$NtServicePackUninstall$\"
explorer.exe 13 Jun 2007 1035264 "explorer.exe"
"C:\WINDOWS\ServicePackFiles\i386\"
explorer.exe 14 Apr 2008 1035776 "explorer.exe"
"C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\"
explorer.exe 13 Jun 2007 1035264 "explorer.exe"
5 items found: 5 files, 0 directories.
Total of file sizes: 5.176.320 bytes 4,93 M
--------------------------------------------------------------------------
Items in Document and Settings:
--------------------------------------------------------------------------
Listing contents of C:\Documents and Settings
"C:\Documents and Settings\"
ALLUSE~1 5 May 2008 "All Users"
DEFAUL~1 5 May 2008 "Default User"
LOCALS~1 6 May 2008 "LocalService"
NETWOR~1 6 May 2008 "NetworkService"
USER 6 May 2008 "User"
5 items found: 0 files, 5 directories (3 H/S).
--------------------------------------------------------------------------
Desktop Items:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\User\Desktop within the last 90 days.
"C:\Documents and Settings\User\Desktop\"
atalho~2.lnk 1 Sep 2008 769 "Atalho para Cliente de Certificao.lnk"
combofix.exe 24 Oct 2008 2995743 "ComboFix.exe"
conect~1.lnk 20 Oct 2008 778 "Conectividade Social.lnk"
folha5~1.pif 30 Oct 2008 2829 "Folha 5.pif"
folhad~1.lnk 9 Oct 2008 459 "Folha de Pgto - Windows.lnk"
gdrais~1.lnk 9 Sep 2008 643 "GDRaisGenrico76_06.lnk"
iseeyo~1.lnk 31 Oct 2008 569 "ISeeYouXP.lnk"
lvro.txt 30 Oct 2008 67 "LVRO.TXT"
8 items found: 8 files (1 H/S), 0 directories.
Total of file sizes: 3.001.857 bytes 2,86 M
Locating all files created in C:\Documents and Settings\All Users\Desktop\ within the last 90 days.
"C:\Documents and Settings\All Users\Desktop\"
antivi~1.lnk 11 Sep 2008 1958 "AntiVir PE Classic.lnk"
lgdesk~1.lnk 15 Sep 2008 1473 "LG Desktop.lnk"
lgsync~1.lnk 15 Sep 2008 1515 "LG SyncManager.lnk"
malwar~1.lnk 17 Oct 2008 771 "Malwarebytes' Anti-Malware.lnk"
progra~1.lnk 31 Oct 2008 854 "Programa da Multifuncional Lexmark 4200 Series.lnk"
5 items found: 5 files, 0 directories.
Total of file sizes: 6.571 bytes 6,41 K
--------------------------------------------------------------------------
Start Menu Items:
--------------------------------------------------------------------------
Locating all files created inC:\Documents and Settings\User\Start Menu within the last 90 days.
No matches found.
Locating all files created in C:\Documents and Settings\User\Start Menu\Programs\Startup within the last 90 days.
No matches found.
Locating all files created in C:\Documents and Settings\All Users\Start Menu within the last 90 days.
No matches found.
Locating all files created in C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ within the last 90 days.
No matches found.
--------------------------------------------------------------------------
Application Data Items:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\User\Application Data\ within the last 90 days.
No matches found.
Locating all files created in C:\Documents and Settings\User\Local Settings\Application Data\ within the last 90 days.
No matches found.
Locating all files created in C:\Documents and Settings\All Users\Application Data\ within the last 90 days.
No matches found.
--------------------------------------------------------------------------
C:\Documents and Settings\User\Local Settings\TEMP:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\User\Local Settings\TEMP within the last 90 days.
--------------------------------------------------------------------------
Items in Templates Folder:
--------------------------------------------------------------------------
Locating all files created in C:\Documents and Settings\User\Templates
No matches found.
--------------------------------------------------------------------------
Items in Program Files:
--------------------------------------------------------------------------
Locating all files created in C:\Arquivos de programas\ within the last 90 days.
"C:\Arquivos de programas\"
ABBYYF~1.0SP 31 Oct 2008 "Abbyy FineReader 6.0 Sprint"
AVIRA 10 Sep 2008 "Avira"
CERTCLI 1 Sep 2008 "CertCli"
LEXMAR~1 31 Oct 2008 "Lexmark 4200 Series"
LGELEC~1 15 Sep 2008 "LG Electronics"
LGSYNC~1 15 Sep 2008 "LG SyncAgent"
MALWAR~1 17 Oct 2008 "Malwarebytes' Anti-Malware"
7 items found: 0 files, 7 directories.
Locating all files created in C:\Arquivos de programas\Arquivos comuns\ within the last 90 days.
No matches found.
Locating all files created in C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders within the last 90 days.
No matches found.
--------------------------------------------------------------------------
Items in the Windows Directory:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\ within the last 90 days.
"C:\WINDOWS\"
$N0ADE~1 14 Aug 2008 "$NtUninstallKB951072-v2$"
$N1AD0~1 9 Sep 2008 "$NtUninstallKB951376-v2$"
$N3E13~1 11 Sep 2008 "$NtUninstallKB954154_WM11$"
$N4CCA~1 9 Sep 2008 "$NtUninstallKB950762$"
$N4CEA~1 11 Sep 2008 "$NtUninstallKB938464$"
$N50D6~1 9 Sep 2008 "$NtUninstallKB951066$"
$N58DA~1 9 Sep 2008 "$NtUninstallKB951376$"
$N64D2~1 9 Sep 2008 "$NtUninstallKB950974$"
$N64E6~1 9 Sep 2008 "$NtUninstallKB952287$"
$N6CC2~1 9 Sep 2008 "$NtUninstallKB952954$"
$N70CA~1 9 Sep 2008 "$NtUninstallKB951748$"
$N74DC~1 9 Sep 2008 "$NtUninstallKB946648$"
$N78EE~1 9 Sep 2008 "$NtUninstallKB951698$"
$N80CE~1 14 Aug 2008 "$NtUninstallKB953839$"
$N88D2~1 11 Sep 2008 "$NtUninstallKB951978$"
$NA18F~1 14 Aug 2008 "$NtUninstallKB951066_0$"
$NB385~1 14 Aug 2008 "$NtUninstallKB950974_0$"
$NB38A~1 14 Aug 2008 "$NtUninstallKB946648_0$"
$NBB87~1 14 Aug 2008 "$NtUninstallKB952287_0$"
$NBF75~1 14 Aug 2008 "$NtUninstallKB952954_0$"
$NTSER~3 9 Sep 2008 "$NtServicePackUninstall$"
0.log 31 Oct 2008 0 "0.log"
bootstat.dat 31 Oct 2008 2048 "bootstat.dat"
cmsetacl.log 9 Sep 2008 173 "cmsetacl.log"
comsetup.log 11 Sep 2008 222066 "comsetup.log"
dpinst.log 12 Sep 2008 5694 "DPINST.LOG"
dtcins~1.log 9 Sep 2008 226 "DtcInstall.log"
ERDNT 21 Oct 2008 "ERDNT"
faxsetup.log 11 Sep 2008 735733 "FaxSetup.log"
iis6.log 11 Sep 2008 784323 "iis6.log"
imsins.bak 11 Sep 2008 1374 "imsins.BAK"
imsins.log 11 Sep 2008 1374 "imsins.log"
kb938464.log 11 Sep 2008 4132 "KB938464.log"
kb942763.log 9 Sep 2008 44997 "KB942763.log"
kb946648.log 9 Sep 2008 199304 "KB946648.log"
kb950762.log 9 Sep 2008 211751 "KB950762.log"
kb950974.log 9 Sep 2008 203980 "KB950974.log"
kb951066.log 9 Sep 2008 190414 "KB951066.log"
kb9510~1.log 9 Sep 2008 35293 "KB951072-v2.log"
kb951376.log 9 Sep 2008 205241 "KB951376.log"
kb9513~1.log 9 Sep 2008 191396 "KB951376-v2.log"
kb951698.log 9 Sep 2008 223455 "KB951698.log"
kb951748.log 9 Sep 2008 201561 "KB951748.log"
kb951978.log 11 Sep 2008 8275 "KB951978.log"
kb952287.log 9 Sep 2008 198287 "KB952287.log"
kb952954.log 9 Sep 2008 203629 "KB952954.log"
kb953839.log 14 Aug 2008 15328 "KB953839.log"
kb9538~1.log 14 Aug 2008 20983 "KB953838-IE7.log"
kb954154.log 11 Sep 2008 4178 "KB954154.log"
L2SCHE~1 9 Sep 2008 "l2schemas"
LASTGOOD 31 Oct 2008 "LastGood"
lexstat.ini 31 Oct 2008 376 "Lexstat.ini"
medctroc.log 11 Sep 2008 51773 "MedCtrOC.log"
msgsocm.log 11 Sep 2008 36615 "msgsocm.log"
msmqinst.log 11 Sep 2008 230396 "msmqinst.log"
netfxocm.log 11 Sep 2008 128551 "netfxocm.log"
NETWOR~1 9 Sep 2008 "network diagnostic"
ntdtcs~1.log 11 Sep 2008 133834 "ntdtcsetup.log"
ocgen.log 11 Sep 2008 347513 "ocgen.log"
ocmsn.log 11 Sep 2008 41893 "ocmsn.log"
oewablog.txt 9 Sep 2008 345 "OEWABLog.txt"
PIF 30 Oct 2008 "PIF"
PREFETCH 9 Sep 2008 "Prefetch"
schedlgu.txt 30 Oct 2008 32544 "SchedLgU.Txt"
SERVIC~1 9 Sep 2008 "ServicePackFiles"
sessmg~1.log 9 Sep 2008 259 "sessmgr.setup.log"
setupapi.log 31 Oct 2008 702272 "setupapi.log"
setuplog.txt 9 Sep 2008 9744 "setuplog.txt"
spupdsvc.log 9 Sep 2008 32430 "spupdsvc.log"
spupds~1.log 9 Sep 2008 187 "spupdsvc.log.1.log"
svcpack.log 9 Sep 2008 518053 "svcpack.log"
system.ini 30 Oct 2008 451 "system.ini"
tabletoc.log 11 Sep 2008 37165 "tabletoc.log"
TEMP 24 Oct 2008 "temp"
tsoc.log 11 Sep 2008 334550 "tsoc.log"
updspapi.log 9 Sep 2008 155925 "updspapi.log"
wiadebug.log 31 Oct 2008 187 "wiadebug.log"
wiaservc.log 31 Oct 2008 50 "wiaservc.log"
win.ini 8 Aug 2008 603 "win.ini"
window~1.log 31 Oct 2008 1838695 "WindowsUpdate.log"
wmsetup.log 17 Oct 2008 2684 "wmsetup.log"
81 items found: 52 files (1 H/S), 29 directories (19 H/S).
Total of file sizes: 8.552.310 bytes 8,15 M
--------------------------------------------------------------------------
C:\WINDOWS\Downloaded Program Files:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\Downloaded Program Files\ within the last 90 days.
"C:\WINDOWS\Downloaded Program Files\"
jinsta~1.inf 26 Sep 2008 1065 "jinstall-6u10.inf"
1 item found: 1 file, 0 directories.
Total of file sizes: 1.065 bytes 1,04 K
--------------------------------------------------------------------------
C:\WINDOWS\PCHealth\HelpCtr\Binaries:
--------------------------------------------------------------------------
Locating all files in C:\WINDOWS\PCHealth\HelpCtr\Binaries
"C:\WINDOWS\pchealth\helpctr\binaries\"
brpinfo.dll 28 Oct 2001 21504 "brpinfo.dll"
hcappres.dll 28 Oct 2001 7168 "HCAppRes.dll"
helpctr.exe 14 Apr 2008 769024 "helpctr.exe"
helphost.exe 28 Oct 2001 99840 "HelpHost.exe"
helpsvc.exe 14 Apr 2008 744448 "helpsvc.exe"
hscsp_w3.cab 17 Jul 2004 324700 "hscsp_w3.cab"
hscupd.exe 14 Apr 2008 18432 "hscupd.exe"
msconfig.exe 14 Apr 2008 171520 "msconfig.exe"
msinfo.dll 14 Apr 2008 381440 "msinfo.dll"
notiflag.exe 28 Oct 2001 35328 "notiflag.exe"
pchdt_w3.cab 3 Aug 2004 2768982 "pchdt_w3.cab"
pchshell.dll 14 Apr 2008 102912 "pchshell.dll"
pchsvc.dll 14 Apr 2008 38400 "pchsvc.dll"
13 items found: 13 files, 0 directories.
Total of file sizes: 5.483.698 bytes 5,23 M
--------------------------------------------------------------------------
C:\WINDOWS\system:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system within the last 90 days.
No matches found.
--------------------------------------------------------------------------
C:\WINDOWS\system32:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32 within the last 90 days.
"C:\WINDOWS\system32\"
BITS 9 Sep 2008 "bits"
cf30563.exe 28 Oct 2008 400896 "CF30563.exe"
deploytk.dll 27 Oct 2008 410976 "deploytk.dll"
fntcache.dat 9 Sep 2008 265416 "FNTCACHE.DAT"
java.exe 27 Oct 2008 144792 "java.exe"
javacpl.cpl 27 Oct 2008 73728 "javacpl.cpl"
javaw.exe 27 Oct 2008 144792 "javaw.exe"
javaws.exe 27 Oct 2008 148888 "javaws.exe"
lexfiles.ulf 31 Oct 2008 19173 "LexFiles.ulf"
mrt.exe 5 Aug 2008 15888504 "MRT.exe"
perfc009.dat 13 Oct 2008 40836 "perfc009.dat"
perfc016.dat 13 Oct 2008 49586 "perfc016.dat"
perfh009.dat 13 Oct 2008 314508 "perfh009.dat"
perfh016.dat 13 Oct 2008 347294 "perfh016.dat"
perfst~1.ini 13 Oct 2008 759962 "PerfStringBackup.INI"
spupdwxp.log 9 Sep 2008 253 "spupdwxp.log"
tzlog.log 14 Aug 2008 360206 "TZLog.log"
wpa.dbl 31 Oct 2008 2206 "wpa.dbl"
18 items found: 17 files, 1 directory.
Total of file sizes: 19.372.016 bytes 18,47 M
--------------------------------------------------------------------------
C:\WINDOWS\system32\com:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\com within the last 90 days.
No matches found.
--------------------------------------------------------------------------
C:\WINDOWS\system32\components:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\components within the last 90 days.
No matches found.
--------------------------------------------------------------------------
C:\WINDOWS\system32\drivers:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\drivers within the last 90 days.
"C:\WINDOWS\system32\drivers\"
mbam.sys 16 Oct 2008 15504 "mbam.sys"
mbamsw~1.sys 16 Oct 2008 38496 "mbamswissarmy.sys"
ndisio.sys 30 Oct 2008 105920 "ndisio.sys"
qjpwvwwr.sys 30 Oct 2008 44288 "qjpwvwwr.sys"
4 items found: 4 files, 0 directories.
Total of file sizes: 204.208 bytes 199,42 K
--------------------------------------------------------------------------
C:\WINDOWS\system32\drivers\etc:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\system32\drivers\etc within the last 90 days.
"C:\WINDOWS\system32\drivers\etc\"
hosts 24 Oct 2008 27 "hosts"
1 item found: 1 file, 0 directories.
Total of file sizes: 27 bytes 0,02 K
--------------------------------------------------------------------------
C:\WINDOWS\TEMP:
--------------------------------------------------------------------------
Locating all files created in C:\WINDOWS\TEMP within the last 90 days.
"C:\WINDOWS\temp\"
perfli~1.dat 31 Oct 2008 16384 "Perflib_Perfdata_134.dat"
wgaerr~1.txt 31 Oct 2008 255 "WGAErrLog.txt"
wganot~1.set 31 Oct 2008 409 "WGANotify.settings"
3 items found: 3 files, 0 directories.
Total of file sizes: 17.048 bytes 16,65 K
************************************************************************************
Checking for .COM files to Delete. They will only print if deleted!
Locating .COM files in the C:\WINDOWS\System32 folder
"C:\WINDOWS\system32\"
chcp.com 28 Oct 2001 7680 "chcp.com"
command.com 28 Oct 2001 52472 "command.com"
diskcomp.com 28 Oct 2001 9216 "diskcomp.com"
diskcopy.com 28 Oct 2001 7168 "diskcopy.com"
edit.com 28 Oct 2001 70750 "edit.com"
format.com 14 Apr 2008 29696 "format.com"
graftabl.com 28 Oct 2001 26112 "graftabl.com"
graphics.com 28 Oct 2001 19918 "graphics.com"
kb16.com 28 Oct 2001 14950 "kb16.com"
loadfix.com 28 Oct 2001 1153 "loadfix.com"
locate.com 14 Jan 2005 11254 "locate.com"
mode.com 28 Oct 2001 19456 "mode.com"
more.com 14 Apr 2008 16896 "more.com"
tree.com 14 Apr 2008 12800 "tree.com"
win.com 28 Oct 2001 18432 "win.com"
15 items found: 15 files, 0 directories.
Total of file sizes: 317.953 bytes 310,50 K
************************************************************************************
Miscellaneous Malware Detections:
------------------------------------------------------------------------------------
**** Delfin Media {31EE3286-D785-4E3F-95FC-51D00FDABC01} NOT FOUND by this tool! ****
**** SmitFraud {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! ****
**** SpywareStrike {C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D} NOT FOUND by this tool! ****
**** SpywareStrike {C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C} NOT FOUND by this tool! ****
**** SpywareStrike {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} NOT FOUND by this tool! ****
**** SpyAxe {A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! ****
**** SpyAxe {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! ****
**** SpyFalcon {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! ****
**** SpyFalcon {C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D} NOT FOUND by this tool! ****
**** SpyFalcon {CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E} NOT FOUND by this tool! ****
**** SpyFalcon {35a88e51-b53d-43e9-b8a7-75d4c31b4676} NOT FOUND by this tool! ****
**** SpyFalcon {64ba30a2-811a-4597-b0af-d551128be340} NOT FOUND by this tool! ****
**** SpyFalcon {89aef01d-d237-49c7-84dc-4e1904c1fd31} NOT FOUND by this tool! ****
**** SpyFalcon {e04408db-4812-4478-8d4d-e46edcffd3b6} NOT FOUND by this tool! ****
**** SpyFalcon {336ec37f-54bf-4f13-8237-03f64fa591e7} NOT FOUND by this tool! ****
**** SpyFalcon {5bc82bdb-bc03-4671-9a78-3ef2b68449de} NOT FOUND by this tool! ****
**** SpyFalcon {24c60b9b-26b5-4201-9f7a-fb9219356ae9} NOT FOUND by this tool! ****
**** SpyFalcon {a0c51615-738a-4542-801a-5af61614e182} NOT FOUND by this tool! ****
**** SpyFalcon {70fbd528-2d3c-4a00-9b8c-bbf441e534be} NOT FOUND by this tool! ****
**** SpyFalcon {a566f298-05a6-4b3d-b672-da7c27316430} NOT FOUND by this tool! ****
**** SpyFalcon {f5947202-e9cb-4a72-88e7-22f2cbd2b124} NOT FOUND by this tool! ****
**** SpyFalcon {5aaf6542-f4ba-4df4-873d-4902ecbe794c} NOT FOUND by this tool! ****
**** SpyFalcon {3e4155b8-5a4a-4e95-83b2-ab032da9acbc} NOT FOUND by this tool! ****
**** SpyFalcon {9952355f-fefb-4764-bcd7-a993d03dd7e2} NOT FOUND by this tool! ****
**** SpyFalcon {55059d4f-a1ac-4837-ae07-4859101f598d} NOT FOUND by this tool! ****
**** SpyFalcon {c3786a8d-6426-4c29-a23f-f36e47b31e0c} NOT FOUND by this tool! ****
**** SpyLocked {25b7d2fd-4f71-46d1-801a-7de323e4ec82} NOT FOUND by this tool! ****
**** SpyLocked {4233AC08-A2C4-4742-A0B4-83719613D62C} NOT FOUND by this tool! ****
**** SpyLocked {716002DB-288C-4BF0-80CD-A467E78D8B55} NOT FOUND by this tool! ****
**** SpyLocked {735E980D-45D2-4777-AF82-9923D3C8D3AE} NOT FOUND by this tool! ****
**** SpyLocked {B23DC537-3E13-44C7-BF67-D8405EB377F7} NOT FOUND by this tool! ****
**** SpyLocked {B292EC9F-A074-4115-8342-1F459702D8D2} NOT FOUND by this tool! ****
**** SpyLocked {CECA6F2B-247B-4ECE-9B7A-D0135C8036FC} NOT FOUND by this tool! ****
**** SpyLocked {DA3B49F6-8C54-4429-A275-21A86DCCA413} NOT FOUND by this tool! ****
**** SpyLocked {EDE8BED5-92CF-4482-8F51-A01CD9B3EA37} NOT FOUND by this tool! ****
**** SpyLocked {FA4FBF53-C766-4622-8011-A87A805EEBF0} NOT FOUND by this tool! ****
**** SpywareLocked {0E4E5110-A772-4C4A-A7DC-137FE10ABD6E} NOT FOUND by this tool! ****
**** SpywareLocked {07A582E8-BAE3-457D-9D29-2048DE45A369} NOT FOUND by this tool! ****
**** SpywareLocked {3BAA1AD8-EE49-4772-BF0B-F55083E0F7AA} NOT FOUND by this tool! ****
**** SpywareLocked {9D6FAC42-A7BE-4702-87EF-75D8DC14249E} NOT FOUND by this tool! ****
**** SpywareLocked {ABEF791F-947E-4CDF-83C3-E72A240AFB67} NOT FOUND by this tool! ****
**** SpywareLocked {BD0FC212-0A36-4232-83CC-2063FB9282E0} NOT FOUND by this tool! ****
**** SpywareLocked {B0DED443-5E68-4001-A81B-0A0001621AB8} NOT FOUND by this tool! ****
**** SpywareLocked {F38B1B2B-4976-46DD-9FE5-60FDE72F0B4D} NOT FOUND by this tool! ****
**** SpywareQuake {0c7416f0-dd23-420f-97f5-aae352ea2bf1} NOT FOUND by this tool! ****
**** SpywareQuake {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} NOT FOUND by this tool! ****
**** SpywareQuake {AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E} NOT FOUND by this tool! ****
**** SpywareQuake {CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A} NOT FOUND by this tool! ****
**** SpywareQuake {EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E} NOT FOUND by this tool! ****
**** SpywareQuake {e5b1e382-817e-4b74-8a96-ec78751e6acf} NOT FOUND by this tool! ****
**** SpywareQuake {a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb} NOT FOUND by this tool! ****
**** SpywareQuake {cbb430e6-5b1b-474a-9d7e-160d4fe74bea} NOT FOUND by this tool! ****
**** SpywareQuake {62eb0924-19d2-4226-b4b9-8ad1f70904c1} NOT FOUND by this tool! ****
**** SpywareQuake {6c69e319-0d03-47da-997a-36586cbc53b3} NOT FOUND by this tool! ****
**** SpywareQuake {aea3d2df-2b2c-4d7b-81a0-d975c6dc088e} NOT FOUND by this tool! ****
**** SpywareSheriff {1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E} NOT FOUND by this tool! ****
**** VirusBurster {9d635a36-6b3c-4146-8625-f3aaf507bbf8} NOT FOUND by this tool! ****
**** TrustCleaner {24E27EA9-FCF3-444F-BD80-20543BA5D946} NOT FOUND by this tool! ****
**** Troj/Small-ER {4F141CBA-1457-6CCA-03A7-7AA21B61EA0F} NOT FOUND by this tool! ****
**** Troj/Spabot-E {429F4BB8-7BF7-4152-8011-3C6F9EB7E892} NOT FOUND by this tool! ****
**** Troj/Dloader-OF {203B1C4D9-BC71-8916-38AD-9DEA5D213614} NOT FOUND by this tool! ****
**** Troj/Crafted-A {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! ****
**** Troj/Agent-FG {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} NOT FOUND by this tool! ****
**** TX 4 BrowserAd adware {8e99f990-b75a-4568-b3c8-24cbc8cbbfc1} NOT FOUND by this tool! ****
**** Trojan-Proxy.Win32.Small {87A3E824-A726-4CF4-8A66-6314B11BDA0C} NOT FOUND by this tool! ****
**** Trojan-Downloader.Win32.Delf.ks {786C369D-409A-456f-A13C-971EADA850C6} NOT FOUND by this tool! ****
**** W32/Almanahe.a Worm NOT FOUND by this tool! ****
**** msctl32.dll SpamBot NOT FOUND by this tool! ****
**** KeyLogger NOT FOUND by this tool! ****
--------------------------------------------------------------------------
CHECKING FOR BOT-TYPE WORMS:
--------------------------------------------------------------------------
**** W32/Sdbot Worm NOT FOUND by this tool! ****
--------------------------------------------------------------------------
CHECKING FOR KNOWN ROOTKIT STEALTHING AGENTS:
--------------------------------------------------------------------------
**** i386p.* Stealthing Agent NOT FOUND by this tool! ****
**** ErrorSafe erssdd.* Stealthing Agent NOT FOUND by this tool! ****
**** VUNDO DP.* Stealthing Agent NOT FOUND by this tool! ****
**** Troj/NTRootK-BP main.* Stealthing Agent NOT FOUND by this tool! ****
**** W32/Almanahe.sys RioDrvrs.* Stealthing Agent NOT FOUND by this tool! ****
**** W32/Almanahe.sys DKIS6.* Stealthing Agent NOT FOUND by this tool! ****
--------------------------------------------------------------------------
CHECKING FOR VISIBLE ROOTKIT-TYPE REGISTRY KEYS:
--------------------------------------------------------------------------
**** Rustock.B trojan, PE386 rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, huy32 rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, lzx32 rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, msguard rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, xpdt.sy_ rootkit NOT FOUND by this tool! ****
**** Rustock.B trojan, xpdt.sys rootkit NOT FOUND by this tool! ****
**** CmdService adware NOT FOUND by this tool! ****
**** Network_Monitor adware NOT FOUND by this tool! ****
**** Trojan.Peacomm NOT FOUND by this tool! ****
**** Trojan.Peacomm windev NOT FOUND by this tool! ****
**** AVPE Haxdoor NOT FOUND by this tool! ****
**** MEMLOW Haxdoor NOT FOUND by this tool! ****
**** VDMT Haxdoor NOT FOUND by this tool! ****
**** YCSVGA Haxdoor NOT FOUND by this tool! ****
**** PPTP Haxdoor FOUND by this tool! ****
CAREFULL HERE THIS WILL ALSO FIND WinLanMiniport
DisplayName REG_SZ Miniporta de rede remota (PPTP)
Description REG_SZ Miniporta de rede remota (PPTP)
DisplayName REG_SZ Miniporta de rede remota (PPTP)
Description REG_SZ Miniporta de rede remota (PPTP)
DisplayName REG_SZ Miniporta de rede remota (PPTP)
Description REG_SZ Miniporta de rede remota (PPTP)
**** DVB Haxdoor NOT FOUND by this tool! ****
**** YVBB Haxdoor NOT FOUND by this tool! ****
**** YVPP Haxdoor NOT FOUND by this tool! ****
**** NKGFS Haxdoor NOT FOUND by this tool! ****
**** XMSK Haxdoor NOT FOUND by this tool! ****
**** AVPX Haxdoor NOT FOUND by this tool! ****
**** MMXF Haxdoor NOT FOUND by this tool! ****
**** DP1112 Vundo Rootkit NOT FOUND by this tool! ****
**** SYSBUS32 Rootkit Driver NOT FOUND by this tool! ****
**** I386P Rootkit Driver NOT FOUND by this tool! ****
**** ERSSDD Rootkit NOT FOUND by this tool! ****
**** GencTurK RootKit NOT FOUND by this tool! ****
**** Troj/NTRootK-BP RootKit NOT FOUND by this tool! ****
**** W32/Almanahe.sys NOT FOUND by this tool! ****
************************************************************************************
Dumping HKLM Uninstall Programs list
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ 2007 Microsoft Office Suite Service Pack 1 (SP1)
DisplayName REG_SZ ABBYY FineReader 6.0 Sprint
DisplayName REG_SZ ACI Windows
DisplayName REG_SZ Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
DisplayName REG_SZ Adobe Flash Player 10 ActiveX
DisplayName REG_SZ Adobe Reader 8.1.2 - Portugus
DisplayName REG_SZ Adobe Reader 8.1.2 Security Update 1 (KB403742)
DisplayName REG_SZ Adobe Shockwave Player 11
DisplayName REG_SZ Assistente de Conexo do Windows Live
DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player (KB911564)
DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player 11 (KB936782)
DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player 6.4 (KB925398)
DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB938127)
DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB950759)
DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB953838)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB941569)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB946648)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB950760)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB950762)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB950974)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951066)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951376-v2)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951376)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951698)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951748)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB952954)
DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB953839)
DisplayName REG_SZ Atualizao para Windows XP (KB942763)
DisplayName REG_SZ Atualizao para Windows XP (KB951072-v2)
DisplayName REG_SZ Avira AntiVir Personal - Free Antivirus
DisplayName REG_SZ CAGED Net - verso 1.01
DisplayName REG_SZ Cliente de Certificao
DisplayName REG_SZ CloneCD
DisplayName REG_SZ CloneDVD2
DisplayName REG_SZ Compressor WinRAR
DisplayName REG_SZ Conectividade Social
DisplayName REG_SZ Creative DVD Audio Plugin for Audigy Series
DisplayName REG_SZ Declarao do Simples Nacional
DisplayName REG_SZ DVD Decrypter (Remove Only)
DisplayName REG_SZ EasyCleaner
DisplayName REG_SZ eMule
DisplayName REG_SZ FaxRedist
DisplayName REG_SZ Gerador de Declarao Rais Genrico76_06 - GDRais Genrico [verso 10.2006]
DisplayName REG_SZ GRRF Eletrnica
DisplayName REG_SZ High Definition Audio Driver Package - KB888111
DisplayName REG_SZ HijackThis 1.99.1
DisplayName REG_SZ Hotfix for Windows Media Format 11 SDK (KB929399)
DisplayName REG_SZ Hotfix para o Windows Media Player 11 (KB939683)
DisplayName REG_SZ Hotfix para Windows XP (KB952287)
DisplayName REG_SZ InterVideo WinDVD 7
DisplayName REG_SZ Java(TM) 6 Update 10
DisplayName REG_SZ Java(TM) 6 Update 5
DisplayName REG_SZ K-Lite Mega Codec Pack 3.7.5
DisplayName REG_SZ Lexmark 4200 Series
DisplayName REG_SZ LG SyncAgent
DisplayName REG_SZ LG USB Modem driver
DisplayName REG_SZ Malwarebytes' Anti-Malware
DisplayName REG_SZ Microsoft Compression Client Pack 1.0 for Windows XP
DisplayName REG_SZ Microsoft Internationalized Domain Names Mitigation APIs
DisplayName REG_SZ Microsoft National Language Support Downlevel APIs
DisplayName REG_SZ Microsoft Office Access MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Enterprise 2007
DisplayName REG_SZ Microsoft Office Enterprise 2007
DisplayName REG_SZ Microsoft Office Excel MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Groove MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office OneNote MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Outlook MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Professional Edio 2003
DisplayName REG_SZ Microsoft Office Proof (English) 2007
DisplayName REG_SZ Microsoft Office Proof (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Proof (Spanish) 2007
DisplayName REG_SZ Microsoft Office Proofing (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Publisher MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Shared MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Office Word MUI (Portuguese (Brazil)) 2007
DisplayName REG_SZ Microsoft Software Update for Web Folders (Portuguese (Brazil)) 12
DisplayName REG_SZ Microsoft User-Mode Driver Framework Feature Pack 1.0
DisplayName REG_SZ Microsoft Visual C++ 2005 Redistributable
DisplayName REG_SZ MSXML 4.0 SP2 (KB936181)
DisplayName REG_SZ MSXML 4.0 SP2 Parser and SDK
DisplayName REG_SZ Nero 7 Ultra Edition
DisplayName REG_SZ NVIDIA Drivers
DisplayName REG_SZ Pacote de Driver do Windows - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
DisplayName REG_SZ Patch SEFIP 8.30
DisplayName REG_SZ Projeto Z
DisplayName REG_SZ Realtek High Definition Audio Driver
DisplayName REG_SZ Security Update for 2007 Microsoft Office System (KB951596)
DisplayName REG_SZ Security Update for Microsoft Office Excel 2007 (KB951546)
DisplayName REG_SZ Security Update for Microsoft Office PowerPoint 2007 (KB951338)
DisplayName REG_SZ Security Update for Microsoft Office Publisher 2007 (KB950114)
DisplayName REG_SZ Security Update for Microsoft Office system 2007 (KB951808)
DisplayName REG_SZ Security Update for Microsoft Office Word 2007 (KB950113)
DisplayName REG_SZ SEFIP 8.20
DisplayName REG_SZ SEFIP 8.30
DisplayName REG_SZ SEFIP 8.40
DisplayName REG_SZ Sicalc Auto Atendimento (V 3.117.51)
DisplayName REG_SZ Update for Microsoft Office Outlook 2007 (KB952142)
DisplayName REG_SZ Update for Office 2007 (KB946691)
DisplayName REG_SZ Update for Outlook 2007 Junk Email Filter (kb955433)
DisplayName REG_SZ WebFldrs XP
DisplayName REG_SZ Windows Genuine Advantage Notifications (KB905474)
DisplayName REG_SZ Windows Genuine Advantage Validation Tool (KB892130)
DisplayName REG_SZ Windows Genuine Advantage Validation Tool (KB892130)
DisplayName REG_SZ Windows Internet Explorer 7
DisplayName REG_SZ Windows Live installer
DisplayName REG_SZ Windows Live Messenger
DisplayName REG_SZ Windows Media Format 11 runtime
DisplayName REG_SZ Windows Media Format 11 runtime
DisplayName REG_SZ Windows Media Player 11
DisplayName REG_SZ Windows Media Player 11
DisplayName REG_SZ Windows XP Service Pack 3
ParentDisplayName REG_SZ
ParentDisplayName REG_SZ
ParentDisplayName REG_SZ Adobe Reader 8.1.2 - Portugus
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Microsoft Office Enterprise 2007
ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software
ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software
ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
ParentDisplayName REG_SZ Windows XP - Atualizaes de Software
QuietDisplayName REG_SZ Shockwave Director 11.0
#####################################################################################################
-- All DONE! :)
~ ShadowPuterDude ~