Resolvendo problemas com sites !

**Serafan** · 31-03-2010, 00:58

Oi Astecks,

Impossível, o ComboFix não danifica o seu computador. Traduzindo de um inglês rústico e barato: Combo = Combo + Fix = Concertar, logo, ComboFix é um conjunto de ferramentas que trabalham simultâneamente (combo) para corrigir (fix) erros do seu computador.
Os erros corrigidos pelo ComboFix são em geral, cookies corrompidos, ou unidades de registro não utilizadas/danificadas. Tome cuidado antes de difamar o programa sem conhecimento sobre ele, e sugiro que você procure um novo técnico, porque este possui um nível de conhecimento muito inferior ao necessário para ser denominado profissional.

//

Postado originalmente por anciet dragon

eu tentei passar o combofix 2 vezes no meu pc e o mawarebytes algumas vezes (perdi as contas de quantas vezes eu já fiz isso) já passei varios antivirus e antispywares, reinstalei o client do tibia, nada adianta já faz 1 mes que eu estou tentando jogar e nada adianta quero conseguir jogar pq logo irei comprar PT, por isso estou pedindo ajuda

DÁ PRA ALGUEM DAR UMA LUZ E ME DIZER COMO Q EU RODO TIBIA NO MEU PC????

Oi ancient,

Se você ler o título do tópico com cuidado, verá que esta é uma solução para quem está com problemas na hora de acessar algum SITE (no caso o do tibia.com), e não refere-se a problemas com o acesso ao cliente do jogo.

**Activia** · 07-04-2010, 19:57

comigo ocorreu a mesmo situaçlão que o cara do outro tópico, fui hackeado e agora o site tibia.com tá bloqueado aqui com a mensagem 'It works!'

até mesmo o site do meu provedor de e-mail (gmail) foi bloquado após isso.
ajudem por favor

ps. ja tentei as sugestões de por www e os cambau.

**Serafan** · 07-04-2010, 20:12

Oi Activia,

Segue os procedimentos listados na mainpage do tópico que certamente seu problema será resolvido.

**_*Yh@nN*_** · 07-04-2010, 23:52

Olá amigos,

estou com o mesmo problema do Activia, o site oficial tibia.com simplesmente não abre! aparece apenas a mensagem "It works!".

NO ENTANDO, ao utilizar um servidor free proxy "www.freeproxy.ws" consegui acessar o www.tibia.com, o que me leva a crer na possibilidade de vírus.
Já me adiantei com o procedimento citado na main page, e nada resolveu!
CCleaner executado e ComboFix passado, com antivírus desativado, conforme recomendações.

Eis o log:

Código:

ComboFix 10-04-06.05 - Yhann Hafael 07/04/2010  23:15:53.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.55.1046.18.959.575 [GMT -3:00]
Executando de: c:\documents and settings\Yhann Hafael\Desktop\ComboFix*****
AV: avast! antivirus 4.8.1368 [VPS 100407-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((((   Outras Exclusões   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\SIntf16.dll
c:\windows\system32\sknc.dll

A cópia de c:\windows\system32\ws2_32.dll foi encontrada e desinfectada 
Cópia restaurada de - c:\windows\system32\dllcache\ws2_32.dll 

.
((((((((((((((((   Arquivos/Ficheiros criados de 2010-03-08 to 2010-04-08  ))))))))))))))))))))))))))))
.

2010-04-08 02:06 . 2010-04-08 02:07    --------    d-----w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\GetRightToGo
2010-03-31 00:06 . 2010-03-31 00:06    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Java
2010-03-28 19:41 . 2010-03-28 19:41    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Skype
2010-03-24 21:56 . 2010-04-02 02:17    --------    d-----w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Tibia
2010-03-24 21:55 . 2010-03-24 21:55    --------    d-----w-    c:\arquivos de programas\Tibia

.
(((((((((((((((((((((((((((((((((((((   Relatório Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-31 00:06 . 2010-03-31 00:06    503808    ----a-w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4d063d66-n\msvcp71.dll
2010-03-31 00:06 . 2010-03-31 00:06    499712    ----a-w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4d063d66-n\jmc.dll
2010-03-31 00:06 . 2010-03-31 00:06    348160    ----a-w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-4d063d66-n\msvcr71.dll
2010-03-31 00:06 . 2010-03-31 00:06    61440    ----a-w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-10e9a22f-n\decora-sse.dll
2010-03-31 00:06 . 2010-03-31 00:06    12800    ----a-w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-10e9a22f-n\decora-d3d.dll
2010-03-31 00:06 . 2009-12-21 15:11    --------    d-----w-    c:\arquivos de programas\Java
2010-03-30 14:03 . 2009-12-21 15:52    --------    d-----w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Skype
2010-03-30 13:59 . 2009-12-21 15:53    --------    d-----w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\skypePM
2010-03-27 02:01 . 2010-01-07 21:31    --------    d-----w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\BitTorrent
2010-03-27 01:36 . 2009-12-21 16:00    --------    d-----w-    c:\arquivos de programas\Garena
2010-03-17 00:46 . 2010-02-13 14:59    --------    d-----w-    c:\documents and settings\Yhann Hafael\Dados de aplicativos\Vso
2010-03-13 00:27 . 2009-12-21 14:38    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\InstallShield
2010-03-09 07:28 . 2009-12-21 15:11    411368    ----a-w-    c:\windows\system32\deploytk.dll
2010-02-28 06:05 . 2008-04-14 12:00    48628    ----a-w-    c:\windows\system32\perfc016.dat
2010-02-28 06:05 . 2008-04-14 12:00    344380    ----a-w-    c:\windows\system32\perfh016.dat
2010-02-27 18:02 . 2009-12-21 21:08    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help
2010-02-20 16:38 . 2010-02-12 05:05    --------    d-----w-    c:\arquivos de programas\Microsoft Works
2010-02-18 21:13 . 2010-01-28 21:49    --------    d-----w-    c:\arquivos de programas\Diablo II
2010-02-14 01:14 . 2010-02-14 01:14    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\vsosdk
2010-02-12 21:08 . 2010-02-12 21:08    --------    d-----w-    c:\arquivos de programas\PluginLetras
2010-02-12 05:39 . 2009-12-21 16:05    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2010-02-12 05:05 . 2010-02-12 05:05    --------    d-----w-    c:\arquivos de programas\MSBuild
2010-02-12 01:50 . 2010-02-12 01:50    --------    d-----w-    c:\arquivos de programas\microsoft frontpage
2010-02-05 16:16 . 2010-01-28 21:53    40620    ----a-w-    c:\windows\DIIUnin.dat
2010-02-02 17:03 . 2010-01-29 05:37    43520    ----a-w-    c:\windows\system32\CmdLineExt03.dll
2010-01-29 05:28 . 2010-01-28 21:58    21840    ----atw-    c:\windows\system32\SIntfNT.dll
2010-01-29 05:28 . 2010-01-28 21:58    17212    ----atw-    c:\windows\system32\SIntf32.dll
2010-01-28 21:53 . 2010-01-28 21:53    94208    ----a-w-    c:\windows\DIIUnin*****
2010-01-28 21:53 . 2010-01-28 21:53    2829    ----a-w-    c:\windows\DIIUnin.pif
2010-01-28 05:44 . 2010-01-28 05:44    691696    ----a-w-    c:\windows\system32\drivers\sptd.sys
.

((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Yhann Hafael\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate*****" [2009-12-21 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched*****" [2010-02-18 248040]
"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp*****" [2009-11-24 81000]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl*****" [2009-12-22 35760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON*****"="c:\windows\system32\CTFMON*****" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 17:57    948672    ----a-r-    c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-21 15:00    135664    ----atw-    c:\documents and settings\Yhann Hafael\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 13:44    31072    ----a-w-    c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower]
2007-04-11 05:06    53248    ----a-w-    c:\windows\system32\SiSPower.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag*****"=
"%windir%\\system32\\sessmgr*****"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM*****"=
"c:\\Arquivos de programas\\Garena\\Garena*****"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk*****"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr*****"=
"c:\\Arquivos de programas\\Messenger\\msmsgs*****"=
"c:\\Arquivos de programas\\Java\\jre6\\bin\\javaw*****"=
"c:\\Arquivos de programas\\BitTorrent\\bittorrent*****"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK*****"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE*****"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE*****"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype*****"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1577:TCP"= 1577:TCP:zygvpl

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28/1/2010 02:44 691696]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [11/1/2010 03:08 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/1/2010 03:08 20560]
S2 gwdmuk;Manager Boot;c:\windows\system32\svchost***** -k netsvcs [14/4/2008 09:00 14336]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\YHANNH~1\CONFIG~1\Temp\ARC15.tmp --> c:\docume~1\YHANNH~1\CONFIG~1\Temp\ARC15.tmp [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper    REG_MULTI_SZ       getPlusHelper
.
Conteúdo da pasta 'Tarefas Agendadas'

2010-04-08 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC***** [2009-08-03 17:07]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://google.com.br/
mStart Page = hxxp://search.localstrike.com.ar/
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~3\Office12\EXCEL*****/3000
FF - ProfilePath - c:\documents and settings\Yhann Hafael\Dados de aplicativos\Mozilla\Firefox\Profiles\gh0ty4kg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.localstrike.com.ar/?q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://pt-BR.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pt-BR:official
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
- - - - ORFÃOS REMOVIDOS - - - -

MSConfigStartUp-Cmaudio - cmicnfg.cpl
MSConfigStartUp-QuickTime Task - c:\arquivos de programas\QuickTime\QTTask*****



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 23:23
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ... 

Procurando entradas auto inicializáveis ocultas ... 

Procurando ficheiros/arquivos ocultos ... 

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl***** CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spwi.sys >>UNKNOWN [0x8578F938]<< 
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75b3f28
\Driver\ACPI -> ACPI.sys @ 0xf741bcb8
\Driver\atapi -> atapi.sys @ 0xf73b0b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl***** @ 0x805a0598
 ParseProcedure -> ntoskrnl***** @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl***** @ 0x805a0598
 ParseProcedure -> ntoskrnl***** @ 0x8056ea15
NDIS: SiS 900 PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf72cdb0a
 PacketIndicateHandler -> NDIS.sys @ 0xf72d8a21
 SendHandler -> NDIS.sys @ 0xf72cd949
user & kernel MBR OK 

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\YHANNH~1\CONFIG~1\Temp\ARC15.tmp"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'explorer*****'(3212)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Alwil Software\Avast4\aswUpdSv*****
c:\arquivos de programas\Alwil Software\Avast4\ashServ*****
c:\windows\system32\sistray*****
c:\arquivos de programas\Java\jre6\bin\jqs*****
c:\arquivos de programas\Windows Media Player\WMPNetwk*****
c:\arquivos de programas\Alwil Software\Avast4\ashMaiSv*****
c:\arquivos de programas\Alwil Software\Avast4\ashWebSv*****
.
**************************************************************************
.
Tempo para conclusão: 2010-04-07  23:28:51 - Máquina reiniciou
ComboFix-quarantined-files.txt  2010-04-08 02:28

Pré-execução: 6 pasta(s) 55.161.634.816 bytes disponíveis
Pós execução: 8 pasta(s) 55.135.924.224 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG*****
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - BB124DC98875695B98144962E2A910CA

Certo de vossa ajuda, e no aguardo,
Yhann.

**Serafan** · 08-04-2010, 13:22

Oi _*Yh@nN*_,

Aparentemente o seu computador está normal, dei uma olhada por cima no log e as únicas anormalidades que eu encontrei são algumas entradas de registro corrompidas, que já foram corrigidas, mas que não interferem em nada no seu problema.

Talvez o problema possa ser sim algum rootkit, ou malware.
Seguiremos um procedimento padrão para remover tais pragas:

- Baixe o malwarebytes nesse link:
http://www.baixaki.com.br/download/m...ti-malware.htm

- Baixe o RegSeeker nesse link:
http://www.baixaki.com.br/download/regseeker.htm

- Baixe o SpyBot - Search & Destroy nesse link:
http://www.baixaki.com.br/download/s...ch-destroy.htm

Execute o RegSeeker, clique em Find in registry e na caixa de dialogo Search For escreva " tibia " sem as aspas e minusculo.
Serão encontrados inumeras chaves de registros. Selecione todas clicando em uma aleatoria e usando o comando CTRL + A (selecionar tudo) do seu teclado, clique em Action em baixo da tela, e logo em seguida em Delete selected items...

-

Execute o malwarebytes, marque a opção Verificação Completa, e clique em verificar. Aguarde até o procedimento ser concluído, se alguma praga for encontrada, exclua.

-

Insale o SpyBot, e execute-o.
Clique em Search for Updates, escolha um mirror e clique em continue, depois em Download, espere terminar e depois clique em Exit. Depois no menu da esquerda clique em Imunizar, e em Immunize. Quando terminar, clique em Search & Destroy, no mesmo menu da esquerda, e em Examinar. Quando terminar, marque todos os erros que aparecerão em vermelho, e clique em Corrigir erros selecionados.

**Thyco heel** · 12-04-2010, 22:35

Obrigadão mesmo, resolveu!

**Serafan** · 14-04-2010, 13:47

Oi Rikkx,

Sempre que precisar, pode voltar aqui que me manterei ativo no tópico (:
Se achar conveniente pode me mandar uma MP clicando no meu nome na SIGN abaixo.

**Sparkz Senpai** · 23-06-2010, 11:50

aqui em casa o site do tibia funciona normal...

quando eu clico em login ele trava com todos os navegador....

ja fiz o que voce falou e não adiantou nada... =(

se alguem souber do meu problema vou agradeçer mt

**Serafan** · 04-07-2010, 23:04

Seu problema pode estar na latência entre o servidor que hosteia o site do tibia, com o seu provedor.

Para tirar a prova se tal informação é ou não procedente, vá até iniciar > executar;
Na caixa de dialogo que apareceu, digite: cmd

Na janela que abriu, escreva: ping www.tibia.com

Se o resultado for: Esgotado tempo limite do pedido
Problema: A latência está alta, e você não está conseguindo uma boa comunicação com o servidor.
Solução: Aumentar a velocidade da sua internet ou checar se a mesma possui limite de banda. Para saber se a sua internet possui um limite de banda (quantidade de dados que você pode transferir em um determinado tempo, geralmente um mês) ligue para o 0800 da sua prestadora de serviços banda larga e se informe.

Se o resultado for: Resposta de [IP]: bytes=32 tempo<Xms TTL=Y
Onde X e Y são variáveis.
Problema: Nenhum, a culpa não é da sua internet, o problema pode ser com o seu dns, tente limpar o cachê dns. Faça o seguinte:

Ainda na janela do prompt de comando (cmd) digite: ipconfig /flushdns
Repita este procedimento 3 vezes e tente acessar o site.

Se isso não resolver o seu problema, volte a postar aqui, tentarei ajuda-lo de diferentes formas possíveis.

**nathanFJV** · 13-07-2010, 12:50

Log

Código:

ComboFix 10-07-12.06 - Nathan 13/07/2010  12:20:16.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.55.1046.18.1007.517 [GMT -3:00]
Executando de: c:\documents and settings\Nathan\Desktop\ComboFix*****
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((((((((((((((((((((((((   Outras Exclusões   )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger
c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger\Ardamax Keylogger.lnk
c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger\Help.lnk
c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger\Log Viewer.lnk
c:\documents and settings\MuAwaY\muaway*****
c:\documents and settings\MuAwaY\mumsg.dll
c:\documents and settings\MuAwaY\npgwev.dll
c:\documents and settings\MuAwaY\wz_patch.dll
c:\documents and settings\MuAwaY\wz_text.dll
C:\Thumbs.db
c:\windows\obs.txt
c:\windows\system32\28463
c:\windows\system32\28463\akv.cfg
c:\windows\system32\28463\Jul_03_2010__19_26_36.jpg
c:\windows\system32\28463\Jul_03_2010__19_27_36.jpg
c:\windows\system32\28463\Jul_03_2010__19_29_48.jpg
c:\windows\system32\28463\Jul_03_2010__19_30_48.jpg
c:\windows\system32\28463\Jul_03_2010__19_31_48.jpg
c:\windows\system32\28463\Jul_03_2010__19_32_49.jpg
c:\windows\system32\28463\Jul_03_2010__19_33_49.jpg
c:\windows\system32\28463\Jun_15_2010__18_30_30.jpg
c:\windows\system32\28463\key.bin
c:\windows\system32\28463\NPRJ.001
c:\windows\system32\28463\NPRJ.005
c:\windows\system32\28463\OTSH.001
c:\windows\system32\28463\OTSH.002
c:\windows\system32\28463\OTSH.006
c:\windows\system32\28463\OTSH.007
c:\windows\system32\28463\SKQG.001
c:\windows\system32\28463\SKQG.002
c:\windows\system32\28463\SKQG.002.tmp
c:\windows\system32\28463\SKQG.005
c:\windows\system32\28463\SKQG.005.tmp
c:\windows\system32\28463\SKQG.009
c:\windows\system32\28463\SKQG.009.tmp
c:\windows\system32\28463\WRIL.001
c:\windows\system32\28463\WRIL.002
c:\windows\system32\28463\WRIL.005
c:\windows\system32\28463\WRIL.007
c:\windows\system32\Thumbs.db
c:\windows\system32\winio.vxd
c:\windows\wpe pro.INI

.
((((((((((((((((   Arquivos/Ficheiros criados de 2010-06-13 to 2010-07-13  ))))))))))))))))))))))))))))
.

2010-07-13 03:54 . 2010-07-13 03:54    --------    d-----w-    c:\arquivos de programas\Pando Networks
2010-07-12 04:50 . 2010-06-28 20:37    165456    ----a-w-    c:\windows\system32\drivers\aswSP.sys
2010-07-12 04:50 . 2010-06-28 20:32    17744    ----a-w-    c:\windows\system32\drivers\aswFsBlk.sys
2010-07-12 04:50 . 2010-06-28 20:33    23376    ----a-w-    c:\windows\system32\drivers\aswRdr.sys
2010-07-12 04:50 . 2010-06-28 20:37    46672    ----a-w-    c:\windows\system32\drivers\aswTdi.sys
2010-07-12 04:50 . 2010-06-28 20:32    100176    ----a-w-    c:\windows\system32\drivers\aswmon2.sys
2010-07-12 04:50 . 2010-06-28 20:32    94544    ----a-w-    c:\windows\system32\drivers\aswmon.sys
2010-07-12 04:50 . 2010-06-28 20:32    28880    ----a-w-    c:\windows\system32\drivers\aavmker4.sys
2010-07-12 04:50 . 2010-06-28 20:57    38848    ----a-w-    c:\windows\avastSS*****
2010-07-12 04:50 . 2010-06-28 20:57    165032    ----a-w-    c:\windows\system32\aswBoot*****
2010-07-12 04:50 . 2010-07-12 04:50    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Alwil Software
2010-07-12 04:50 . 2010-07-12 04:50    --------    d-----w-    c:\arquivos de programas\Alwil Software
2010-07-12 03:37 . 2010-07-13 01:31    --------    d-----w-    c:\documents and settings\Cópia de MuAwaY
2010-07-12 03:24 . 2010-07-12 03:24    --------    d-----w-    c:\arquivos de programas\Opera
2010-07-11 20:42 . 2010-07-11 20:42    --------    d-----w-    c:\windows\system32\wbem\Repository
2010-07-10 16:16 . 2010-07-11 20:42    --------    d-----w-    c:\arquivos de programas\Charles
2010-07-06 04:30 . 2010-07-06 04:30    --------    d-----w-    c:\arquivos de programas\Rockstar Games
2010-07-06 01:28 . 2010-07-06 02:26    --------    d-----w-    c:\arquivos de programas\DAEMON Tools Toolbar
2010-07-06 01:28 . 2010-07-06 11:48    --------    d-----w-    c:\arquivos de programas\DAEMON Tools Lite
2010-07-06 01:28 . 2010-07-06 01:33    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\DAEMON Tools Lite
2010-07-06 01:27 . 2010-07-06 01:28    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\DAEMON Tools Lite
2010-07-01 05:57 . 2010-07-01 05:57    --------    d-----w-    c:\arquivos de programas\Bonjour
2010-06-30 03:42 . 2010-06-30 03:42    --------    d-----w-    c:\documents and settings\Nathan\temp
2010-06-30 01:52 . 2010-06-30 01:52    --------    d-----w-    c:\arquivos de programas\Wisdom-soft AutoScreenRecorder 3 Free
2010-06-26 23:45 . 2010-06-26 23:45    --------    d-----w-    C:\TopEvo3
2010-06-25 19:14 . 2010-06-25 19:14    --------    d-----w-    c:\arquivos de programas\AmitySource
2010-06-25 06:14 . 2010-07-12 22:08    --------    d-----w-    C:\Fraps
2010-06-24 20:22 . 2010-06-24 20:22    --------    d-----w-    c:\documents and settings\taynna\Dados de aplicativos\Apple Computer
2010-06-24 18:30 . 2010-07-12 19:42    --------    d-----w-    c:\documents and settings\taynna\Dados de aplicativos\uTorrent
2010-06-22 03:00 . 2010-06-22 03:04    664    ----a-w-    c:\windows\system32\d3d9caps.dat
2010-06-22 02:46 . 2008-07-10 16:56    107864    ----a-w-    c:\windows\system32\tsccvid.dll
2010-06-22 02:46 . 2010-06-22 02:46    --------    d-----w-    c:\windows\system32\QuickTime
2010-06-22 02:46 . 2010-06-22 02:46    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\TechSmith
2010-06-22 02:46 . 2010-06-22 02:46    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\TechSmith Shared
2010-06-22 02:46 . 2010-06-22 02:46    --------    d-----w-    c:\arquivos de programas\TechSmith
2010-06-20 20:52 . 2010-06-20 20:52    8854    ----a-r-    c:\documents and settings\Nathan\Dados de aplicativos\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\Uninstall_Project64__9559F7CA5E344237A2D9D856464AD727*****
2010-06-20 20:52 . 2010-06-20 20:52    40960    ----a-r-    c:\documents and settings\Nathan\Dados de aplicativos\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727*****
2010-06-20 20:52 . 2010-06-20 20:52    40960    ----a-r-    c:\documents and settings\Nathan\Dados de aplicativos\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON*****
2010-06-20 20:52 . 2010-06-20 20:58    --------    d-----w-    c:\arquivos de programas\Project64 1.6
2010-06-20 03:41 . 2010-06-20 03:56    --------    d-----w-    c:\arquivos de programas\zbattle.net
2010-06-17 00:51 . 2010-06-17 00:51    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Skype
2010-06-16 23:46 . 2010-06-16 23:46    --------    d-----w-    c:\documents and settings\MuAwaY\GameGuard
2010-06-16 23:43 . 2010-06-16 23:45    --------    d-----w-    c:\documents and settings\MuAwaY\data
2010-06-16 23:43 . 2007-07-21 13:52    163840    ----a-w-    c:\documents and settings\MuAwaY\unrar.dll
2010-06-16 23:43 . 2009-01-13 04:51    565248    ----a-w-    c:\documents and settings\MuAwaY\jogar*****
2010-06-16 23:43 . 2008-08-26 05:02    73728    ----a-w-    c:\documents and settings\MuAwaY\atualiza*****
2010-06-16 23:43 . 2007-11-07 04:19    655872    ----a-w-    c:\documents and settings\MuAwaY\msvcr90.dll
2010-06-16 23:43 . 2010-07-13 15:24    --------    d-----w-    c:\documents and settings\MuAwaY
2010-06-16 23:43 . 2010-06-16 23:45    262683    ----a-w-    c:\documents and settings\MuAwaY\unins000.dat
2010-06-16 23:43 . 2010-06-16 23:42    712330    ----a-w-    c:\documents and settings\MuAwaY\unins000*****
2010-06-16 22:25 . 2008-04-13 22:20    4255    ------w-    c:\windows\system32\drivers\adv01nt5.dll
2010-06-16 19:39 . 2010-07-12 19:42    --------    d-----w-    c:\documents and settings\taynna\Dados de aplicativos\Orbit
2010-06-16 14:06 . 2010-06-16 14:06    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\GrabPro
2010-06-16 14:06 . 2010-06-16 14:06    --------    d-----w-    c:\arquivos de programas\Orbitdownloader
2010-06-16 14:06 . 2010-07-13 15:12    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Orbit
2010-06-15 06:34 . 2010-06-16 04:20    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\TeamViewer
2010-06-15 06:34 . 2010-06-30 03:43    --------    d-----w-    c:\arquivos de programas\TeamViewer
2010-06-15 02:16 . 2010-06-15 02:16    86016    ----a-w-    c:\windows\system32\frapsvid.dll
2010-06-14 19:02 . 2010-06-25 16:19    --------    d-----w-    C:\output

.
(((((((((((((((((((((((((((((((((((((   Relatório Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-13 15:12 . 2010-05-22 15:24    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\uTorrent
2010-07-13 15:06 . 2010-05-21 20:59    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Skype
2010-07-13 14:27 . 2010-05-23 04:24    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\skypePM
2010-07-12 21:40 . 2010-05-23 21:41    --------    d--h--w-    c:\arquivos de programas\InstallShield Installation Information
2010-07-11 19:23 . 2010-05-23 01:35    --------    d-----w-    c:\arquivos de programas\Cópia de MuAwaY
2010-07-01 05:57 . 2010-05-30 11:27    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Adobe
2010-06-25 19:29 . 2010-05-22 13:35    --------    d-----w-    c:\arquivos de programas\PhotoScape
2010-06-24 18:30 . 2010-05-22 15:25    --------    d-----w-    c:\arquivos de programas\uTorrent
2010-06-23 22:00 . 2010-05-21 21:31    --------    d-----w-    c:\arquivos de programas\MuAwaY
2010-06-17 00:51 . 2010-05-20 21:43    --------    d-----r-    c:\arquivos de programas\Skype
2010-06-17 00:51 . 2010-05-20 21:43    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Skype
2010-06-16 06:18 . 2010-05-22 06:06    848    --sha-w-    c:\windows\system32\KGyGaAvL.sys
2010-06-14 17:00 . 2010-05-20 22:00    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help
2010-06-14 14:40 . 2010-05-22 19:12    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\LimeWire
2010-06-12 05:52 . 2010-05-21 21:16    --------    d-----w-    c:\arquivos de programas\DevilzMu
2010-06-11 05:00 . 2010-05-20 22:10    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\InstallShield
2010-06-10 18:39 . 2010-06-10 18:39    --------    d-----w-    c:\documents and settings\taynna\Dados de aplicativos\4shared Desktop
2010-06-10 05:51 . 2010-05-25 01:47    --------    d---a-w-    c:\documents and settings\All Users\Dados de aplicativos\TEMP
2010-06-08 22:55 . 2010-06-08 22:48    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\GetRightToGo
2010-06-08 20:19 . 2010-06-08 20:19    --------    d-----w-    c:\arquivos de programas\baidu
2010-06-06 18:22 . 2010-06-05 19:55    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\DAEMON Tools Pro
2010-06-05 19:55 . 2010-06-05 19:55    697328    ----a-w-    c:\windows\system32\drivers\sptd.sys
2010-06-05 19:55 . 2010-06-05 19:55    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\DAEMON Tools Pro
2010-06-05 19:41 . 2010-05-20 21:56    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Ahead
2010-06-02 13:17 . 2001-10-28 14:07    50152    ----a-w-    c:\windows\system32\perfc016.dat
2010-06-02 13:17 . 2001-10-28 14:07    347980    ----a-w-    c:\windows\system32\perfh016.dat
2010-06-01 06:01 . 2010-06-01 06:01    --------    d-----w-    c:\arquivos de programas\MSXML 4.0
2010-05-30 17:35 . 2010-05-30 12:03    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\FLEXnet
2010-05-30 11:52 . 2010-05-30 11:52    --------    d-----w-    c:\arquivos de programas\Adobe Media Player
2010-05-30 11:48 . 2010-05-30 11:48    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Adobe AIR
2010-05-30 11:42 . 2010-05-30 11:42    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Macrovision Shared
2010-05-29 22:56 . 2010-05-20 22:02    --------    d-----w-    c:\arquivos de programas\Windows Media Connect 2
2010-05-29 22:56 . 2010-05-22 19:11    --------    d-----w-    c:\arquivos de programas\LimeWire
2010-05-29 03:40 . 2010-05-20 21:57    --------    d-----w-    c:\arquivos de programas\Google
2010-05-29 03:40 . 2010-05-27 03:30    --------    d-----w-    c:\arquivos de programas\SpeederXP
2010-05-24 22:35 . 2010-05-22 13:45    --------    d-----w-    c:\arquivos de programas\PhotoFiltre Studio X
2010-05-23 04:24 . 2010-05-23 04:24    56    ---ha-w-    c:\windows\system32\ezsidmv.dat
2010-05-22 19:04 . 2010-05-22 19:04    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Apple Computer
2010-05-22 14:14 . 2010-05-21 20:48    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!
2010-05-22 05:07 . 2010-05-22 05:07    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Media Player Classic
2010-05-21 20:41 . 2010-05-21 20:41    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Avira
2010-05-21 00:55 . 2010-05-21 00:55    0    ----a-w-    c:\windows\nsreg.dat
2010-05-20 22:12 . 2010-05-20 22:12    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Corel
2010-05-20 22:10 . 2010-05-20 22:10    65536    ----a-r-    c:\documents and settings\Nathan\Dados de aplicativos\Microsoft\Installer\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C*****
2010-05-20 22:10 . 2010-05-20 22:10    10134    ----a-r-    c:\documents and settings\Nathan\Dados de aplicativos\Microsoft\Installer\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}\ARPPRODUCTICON*****
2010-05-20 22:10 . 2010-05-20 22:10    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\InstallShield
2010-05-20 22:09 . 2010-05-20 22:09    --------    d-----w-    c:\arquivos de programas\Corel
2010-05-20 22:09 . 2010-05-20 22:09    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Corel
2010-05-20 22:05 . 2010-05-20 22:05    --------    d-----w-    c:\arquivos de programas\Microsoft Works
2010-05-20 22:05 . 2010-05-20 22:05    --------    d-----w-    c:\arquivos de programas\MSBuild
2010-05-20 21:59 . 2010-05-20 21:58    --------    d-----w-    c:\arquivos de programas\QuickTime
2010-05-20 21:58 . 2010-05-20 21:58    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Apple Computer
2010-05-20 21:58 . 2010-05-20 21:58    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Apple
2010-05-20 21:58 . 2010-05-20 21:58    --------    d-----w-    c:\arquivos de programas\Apple Software Update
2010-05-20 21:58 . 2010-05-20 21:58    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Apple
2010-05-20 21:56 . 2010-05-20 21:54    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Ahead
2010-05-20 21:56 . 2010-05-20 21:56    --------    d-----w-    c:\arquivos de programas\K-Lite Codec Pack
2010-05-20 21:54 . 2010-05-20 21:54    --------    d-----w-    c:\arquivos de programas\Nero
2010-05-20 21:53 . 2010-05-20 21:53    --------    d-----w-    c:\documents and settings\Nathan\Dados de aplicativos\Foxit
2010-05-20 21:53 . 2010-05-20 21:53    --------    d-----w-    c:\arquivos de programas\Foxit Software
2010-05-20 21:52 . 2010-05-20 21:52    --------    d-----w-    c:\arquivos de programas\Messenger Plus! Live
2010-05-20 21:46 . 2010-05-20 21:45    --------    d-----w-    c:\arquivos de programas\Windows Live
2010-05-20 21:45 . 2010-05-20 21:45    --------    d-----w-    c:\arquivos de programas\Microsoft
2010-05-20 21:45 . 2010-05-20 21:45    --------    d-----w-    c:\arquivos de programas\Windows Live SkyDrive
2010-05-20 21:43 . 2010-05-20 21:43    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Windows Live
2010-05-20 21:36 . 2010-05-20 21:36    --------    d-----w-    c:\arquivos de programas\CCleaner
2010-05-20 21:35 . 2010-05-20 21:35    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\DVD Shrink
2010-05-20 21:35 . 2010-05-20 21:35    --------    d-----w-    c:\arquivos de programas\DVD Shrink
2010-05-20 21:34 . 2010-05-20 21:34    --------    d-----w-    c:\arquivos de programas\DVDFab Decrypter 3
2010-05-20 21:30 . 2010-05-20 21:30    2232    ----a-w-    c:\windows\java\Packages\Data\R7J5Z7RJ.DAT
2010-05-20 21:30 . 2010-05-20 21:30    155995    ----a-w-    c:\windows\java\Packages\YE1NLJ1J*****
2010-05-20 21:30 . 2010-05-20 21:30    2678    ----a-w-    c:\windows\java\Packages\Data\HBX39BBN.DAT
2010-05-20 21:30 . 2010-05-20 21:30    2678    ----a-w-    c:\windows\java\Packages\Data\FPNJ135R.DAT
2010-05-20 21:30 . 2010-05-20 21:30    2678    ----a-w-    c:\windows\java\Packages\Data\LFFRHN5R.DAT
2010-05-20 21:30 . 2010-05-20 21:30    2678    ----a-w-    c:\windows\java\Packages\Data\C2UNRHBZ.DAT
2010-05-20 21:30 . 2010-05-20 21:30    2678    ----a-w-    c:\windows\java\Packages\Data\2J5RZNP7.DAT
2010-05-20 21:29 . 2010-05-20 21:29    --------    d-----w-    c:\arquivos de programas\Java
2010-05-20 21:29 . 2010-05-20 21:29    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Java
2010-05-20 21:28 . 2010-05-20 21:28    --------    d-----w-    c:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-20 21:28 . 2010-05-20 21:28    --------    d-----w-    c:\arquivos de programas\Avira
2010-05-20 20:55 . 2010-05-20 20:12    86327    ----a-w-    c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-05-20 20:13 . 2010-05-20 20:13    --------    d-----w-    c:\arquivos de programas\microsoft frontpage
2010-05-20 20:11 . 2010-05-20 20:11    --------    d-----w-    c:\arquivos de programas\Serviços on-line
2010-05-20 20:11 . 2010-05-20 20:11    --------    d-----w-    c:\arquivos de programas\Arquivos comuns\Serviços
2010-05-20 20:09 . 2010-05-20 20:09    21844    ----a-w-    c:\windows\system32\emptyregdb.dat
2010-05-20 17:00 . 2010-05-20 17:00    --------    d-----w-    c:\arquivos de programas\Motorola
2010-05-04 17:17 . 2008-04-13 21:20    832512    ----a-w-    c:\windows\system32\wininet.dll
2010-05-04 17:17 . 2008-04-13 21:20    78336    ----a-w-    c:\windows\system32\ieencode.dll
2010-05-04 17:17 . 2008-04-13 21:20    17408    ----a-w-    c:\windows\system32\corpol.dll
2010-05-02 08:08 . 2008-04-13 20:54    1851392    ----a-w-    c:\windows\system32\win32k.sys
2010-04-20 05:31 . 2008-04-13 21:18    285696    ----a-w-    c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\arquivos de programas\uTorrent\uTorrent*****" [2010-06-24 461688]
"Google Update"="c:\documents and settings\Nathan\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate*****" [2010-06-11 136176]
"DAEMON Tools Lite"="c:\arquivos de programas\DAEMON Tools Lite\DTLite*****" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\arquivos de programas\Avira\AntiVir Desktop\avgnt*****" [2010-03-02 282792]
"AdobeCS4ServiceManager"="c:\arquivos de programas\Arquivos comuns\Adobe\CS4ServiceManager\CS4ServiceManager*****" [2008-08-14 611712]
"avast5"="c:\arquiv~1\ALWILS~1\Avast5\avastUI*****" [2010-06-28 2837864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON*****"="c:\windows\system32\CTFMON*****" [2008-04-13 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm***** [2010-6-16 1809680]

[HKLM\~\startupfolder\C:^Documents and Settings^Nathan^Menu Iniciar^Programas^Inicializar^LimeWire On Startup.lnk]
path=c:\documents and settings\Nathan\Menu Iniciar\Programas\Inicializar\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-08-22 12:52    94208    ----a-w-    c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON*****]
2008-04-13 21:20    15360    ----a-w-    c:\windows\system32\ctfmon*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 03:47    31016    ----a-w-    c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-05-27 14:11    77824    ----a-w-    c:\windows\system32\hkcmd*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-05-27 14:11    94208    ----a-w-    c:\windows\system32\igfxtray*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-08-11 19:30    249856    ----a-w-    c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\ISUSPM*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-08-11 19:30    81920    ----a-w-    c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 19:40    155648    ----a-w-    c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-05-27 14:11    114688    ----a-w-    c:\windows\system32\igfxpers*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 00:53    421888    ----a-w-    c:\arquivos de programas\QuickTime\QTTask*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 19:12    26192168    ----a-r-    c:\arquivos de programas\Skype\Phone\Skype*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
2009-05-27 14:13    638976    ----a-w-    c:\arquivos de programas\Motorola\SMSERIAL\sm56hlpr*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2009-05-27 13:46    577536    ----a-w-    c:\windows\SOUNDMAN*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 07:25    144784    ----a-w-    c:\arquivos de programas\Java\jre1.6.0_05\bin\jusched*****

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"ose"=3 (0x3)
"gusvc"=3 (0x3)
"NBService"=3 (0x3)
"fsssvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag*****"=
"%windir%\\system32\\sessmgr*****"=
"c:\\Arquivos de programas\\LimeWire\\LimeWire*****"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk*****"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr*****"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK*****"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE*****"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE*****"=
"c:\\Arquivos de programas\\uTorrent\\uTorrent*****"=
"c:\\Arquivos de programas\\Messenger\\msmsgs*****"=
"c:\\Arquivos de programas\\Arquivos comuns\\Adobe\\CS4ServiceManager\\CS4ServiceManager*****"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitdm*****"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitnet*****"=
"c:\\Arquivos de programas\\Mozilla Firefox\\firefox*****"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM*****"=
"c:\\Documents and Settings\\Nathan\\temp\\TeamViewer\\Version5\\TeamViewer*****"=
"c:\\Arquivos de programas\\TeamViewer\\Version5\\TeamViewer*****"=
"c:\\Arquivos de programas\\Bonjour\\mDNSResponder*****"=
"c:\\Arquivos de programas\\Opera\\opera*****"=
"c:\\Fraps\\MuAwaY\\jogar*****"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype*****"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/7/2010 01:50 165456]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\Avira\AntiVir Desktop\sched***** [20/5/2010 18:28 135336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/7/2010 01:50 17744]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5/6/2010 16:55 697328]
.
Conteúdo da pasta 'Tarefas Agendadas'
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~3\Office12\EXCEL*****/3000
TCP: {3D56B4E2-F7BF-4A3B-863E-BAF441542285} = 172.16.70.254
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Nathan\Dados de aplicativos\Mozilla\Firefox\Profiles\b8x0j58n.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/
FF - component: c:\arquivos de programas\Orbitdownloader\addons\OneClickYouTubeDownloader\components\GrabXpcom.dll
FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORFÃOS REMOVIDOS - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-13 12:25
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ... 

Procurando entradas auto inicializáveis ocultas ... 

Procurando ficheiros/arquivos ocultos ... 

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
Tempo para conclusão: 2010-07-13  12:28:22
ComboFix-quarantined-files.txt  2010-07-13 15:28

Pré-execução: 19 pasta(s) 40.082.825.216 bytes disponíveis
Pós execução: 21 pasta(s) 41.147.260.928 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG*****
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
c:\$win_nt$.~bt\BOOTSECT.DAT="Instalaçao do Microsoft Windows XP Professional"

- - End Of File - - C1A10E280EAAD08DAAA414CDA1D0C82B

Tópico: Resolvendo problemas com sites !

Ferramentas de Tópicos

Exibir

bom precisa de ajuda...

Tópicos Similares

Tecnologia | Problemas com sites da Glogo que estão sendo redirecionados

Taverna | Procon Libera lista de sites não confiáveis de compra.

[Artigo Oficial] 50 respostas dos product managers

Problemas e mais problemas......

Permissões de Postagem