Firefox - Home inicial abre com Babylon Search

Olá, tudo bom!?

Bem, ao instalar o PhotoScape no meu PC, mesmo não autorizando a Barra Toolbar Babylon (e de fato ela não aparece mesmo), agora toda vez que inicio o Firefox, a página inicial deixa de ser Google para ser Babylon!


Por favor. Se puder ajudar...Obrigada.

Obs:

Nã há problema com o IE. Está tudo Ok. Já resolvi tudo!

Nã há Caixas de pesquisas/Toolbar Babylon nem no IE ou Firefox.

Removi tudo que é Babylon no Painel de Controle - Hadware.

Removi tudo que é Babylon depois de pesquisar na caixa de pesquisa do meu PC.

Nã há Babylon nos complementos >> extensões do Firefox.

Já desinstalei e instalei o Firefox.

Já fui em FERRAMENTAS>> OPÇÕES>> E Já mudei o link da página inicial para o Google. Não resolve!

Apenas a página INICIAL (Home) que aparece o Babylon Search.

Nas Novas páginas Guias do Firefox já resolvi o problema e está ok!

Mas continua na Home inicial toda vez que entro.

Amigo, o topico não está aceitando eu postar o Log de ZHPDiag_silent.

Aparece essa frase aqui no forum:

Você não tem permissão para postar links externos e e-mails.
A largura da sua mensagem ultrapassa o limite autorizado.

Boa Noite! Diva.pop.s

|- A ferramenta ZHPDiag_silent ao findar seu scan,costuma gerar um link.
|- Poste esse link e não o relatório que,provavelmente,o Fórum não permite devido ao tamanho.

Abraços!

joram escreveu:Boa Noite! Diva.pop.s

|- A ferramenta ZHPDiag_silent ao findar seu scan,costuma gerar um link.
|- Poste esse link e não o relatório que,provavelmente,o Fórum não permite devido ao tamanho.

Abraços!

Sim. Ok. Eis o link gerado:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Bom Dia! Diva.pop.s

|- Desinstale: SpywareTerminator <- Placebo!

-/-

|- O Fórum está no seu início,daí essa dificuldade que encontrou ao postar. Estou realizando alguns ajustes e acredito que estará pronto daqui à 2 ou 3 semanas.
|- Quer ser Moderadora da sala,ainda virgem,"Artigos & Tutoriais"?

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Ps: Clique neste ícone,ao postar suas respostas.

-/-

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... de C-XX )

|- Ou... < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > <- Link!

|- Salve-o em C:\ ( Disco local )
|- Duplo clique em AD-R.exe
|- Para Windows Vista ou 7,dê clique direito no arquivo e execute-o como administrador!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Aperte a opção "Clean".
|- Ao concluir,aceite/confirme o reboot.
|- Ou seja,o computador irá reiniciar!
|- Poste o relatório: C:\Ad-Report-CLEAN[1].txt

-/-

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

|- Descompacte-o para o desktop.

|- Feche programas/pastas que estejam abertas.
|- Feche,também,o navegador!
|- Para Windows Vista,desabilite a [Tens de ter uma conta e sessão iniciada para poderes visualizar este link].

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >> [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.
|- Selecione e copie estas informações,que estão em vermelho,para o "Bloco de Notas".

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} Orphean Key => Infection BT (Toolbar.Babylon)
O3 - Toolbar: (no name) - [HKLM]{D0F4A166-B8D4-48b8-9D63-80849FE137CB} . (...) -- (.not file.)
O8 - Extra context menu item: Baixar com Mipony - (.not file.) - file:\\D:\Karlla\Programas\Mipony\Browser\IEContext.htm
O41 - Driver: (ifqjsuqj) . (. - .) - C:\WINDOWS\system32\drivers\ifqjsuqj.sys (.not file.)
O41 - Driver: (MpKsl75d209fc) . (. - .) - C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Microsoft Antimalware\Definition Updates\{C53E17A7-11ED-4CBC-8B03-A8420628C74C}\MpKsl75d209fc.sys (.not file.)

[HKLM\Software\Classes\AppID\NCTAudioCDGrabber2.DLL]
[HKLM\Software\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}] => Toolbar.BarsShare
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] => Infection BT (Adware.MyWebSearch)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49dd-99D7-DC866BE87DBC}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}] => Infection PUP (PUP.DealPly)

C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\Conduit => Toolbar.Conduit
C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\OpenCandy

emptytemp
emptyflash
proxyfix
firewallraz
sysrestore

|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"
|- Minimize o Bloco de Notas.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique no menu,"Paste ClipBoard".
|- Clique em "GO" -> Oui.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.
|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt

Abraços!

Amigo, fique tranquilo, eu entendo que o forum é novo..rs.

Olha, mas sobre a orientação que vc me passou para deletar o babylon, mesmo fazendo login,não consigo ver nem as imgs nem os links. Aparece esssa mensagem: [Somente administradores podem ver este link].

Diva.pop.s escreveu:Amigo, fique tranquilo, eu entendo que o forum é novo..rs.

Olha, mas sobre a orientação que vc me passou para deletar o babylon, mesmo fazendo login,não consigo ver nem as imgs nem os links. Aparece esssa mensagem: [Somente administradores podem ver este link].

Olá!

|- Tente agora! Vc deverá estar logada,para ter acesso à links.

Abs!

======= REPORT FROM AD-REMOVER 2.0.0.2,G | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

C:\Arquivos de programas\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 15:23:03 on 19/08/2012, Normal boot

Microsoft Windows XP Professional Service Pack 3 (X86)
Karlla Oliveira@KARLLA ( )

============== ACTION(S) ==============


Folder deleted: C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\Conduit
Folder deleted: C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\OpenCandy

(!) -- Temporary files deleted.




============== ADDITIONNAL SCAN ==============

**** Mozilla Firefox Version [14.0.1 (pt-BR)] ****

HKLM_MozillaPlugins\Adobe Reader (x)
Searchplugins\buscape.xml (hxxp://busca.buscape.com.br/cprocura)
Searchplugins\mercadolivre.xml (hxxp://pmstrk.mercadolivre.com.br/jm/PmsTrk)
Searchplugins\twitter.xml (hxxps://twitter.com/search/{searchTerms})
Searchplugins\wikipedia-br.xml (hxxp://pt.wikipedia.org/wiki/Especial:Busca)
Searchplugins\yahoo-br.xml (hxxp://br.search.yahoo.com/search)
Components\browsercomps.dll (Mozilla Foundation)
HKCU_Extensions|{b64982b1-d112-42b5-b1e4-d3867c4533f8} - C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension

-- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mozilla\FireFox\Profiles\vn4muszz.default --
Prefs.js - browser.download.lastDir, C:
Prefs.js - browser.search.defaultenginename, Search the web (Babylon)
Prefs.js - browser.search.selectedEngine, Search the web (Babylon)
Prefs.js - browser.startup.homepage, [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Prefs.js - browser.startup.homepage_override.buildID, 20120713134347
Prefs.js - browser.startup.homepage_override.mstone, 14.0.1

========================================

**** Internet Explorer Version [8.0.6001.18702] ****

HKCU_Main|Default_Page_URL - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKCU_Main|Default_Search_URL - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKCU_Main|Search bar - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKCU_Main|Start Page - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM_Main|Default_Page_URL - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM_Main|Default_Search_URL - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM_Main|Search bar - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM_Main|Search Page - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM_Main|Start Page - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKCU_SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - "?" (?)
HKCU_SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} - "?" (?)
HKCU_Toolbar\WebBrowser|{C55BBCD6-41AD-48AD-9953-3609C48EACC7} (x)
HKLM_Toolbar|{D0F4A166-B8D4-48b8-9D63-80849FE137CB} (x)
HKLM_ElevationPolicy\9a0ab238-6479-498a-bf23-bc40a3e594ad - C:\Arquivos de programas\DVDVideoSoftTB\DVDVideoSoftTBToolbarHelper.exe (x)
HKLM_ElevationPolicy\df8cb91c-e823-41e3-84ab-d78e031a5443 - C:\Arquivos de programas\mipony-plugin\mipony-pluginToolbarHelper.exe (x)
HKLM_ElevationPolicy\{08E8D305-8D6D-49fe-8603-03A926E46AE0} - C:\Arquivos de programas\Arquivos comuns\Adobe\Updater6\Adobe_Updater.exe (x)
HKLM_ElevationPolicy\{1C306DF7-2171-45c8-9324-D36448104BD5} - C:\Arquivos de programas\Free Download Manager\fdm.exe (x)
HKLM_ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2} - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe (x)
HKLM_ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} - C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe (x)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\{2EECD738-5844-4a99-B4B6-146BF802613B} (?)

========================================

C:\Arquivos de programas\Ad-Remover\Quarantine: 38 File(s)
C:\Arquivos de programas\Ad-Remover\Backup: 13 File(s)

C:\Ad-Report-CLEAN[1].txt - 19/08/2012 15:23:13 (696 Byte(s))

End at: 15:24:36, 19/08/2012

============== E.O.F ==============

Rapport de ZHPFix 1.2.06 par Nicolas Coolman, Update du 17/05/2012
Fichier d'export Registre :
Run by Karlla Oliveira at 19/8/2012 15:31:36
Windows XP Professional Service Pack 3 (Build 2600)
Web site : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Web site : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

========== Registry Key ==========
DELETED Key: CLSID BHO: {2EECD738-5844-4a99-B4B6-146BF802613B}
DELETED Key*: Menu Contextuel: Baixar com Mipony
DELETED Driver Key: ifqjsuqj
DELETED Key*: HKLM\Software\Classes\AppID\NCTAudioCDGrabber2.DLL
DELETED Key*: HKLM\Software\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
DELETED Key: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}
DELETED Key*: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4a99-B4B6-146BF802613B}
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4a99-B4B6-146BF802613B}
DELETED Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49dd-99D7-DC866BE87DBC}
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}

========== Registry Value ==========
ERROR O3 - Toolbar: (no name) - [HKLM]{D0F4A166-B8D4-48b8-9D63-80849FE137CB} . (...) -- (.not file.)
NOT FOUND Toolbar: {D0F4A166-B8D4-48b8-9D63-80849FE137CB}
ProxyFix : Proxy killed successfully
DELETED ProxyServer Value
DELETED ProxyEnable Value
DELETED EnableHttp1_1 Value
DELETED ProxyHttp1.1 Value
DELETED ProxyOverride Value
DELETED FirewallRaz (SP) : %windir%\Network Diagnostic\xpnetdiag.exe
DELETED FirewallRaz (SP) : %windir%\system32\sessmgr.exe
DELETED FirewallRaz (SP) : C:\Arquivos de programas\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe
DELETED FirewallRaz (SP) : C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\mjusbsp\magicJack.exe
DELETED FirewallRaz (DP) : %windir%\Network Diagnostic\xpnetdiag.exe
DELETED FirewallRaz (DP) : %windir%\system32\sessmgr.exe
DELETED FirewallRaz (DP) : C:\Arquivos de programas\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe
No Value in Firewall Exception Register Key (FirewallRaz)

========== Repertory ==========
DELETED Window Temporary:
DELETED Flash Cookies:

========== File ==========
NOT FOUND File: e:\\d:\karlla\programas\mipony\browser\iecontext.htm
NOT FOUND Folder/File: c:\documents and settings\karlla oliveira\configurações locais\dados de aplicativos\conduit
NOT FOUND Folder/File: c:\documents and settings\karlla oliveira\configurações locais\dados de aplicativos\opencandy
DELETED Window Temporary:
DELETED Flash Cookies:

========== Restoration ==========
Restore System Point created succefully


========== Summary ==========
12 : Registry Key
16 : Registry Value
2 : Repertory
5 : File
1 : Restoration


End of clean in 00mn 19s

========== Report File ==========
C:\ZHP\ZHPFix[R1].txt - 19/8/2012 15:31:36 [3211]

Boa Tarde! Diva.pop.s

|- No Firefox,vá em "Ferramentas" -> "Opções..." -> "Privacidade"
|- Marque: "Sites podem definir cookies"
|- Clique em "Exceções...".
|- À seguir,digite no campo o domínio: babylon.com
|- Clique em "Bloquear" -> "Fechar".
|- Clique,novamente,na guia "Ferramentas" -> "Complementos" -> "Extensões".
|- Localize e remova,se existir,Babylon.
|- Clique "Excluir".

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by OldTimer Tools )

|- Clique em Salvar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

|- Salve-o no desktop!
|- Duplo clique em OTL.exe -> Executar.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >> [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Configure "Verificação de Arquivos",segundo a screenshot!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Ps: Faça o mesmo para estes!
|- Em "Exame Extra do Registro",assinale "Nenhum".

< *crack* /s >
< *keygen* /s >
< *serial* /s >
< *AutoKMS* /s >
< *loader* /s >
%APPDATA%\Local\*.
%APPDATA%\*.exe /s
%APPDATA%\*.
%USERPROFILE%\AppData\Local\*.*
%USERPROFILE%\AppData\Roaming\*.*
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\GAC\*.* /S /MD5
%systemroot%\assembly\GAC_32\*.* /S /MD5
%systemroot%\system32\config\systemprofile\AppData\Local\*.*
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
/md5start
netsvcs
explorer.exe
userinit.exe
winlogon.exe
wininit.exe
csrss.exe
smss.exe
svchost.exe
services.exe
uninst.exe
/md5stop
regedit /e c:\registrybackup.reg /c
type c:\boot.ini >> test.txt /c
%systemroot%\system32\Tasks\*.* /s
%windir%\tasks\*.* /s

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Cole estas informações,que estão em verde,para o campo "Exames Personalizados/Correções".

|- Clique em Verificar: [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Concluindo,poste o relatório: OTL.txt
|- Para grandes relatórios,acesse: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

|- Ou...acesse: < |[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]| >

Abraços!

Amigo é o seguinte, eu tenho o Firefox 14.0.1 e veja como é diferente essa aba "Privacidade". Eu tentei procurar o que vc pediu em outras abas, mas não tem...Só tem como excluir os cookies no PC e não bloquear...

É para eu pular essa parte e seguir com o resto dos procedimentos???


[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

Vi que o Firefox tem um complemento próprio p/ bloquear sites, é o "Block". O que acha, devo instalar e bloquear o Babylon?

Bom Dia! Diva.pop.s

Diva.pop.s escreveu:Amigo é o seguinte, eu tenho o Firefox 14.0.1 e veja como é diferente essa aba "Privacidade". Eu tentei procurar o que vc pediu em outras abas, mas não tem...Só tem como excluir os cookies no PC e não bloquear...

É para eu pular essa parte e seguir com o resto dos procedimentos???

|- Sim! Siga o procedimento com a ferramenta OTL.

Diva.pop.s escreveu:Vi que o Firefox tem um complemento próprio p/ bloquear sites, é o "Block". O que acha, devo instalar e bloquear o Babylon?

|- Não! Ao final,instale o [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] que lhe dará maior proteção ao navegar.

Abs!

OTL logfile created on: 20/8/2012 16:10:26 - Run 1
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Documents and Settings\Karlla Oliveira\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy

1,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 73,02% Memory free
3,84 Gb Paging File | 3,44 Gb Available in Paging File | 89,50% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas
Drive C: | 68,36 Gb Total Space | 17,37 Gb Free Space | 25,41% Space Free | Partition Type: NTFS
Drive D: | 397,39 Gb Total Space | 357,96 Gb Free Space | 90,08% Space Free | Partition Type: NTFS

Computer Name: KARLLA | User Name: Karlla Oliveira | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/20 15:45:49 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karlla Oliveira\Desktop\OTL.exe
PRC - [2012/08/12 22:33:10 | 001,697,312 | ---- | M] () -- C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Microsoft Security Client\MsMpEng.exe
PRC - [2012/02/27 00:15:42 | 000,055,144 | ---- | M] (Apple Inc.) -- C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/06/02 16:06:20 | 000,116,104 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\ramaint.exe
PRC - [2010/06/02 16:06:14 | 000,378,248 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
PRC - [2008/04/13 19:21:00 | 001,035,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/08/03 15:09:34 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
PRC - [2007/08/03 15:09:34 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe


========== Modules (No Company Name) ==========

MOD - [2012/08/12 22:33:10 | 002,049,056 | ---- | M] () -- c:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll
MOD - [2012/08/12 22:33:10 | 001,697,312 | ---- | M] () -- C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe
MOD - [2011/11/01 22:26:32 | 000,087,912 | ---- | M] () -- C:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\zlib1.dll
MOD - [2011/11/01 22:26:12 | 001,242,472 | ---- | M] () -- C:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\libxml2.dll
MOD - [2011/05/28 22:04:58 | 000,140,288 | ---- | M] () -- C:\Arquivos de programas\WinRAR\RarExt.dll
MOD - [2010/01/27 18:45:04 | 001,235,280 | ---- | M] () -- C:\Arquivos de programas\LogMeIn\x86\ICSAgent32.dll
MOD - [2009/02/27 19:49:12 | 000,311,296 | ---- | M] () -- C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\pdfshell.PTB


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/08/15 20:36:35 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/12 22:33:10 | 001,697,312 | ---- | M] () [Auto | Running] -- C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -- (Browser Manager)
SRV - [2012/07/13 21:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Arquivos de programas\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Arquivos de programas\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/02/27 00:15:42 | 000,055,144 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2011/07/20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010/06/02 16:06:20 | 000,116,104 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\ramaint.exe -- (LMIMaint)
SRV - [2007/08/03 15:09:34 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2006/10/26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [File_System | Auto | Stopped] -- -- (StarOpen)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (ONDAusbvoice)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (ONDAusbser6k)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (ONDAusbnmea)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (ONDAusbmdm6k)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (InCDRm)
DRV - File not found [Kernel | System | Stopped] -- -- (InCDPass)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a30h1x5k)
DRV - [2010/09/27 23:18:45 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/06/02 16:06:44 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2010/01/27 12:22:02 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2010/01/27 12:22:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2009/03/18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/05/07 08:31:16 | 000,106,368 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/09 07:01:00 | 004,703,744 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search bar = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\SearchScopes,DefaultScope = ${searchCLSID}
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\SearchScopes\${searchCLSID}: "URL" = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\SearchScopes\{3961E45A-FFCD-4B49-8814-587C44D61FD2}: "URL" = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=113480&tt=120812_bandext_3212_4&babsrc=HP_ss&mntrId=d4ae1e7900000000000090e6ba091a7a"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Arquivos de programas\iTunes\Mozilla Plugins\npitunes.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Arquivos de programas\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Arquivos de programas\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Arquivos de programas\Mozilla Firefox\components [2012/08/14 16:05:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Arquivos de programas\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension [2012/08/12 22:33:13 | 000,000,000 | ---D | M]

[2012/08/14 16:06:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mozilla\Extensions
[2012/08/16 00:13:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mozilla\Firefox\Profiles\vn4muszz.default\Extensions
[2012/08/16 00:13:55 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mozilla\Firefox\Profiles\vn4muszz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/08/14 16:05:50 | 000,000,000 | ---D | M] (No name found) -- C:\Arquivos de programas\Mozilla Firefox\extensions
[2012/07/13 21:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Arquivos de programas\mozilla firefox\components\browsercomps.dll
[2012/07/13 22:31:50 | 000,001,027 | ---- | M] () -- C:\Arquivos de programas\mozilla firefox\searchplugins\buscape.xml
[2012/07/13 22:31:50 | 000,001,212 | ---- | M] () -- C:\Arquivos de programas\mozilla firefox\searchplugins\mercadolivre.xml
[2012/07/13 22:31:50 | 000,002,040 | ---- | M] () -- C:\Arquivos de programas\mozilla firefox\searchplugins\twitter.xml
[2012/07/13 22:31:50 | 000,001,168 | ---- | M] () -- C:\Arquivos de programas\mozilla firefox\searchplugins\wikipedia-br.xml
[2012/07/13 22:31:50 | 000,000,952 | ---- | M] () -- C:\Arquivos de programas\mozilla firefox\searchplugins\yahoo-br.xml

O1 HOSTS File: ([2012/02/13 13:06:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [MSC] C:\Arquivos de programas\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [OiVelox] C:\Arquivos de programas\Oi\Programmer\OiVeloxCheck.exe ()
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-21-329068152-2111687655-299502267-1003..\Run: [DAEMON Tools Lite] C:\Arquivos de programas\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O7 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Arquivos de programas\4shared Desktop\down_all.htm File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Arquivos de programas\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76CFB531-0DE7-4ABE-9F0E-98FC34A6A0A3}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\docume~1\alluse~1\dadosd~1\browse~1\22565~1.25\{16cdf~1\browse~1.dll) - c:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager\2.2.565.25\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop Components:0 (Minha página inicial atual) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/20 18:23:55 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/08/20 15:51:22 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Karlla Oliveira\Recent
[2012/08/20 15:45:43 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Karlla Oliveira\Desktop\OTL.exe
[2012/08/19 15:30:38 | 000,000,000 | ---D | C] -- C:\ZHP
[2012/08/19 15:30:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Desktop\ZHPFix
[2012/08/19 15:23:02 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Ad-Remover
[2012/08/18 13:49:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Desktop\Babylones
[2012/08/18 12:00:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
[2012/08/16 16:19:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\Adobe
[2012/08/16 16:19:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Adobe
[2012/08/16 16:19:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Adobe
[2012/08/16 15:31:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Desktop\ICMS-SP
[2012/08/14 16:05:55 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Mozilla Maintenance Service
[2012/08/14 16:05:48 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Mozilla Firefox
[2012/08/14 15:44:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\searchplugins
[2012/08/14 15:44:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Extensions
[2012/08/12 22:38:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\PhotoScape
[2012/08/12 22:38:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Iniciar\Programas\PhotoScape
[2012/08/12 22:37:44 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\PhotoScape
[2012/08/12 22:33:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Start Menu
[2012/08/12 22:33:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager
[2012/08/10 22:04:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karlla Oliveira\Desktop\Nova pasta
[2011/08/09 10:20:34 | 004,380,272 | ---- | C] ([Tens de ter uma conta e sessão iniciada para poderes visualizar este link] ) -- C:\Arquivos de programas\OrbitDownloaderSetup.exe
[2010/09/20 20:58:48 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\pcouffin.sys
[2010/09/20 20:20:30 | 011,898,952 | ---- | C] (Microsoft Corporation) -- C:\Arquivos de programas\mssefullinstall-x86fre-pt-br-xp.exe

========== Files - Modified Within 30 Days ==========

[2012/08/20 15:45:49 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karlla Oliveira\Desktop\OTL.exe
[2012/08/20 15:36:51 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2012/08/20 15:36:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/08/20 13:35:15 | 000,000,902 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/20 12:37:29 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012/08/19 23:49:52 | 000,058,368 | ---- | M] () -- C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/19 15:23:03 | 000,001,626 | ---- | M] () -- C:\Documents and Settings\Karlla Oliveira\Desktop\AD-R.lnk
[2012/08/14 20:15:13 | 000,022,828 | ---- | M] () -- C:\WINDOWS\hpqins15.dat
[2012/08/14 16:05:57 | 000,000,780 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/12 23:00:59 | 000,006,144 | -H-- | M] () -- C:\Documents and Settings\Karlla Oliveira\Desktop\photothumb.db
[2012/08/12 22:38:00 | 000,000,762 | ---- | M] () -- C:\Documents and Settings\Karlla Oliveira\Desktop\PhotoScape.lnk
[2012/08/12 12:43:32 | 000,001,041 | ---- | M] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\vso_ts_preview.xml
[2012/08/09 09:09:04 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

========== Files Created - No Company Name ==========

[2012/08/19 15:23:03 | 000,001,626 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Desktop\AD-R.lnk
[2012/08/14 20:15:10 | 000,022,828 | ---- | C] () -- C:\WINDOWS\hpqins15.dat
[2012/08/14 16:05:57 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Iniciar\Programas\Mozilla Firefox.lnk
[2012/08/14 16:05:57 | 000,000,780 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/12 22:38:57 | 000,006,144 | -H-- | C] () -- C:\Documents and Settings\Karlla Oliveira\Desktop\photothumb.db
[2012/08/12 22:38:00 | 000,000,762 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Desktop\PhotoScape.lnk
[2012/07/07 11:06:06 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\AVEQT.dll
[2012/02/16 08:06:21 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/20 21:31:53 | 000,056,736 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2011/08/24 23:06:05 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2011/08/24 23:05:52 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/08/24 23:05:52 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/08/24 23:05:51 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2011/08/24 23:05:45 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011/06/27 12:03:16 | 000,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\sysqcl1129139270.dat
[2010/12/13 20:29:13 | 000,172,393 | ---- | C] () -- C:\WINDOWS\hphins33.dat
[2010/12/13 20:29:13 | 000,000,512 | ---- | C] () -- C:\WINDOWS\hphmdl33.dat
[2010/11/11 12:15:23 | 000,000,160 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\default.pls
[2010/11/08 22:37:09 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2010/10/27 15:59:02 | 000,000,848 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2010/10/24 22:01:57 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll
[2010/09/21 16:33:24 | 000,039,095 | ---- | C] () -- C:\WINDOWS\Iccsigs.dat
[2010/09/21 16:33:24 | 000,000,156 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2010/09/21 16:32:36 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2010/09/21 16:32:35 | 000,042,483 | ---- | C] () -- C:\WINDOWS\ICCCODES.DAT
[2010/09/21 00:13:20 | 000,058,368 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/20 20:59:23 | 000,001,041 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\vso_ts_preview.xml
[2010/09/20 20:58:48 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\inst.exe
[2010/09/20 20:58:48 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\pcouffin.cat
[2010/09/20 20:58:48 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\pcouffin.inf
[2010/09/20 20:55:36 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010/09/20 20:54:35 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/09/20 20:09:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/09/20 18:44:37 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010/09/20 18:40:07 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2010/09/20 18:38:16 | 000,002,695 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010/09/20 18:38:15 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/09/20 18:26:43 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/09/20 18:20:03 | 000,021,844 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/09/20 15:13:08 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2011/07/18 19:59:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\AVG
[2010/09/27 18:11:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\avg9
[2012/08/12 22:33:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Browser Manager
[2012/03/17 13:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Canneverbe Limited
[2012/05/31 19:42:52 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Common Files
[2010/09/27 23:17:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\DAEMON Tools Lite
[2011/07/17 20:45:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Electronic Arts
[2011/12/08 10:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Lightcomm
[2010/09/21 16:28:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\LogMeIn
[2010/12/04 13:43:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\magicJack
[2012/05/01 14:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\MAGIX
[2011/12/08 10:09:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Oi
[2012/08/19 15:22:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\TEMP
[2010/10/03 22:52:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\vsosdk
[2012/05/01 14:15:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Xara
[2011/08/30 18:50:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/07/18 19:52:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\AVG
[2012/03/17 13:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Canneverbe Limited
[2012/07/21 09:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\DAEMON Tools Lite
[2011/03/12 00:34:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\DVDVideoSoftIEHelpers
[2011/06/18 20:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\GrabPro
[2010/11/28 16:01:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Imagenomic
[2012/05/01 14:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\MAGIX
[2010/11/25 18:47:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mipony
[2012/08/13 09:06:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Orbit
[2012/08/13 21:42:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\PhotoScape
[2010/10/07 10:36:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\ProgSense
[2012/07/26 19:52:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\uTorrent
[2012/08/13 09:27:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Vso
[2012/08/20 15:36:51 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job

========== Purity Check ==========



========== Custom Scans ==========

< < *crack* /s > >

< < *keygen* /s > >

< < *serial* /s > >

< < *AutoKMS* /s > >

< < *loader* /s > >

< %APPDATA%\Local\*. >

< %APPDATA%\*.exe /s >
[2010/09/20 20:58:48 | 000,087,608 | ---- | M] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\inst.exe
[2011/02/09 19:48:07 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe
[2010/09/27 23:46:11 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2010/09/21 16:28:25 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Microsoft\Installer\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}\ARPPRODUCTICON.exe
[2010/09/21 16:28:25 | 000,065,536 | R--- | M] (InstallShield Software Corp.) -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Microsoft\Installer\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe

< %APPDATA%\*. >
[2012/08/18 14:09:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Adobe
[2010/09/29 11:25:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\AdobeUM
[2012/08/11 20:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Ahead
[2012/01/26 19:58:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Apple Computer
[2011/07/18 19:52:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\AVG
[2012/03/17 13:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Canneverbe Limited
[2010/10/27 15:58:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Corel
[2012/07/21 09:18:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\DAEMON Tools Lite
[2011/03/12 00:34:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\DVDVideoSoftIEHelpers
[2011/06/18 20:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\GrabPro
[2010/12/13 20:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\HP
[2012/08/14 16:18:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\HPAppData
[2011/04/07 16:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\HpUpdate
[2010/09/20 18:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Identities
[2010/11/28 16:01:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Imagenomic
[2010/09/20 18:42:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\InstallShield
[2010/09/27 21:06:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Macromedia
[2012/05/01 14:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\MAGIX
[2010/09/20 21:02:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Malwarebytes
[2012/08/20 15:59:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Media Player Classic
[2012/03/17 13:18:42 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Microsoft
[2010/11/25 18:47:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mipony
[2012/08/14 16:06:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Mozilla
[2012/08/13 09:06:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Orbit
[2012/08/13 21:42:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\PhotoScape
[2010/10/07 10:36:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\ProgSense
[2012/03/02 13:09:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Real
[2011/07/18 18:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Sun
[2012/07/26 19:52:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\uTorrent
[2012/08/13 09:27:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\Vso
[2011/07/04 21:23:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karlla Oliveira\Dados de aplicativos\WinRAR

< %USERPROFILE%\AppData\Local\*.* >

< %USERPROFILE%\AppData\Roaming\*.* >

< %systemroot%\assembly\tmp\*.* /S /MD5 >

< %systemroot%\assembly\temp\*.* /S /MD5 >

< %systemroot%\assembly\GAC\*.* /S /MD5 >
[2010/11/05 12:50:45 | 000,053,248 | ---- | M] () MD5=75933586AFD94EA24C5ACD3DBC89A272 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
[2010/11/05 12:50:45 | 000,000,318 | ---- | M] () MD5=DFA7BB6768BB714F62008C14092554F3 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:45 | 000,012,800 | ---- | M] () MD5=C0843F0F45EDEEF233B1E581AE75E3BB -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
[2010/11/05 12:50:45 | 000,000,304 | ---- | M] () MD5=726B1708BD9349091A3FF150E3D0FD67 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:46 | 000,473,600 | ---- | M] () MD5=7AD4D9FABD109432EED91B359CEAE430 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
[2010/11/05 12:50:46 | 000,000,298 | ---- | M] () MD5=724C36E24D542380CDAF8A0AD8CFA249 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:36 | 002,676,224 | ---- | M] () MD5=A73E7421449CCA62B0561BAD4C8EF23D -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:36 | 000,000,300 | ---- | M] () MD5=D65D524325C07733A800ADBFF479BFFC -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:37 | 002,846,720 | ---- | M] () MD5=5E2B8B8A5ED016468716B9FF82A1806F -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:38 | 000,000,300 | ---- | M] () MD5=86A8EAA36B8EE5D312DBA9EDBD336BBA -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:38 | 000,563,712 | ---- | M] () MD5=D3F1922325BE8E7E1C72BFD8179454CE -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:38 | 000,000,300 | ---- | M] () MD5=5B7A763773459C332CDBA8B2FDD02960 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:39 | 000,567,296 | ---- | M] () MD5=FB3BC0754921873A65F5FBDCA845E6EE -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:39 | 000,000,300 | ---- | M] () MD5=FCD3B534FED67607D4CB1C6CE2D35894 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:40 | 000,576,000 | ---- | M] () MD5=AFCF5F50C632F3A5598ABC28F196D77C -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:40 | 000,000,300 | ---- | M] () MD5=9B9144CB6A871C1CC717E1AB55DC6B49 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:40 | 000,577,024 | ---- | M] () MD5=CCD53738DF4FA27849B6BB05DD67D10D -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:41 | 000,000,300 | ---- | M] () MD5=3C5DB34958BB2FD08B36CAB10D05CD18 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:41 | 000,577,536 | ---- | M] () MD5=43C280C3B15CEB2472AB560D09629664 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:41 | 000,000,300 | ---- | M] () MD5=E5E2E822F345AFE0A1E6B3DECF53517F -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:42 | 000,577,536 | ---- | M] () MD5=490807C150B7D8BE44BDE871F4DF8C56 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:42 | 000,000,300 | ---- | M] () MD5=FED4D363D778DB202C775D336AFEE692 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:42 | 000,578,560 | ---- | M] () MD5=933085360527DE1B4947289CA468184E -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:42 | 000,000,300 | ---- | M] () MD5=C05A12FCEC9EAE6A3D28A750ADA535B6 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:46 | 000,578,560 | ---- | M] () MD5=25C76C1E29D3E8E7398F0901F558A629 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
[2010/11/05 12:50:47 | 000,000,300 | ---- | M] () MD5=4F5BAD33BB38AB0732E6E5E54840CB3D -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:47 | 000,145,920 | ---- | M] () MD5=D9824A9DD107E598575112B4FF897292 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
[2010/11/05 12:50:47 | 000,000,302 | ---- | M] () MD5=82E3D22A641B0033DDEAD41FFCED2294 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:47 | 000,159,232 | ---- | M] () MD5=CEBD995DDEAB2C525A5C4E95789BC961 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
[2010/11/05 12:50:47 | 000,000,304 | ---- | M] () MD5=7BF4EB25C037C141E235AE0565C918F3 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:48 | 000,364,544 | ---- | M] () MD5=46F26E2BAFD44960E7F13B2EF80AA0BC -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
[2010/11/05 12:50:48 | 000,000,302 | ---- | M] () MD5=E4B8159C029D285C87B03B98475FD6A1 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:48 | 000,178,176 | ---- | M] () MD5=D035348EC8968861AF585B7132FE4C7B -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
[2010/11/05 12:50:48 | 000,000,304 | ---- | M] () MD5=CDE90172766613FD7A77AF6CCE265510 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini
[2010/11/05 12:50:44 | 000,223,232 | ---- | M] () MD5=0C453970E89DB1C1EB9DE087E6EAB5BA -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
[2010/11/05 12:50:44 | 000,000,280 | ---- | M] () MD5=DC9FDB9C8DF3F598582F30F31C692A38 -- C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\__AssemblyInfo__.ini

< %systemroot%\assembly\GAC_32\*.* /S /MD5 >
[2012/06/14 00:39:28 | 000,069,120 | ---- | M] () MD5=DC426A365577F27187F99EB506ECD5D1 -- C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
[2012/06/14 00:39:33 | 000,072,192 | ---- | M] () MD5=29B35A999E341A37BE67771BE01CC275 -- C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
[2010/09/30 16:46:42 | 000,163,840 | ---- | M] () MD5=36BDD82A92AA704034475C2DEF7FBD29 -- C:\WINDOWS\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
[2012/06/14 00:39:41 | 000,066,728 | ---- | M] () MD5=C01B81BB10AD14DBC5C4ECD350638096 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp
[2012/06/14 00:39:41 | 000,082,172 | ---- | M] () MD5=EE1F60F8774D74BED8B13498F3FE737A -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp
[2012/06/14 00:39:41 | 000,116,756 | ---- | M] () MD5=F6DFDA5A31162D848634504565F6D321 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp
[2012/06/14 00:39:41 | 004,550,656 | ---- | M] () MD5=3BDAE07DA44654FA393A2A2BA242EA41 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
[2012/06/14 00:39:41 | 000,059,342 | ---- | M] () MD5=DA5748A89E22A3932387E65694B25BBB -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp
[2012/06/14 00:39:41 | 000,045,794 | ---- | M] () MD5=3831A5E217D6FA828CCE1011DA26E677 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp
[2012/06/14 00:39:41 | 000,039,284 | ---- | M] () MD5=DBDE664E0BA4BACD0A6A04AE2232B205 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp
[2012/06/14 00:39:41 | 000,066,384 | ---- | M] () MD5=C9B88B759FE81D59CE8EBF5A0A8EB75A -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp
[2012/06/14 00:39:41 | 000,060,294 | ---- | M] () MD5=3CAB6AB66759FCDF73B61EE262C9ACF4 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp
[2012/06/14 00:39:41 | 000,083,748 | ---- | M] () MD5=54144F43EDF5AA8F504A30E7C1D1A7B5 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp
[2012/06/14 00:39:41 | 000,083,748 | ---- | M] () MD5=901863C68E6523336CAC602FE9320ABC -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp
[2012/06/14 00:39:41 | 000,262,148 | ---- | M] () MD5=FB59D247F7143C3B9683A547E808A88B -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
[2012/06/14 00:39:41 | 000,020,320 | ---- | M] () MD5=FF13BA175F0013D2311827E0D438C60B -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
[2012/06/14 00:39:41 | 000,028,288 | ---- | M] () MD5=09E420F90A329BDA68477FA4AF43CB28 -- C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp
[2012/05/11 23:25:09 | 004,214,784 | ---- | M] () MD5=E0EB0BDC866E2C0CC792B83BD2422501 -- C:\WINDOWS\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
[2012/06/14 00:39:43 | 000,486,400 | ---- | M] () MD5=759FD3779911F89C450CCAE06B92AE3A -- C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
[2012/06/14 00:39:44 | 002,933,248 | ---- | M] () MD5=16F96C1496CBD0965285AB19A9271D02 -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
[2012/06/14 00:39:36 | 000,258,048 | ---- | M] () MD5=9631B15DB7C43C267636FF43C3075E07 -- C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
[2012/06/14 00:39:36 | 000,113,664 | ---- | M] () MD5=E786C33D35D39C5CCB523AECC18D7BD7 -- C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
[2012/05/11 23:25:12 | 000,368,640 | ---- | M] () MD5=E915933B0E68B61A6AC22E06BD1AD651 -- C:\WINDOWS\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
[2012/06/14 00:39:35 | 000,261,632 | ---- | M] () MD5=F054572A92573CA32D5F3AA8C15D2BAC -- C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
[2012/06/14 00:39:22 | 005,246,976 | ---- | M] () MD5=661268A6BEEF1C1B0D1B9137F530A9FD -- C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll

< %systemroot%\system32\config\systemprofile\AppData\Local\*.* >

< %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.* >

< %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes >
"DefaultScope" = {006ee092-9658-4fd6-bd8e-a21a348e59f5}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

< HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes >
"DefaultScope" = ${searchCLSID}
"DownloadRetries" = 0
"DownloadUpdates" = 0
"Version" = 2
"UpgradeTime" = 3C AB 59 F4 A2 45 CC 01 [binary data]
"BrowserMngrDefaultScope" = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\${searchCLSID}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3961E45A-FFCD-4B49-8814-587C44D61FD2}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}]

< MD5 for: CSRSS.EXE >
[2008/04/13 19:20:54 | 000,006,144 | ---- | M] (Microsoft Corporation) MD5=CDACC26997A7A38F7806697FDCE8D83D -- C:\WINDOWS\system32\csrss.exe
[2008/04/13 19:20:54 | 000,006,144 | ---- | M] (Microsoft Corporation) MD5=CDACC26997A7A38F7806697FDCE8D83D -- C:\WINDOWS\system32\dllcache\csrss.exe

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:21:00 | 001,035,776 | ---- | M] (Microsoft Corporation) MD5=064EC7FF5F58B928C3E119402977FA6D -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 19:21:00 | 001,035,776 | ---- | M] (Microsoft Corporation) MD5=064EC7FF5F58B928C3E119402977FA6D -- C:\WINDOWS\explorer.exe
[2008/04/13 19:21:00 | 001,035,776 | ---- | M] (Microsoft Corporation) MD5=064EC7FF5F58B928C3E119402977FA6D -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/02/09 08:17:04 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=38867483E0CB504BB8F277E05729881E -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2009/02/09 08:25:05 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=C52DEB6D8CD4B096BF1A9EC001F36507 -- C:\WINDOWS\ERDNT\cache\services.exe
[2009/02/09 08:25:05 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=C52DEB6D8CD4B096BF1A9EC001F36507 -- C:\WINDOWS\system32\dllcache\services.exe
[2009/02/09 08:25:05 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=C52DEB6D8CD4B096BF1A9EC001F36507 -- C:\WINDOWS\system32\services.exe

< MD5 for: SMSS.EXE >
[2008/04/13 19:21:20 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=DEEA6E1DBF7B2576A967D778C47A5DED -- C:\WINDOWS\system32\dllcache\smss.exe
[2008/04/13 19:21:20 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=DEEA6E1DBF7B2576A967D778C47A5DED -- C:\WINDOWS\system32\smss.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 19:21:22 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=ED2D69CD4B0EBE37EFE11D4DC4ABC68F -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 19:21:22 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=ED2D69CD4B0EBE37EFE11D4DC4ABC68F -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/13 19:21:22 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=ED2D69CD4B0EBE37EFE11D4DC4ABC68F -- C:\WINDOWS\system32\svchost.exe

< MD5 for: UNINST.EXE >
[2012/06/22 16:30:16 | 000,133,864 | ---- | M] (Piriform Ltd) MD5=BFB89A012A5598EEB1E1A7141EC49661 -- C:\Arquivos de programas\CCleaner\uninst.exe
[2010/04/01 06:18:04 | 000,662,576 | ---- | M] (DT Soft Ltd.) MD5=D83A00107189D12A1827BB32886CCBEF -- C:\Arquivos de programas\DAEMON Tools Lite\uninst.exe

< MD5 for: USERINIT.EXE >
[2008/04/13 19:21:22 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A7EA40F680163808D96F89B4FF991876 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 19:21:22 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A7EA40F680163808D96F89B4FF991876 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/13 19:21:22 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A7EA40F680163808D96F89B4FF991876 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/13 19:21:24 | 000,509,952 | ---- | M] (Microsoft Corporation) MD5=71D440F79B711627B12B567FB2EADB42 -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 19:21:24 | 000,509,952 | ---- | M] (Microsoft Corporation) MD5=71D440F79B711627B12B567FB2EADB42 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/13 19:21:24 | 000,509,952 | ---- | M] (Microsoft Corporation) MD5=71D440F79B711627B12B567FB2EADB42 -- C:\WINDOWS\system32\winlogon.exe

< regedit /e c:\registrybackup.reg /c >

< type c:\boot.ini >> test.txt /c >
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

< %systemroot%\system32\Tasks\*.* /s >

< %windir%\tasks\*.* /s >
[2012/08/20 13:35:15 | 000,000,902 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/09 09:09:04 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2001/10/28 12:07:04 | 000,000,065 | RH-- | M] () -- C:\WINDOWS\tasks\desktop.ini
[2012/08/20 15:36:51 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2012/08/20 15:36:48 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

========== Alternate Data Streams ==========

@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:0B4227B4
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:5C321E34

< End of report >

Boa Tarde! Diva.pop.s

|- Execute o OTL.exe.
|- Copie estas informações que estão em vermelho,para o campo clipboard da ferramenta. ( "Exames Personalizados Correções" )

:OTL
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
IE - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=113480&tt=120812_bandext_3212_4&babsrc=HP_ss&mntrId=d4ae1e7900000000000090e6ba091a7a"
FF - user.js - File not found
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKU\S-1-5-21-329068152-2111687655-299502267-1003\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O8 - Extra context menu item: &Download All using 4shared Desktop - C:\Arquivos de programas\4shared Desktop\down_all.htm File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (Reg Error: Key error.)
[2012/08/19 23:49:52 | 000,058,368 | ---- | M] () -- C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:0B4227B4
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:5C321E34

:Files
Type C:\Documents and Settings\All Users\Dados de aplicativos\{429CAD59-35B1-4DBC-BB6D-1DB246563521} /C
C:\user.js

:reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}]
[-HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr.1]
[-HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr.1\CLSID]
[-HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr\CurVer]
[-HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr\CLSID]
[-HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

:Commands
[CREATERESTOREPOINT]
[purity]
[emptytemp]
[Reboot]

|- Clique no botão Consertar >> Aguarde a conclusão!
|- O computador vai reiniciar! >> Clique em "Executar".

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Para versões em Inglês,clique em Run Fix que é o mesmo que Consertar.
|- Poste o relatório: C:\_OTL\MovedFiles\*.log

Abs!

All processes killed
========== OTL ==========
HKU\S-1-5-21-329068152-2111687655-299502267-1003\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
HKEY_USERS\S-1-5-21-329068152-2111687655-299502267-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Prefs.js: "Search the web (Babylon)" removed from browser.search.defaultenginename
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "Search the web (Babylon)" removed from browser.search.selectedEngine
Prefs.js: "http://search.babylon.com/?affID=113480&tt=120812_bandext_3212_4&babsrc=HP_ss&mntrId=d4ae1e7900000000000090e6ba091a7a" removed from browser.startup.homepage
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.
Registry value HKEY_USERS\S-1-5-21-329068152-2111687655-299502267-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Download All using 4shared Desktop\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\Documents and Settings\Karlla Oliveira\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
ADS C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:0B4227B4 deleted successfully.
ADS C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:5C321E34 deleted successfully.
========== FILES ==========
< Type C:\Documents and Settings\All Users\Dados de aplicativos\{429CAD59-35B1-4DBC-BB6D-1DB246563521} /C >
C:\Documents and Settings\Karlla Oliveira\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Karlla Oliveira\Desktop\cmd.txt deleted successfully.
File\Folder C:\user.js not found.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}\ not found.
Registry key HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr.1 not found.
Registry key HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr.1\CLSID\ not found.
Registry key HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr\CurVer\ not found.
Registry key HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr\CLSID\ not found.
Registry key HKEY_CLASSES_ROOT\bbylntlbr.bbylntlbrHlpr not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Karlla Oliveira
->Temp folder emptied: 26058 bytes
->Temporary Internet Files folder emptied: 65938 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 64272869 bytes
->Flash cache emptied: 861 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 61464 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 81344 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 62,00 mb


OTL by OldTimer - Version 3.2.58.1 log created on 08202012_193524

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.

Boa Noite! Diva.pop.s

|- Caso tenha,ainda,cookies armazenados do Babylon,pode excluí-los.

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

|- Ps: Expanda Babylon.com,para ter acesso aos cookies,caso exista.

-/-

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... de C_XX )
|- Descompacte-o para o desktop!
|- Para Windows Vista ou 7,dê clique direito em SEAF.exe e execute-o como administrador.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Siga a sequência numérica,em seus procedimentos:

|- < 1 > Neste campo,cole a(s) ocorrência(s)...no caso: babylon
|- < 2 > Em "Calculer le checksum",escolha "MD5".
|- < 3 > Em "[ Options du registre ]",marque: "Chercher également dans le registre"
|- < 4 > Clique em "Lancer la recherche" |-- Aguarde!

|- Ps: Na mensagem,clique em "Non".
|- Ao concluir,teremos o relatório: C:\SeafLog.txt <-- Poste-o!

Abs!

1. ========================= SEAF 1.0.1.0 - C_XX
2.
3. Commencé à: 20:55:42 le 20/08/2012
4.
5. Valeur(s) recherchée(s):
6. babylon
7.
8. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès
9.
10. (!) --- Calcul du Hash "MD5"
11. (!) --- Recherche registre
12.
13. ====== Fichier(s) ======
14.
15.
16. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar.zip" [ ARCHIVE | 805 o ]
17. TC: 18/08/2012,12:50:23 | TM: 18/08/2012,12:50:23 | DA: 18/08/2012,12:50:23
18.
19. Hash MD5: B863861A2A3D59D771263A22D524A374
20.
21.
22. =========================
23.
24.
25. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar1.zip" [ ARCHIVE | 785 o ]
26. TC: 18/08/2012,12:50:23 | TM: 18/08/2012,12:50:23 | DA: 18/08/2012,12:50:23
27.
28. Hash MD5: E8D7546EAC548C761357123025FC4F94
29.
30.
31. =========================
32.
33.
34. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip" [ ARCHIVE | 738 o ]
35. TC: 18/08/2012,12:50:23 | TM: 18/08/2012,12:50:23 | DA: 18/08/2012,12:50:23
36.
37. Hash MD5: 1CCBAD2102265F0E549A7EF9DF00055B
38.
39.
40. =========================
41.
42.
43. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar3.zip" [ ARCHIVE | 671 o ]
44. TC: 18/08/2012,12:50:23 | TM: 18/08/2012,12:50:23 | DA: 18/08/2012,12:50:23
45.
46. Hash MD5: E0162B8702B16D3FC3C83AF8B661EFEA
47.
48.
49. =========================
50.
51.
52. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar4.zip" [ ARCHIVE | 805 o ]
53. TC: 18/08/2012,13:46:30 | TM: 18/08/2012,13:46:30 | DA: 18/08/2012,13:46:30
54.
55. Hash MD5: AFDB70C79B1C23D94D7F591F2163A51B
56.
57.
58. =========================
59.
60.
61. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar5.zip" [ ARCHIVE | 785 o ]
62. TC: 18/08/2012,13:46:30 | TM: 18/08/2012,13:46:30 | DA: 18/08/2012,13:46:30
63.
64. Hash MD5: B3422A3C7ECD482562A7901903B863CF
65.
66.
67. =========================
68.
69.
70. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar6.zip" [ ARCHIVE | 738 o ]
71. TC: 18/08/2012,13:46:30 | TM: 18/08/2012,13:46:30 | DA: 18/08/2012,13:46:30
72.
73. Hash MD5: 8F1E5AD808BAA8127863EDB5938BE900
74.
75.
76. =========================
77.
78.
79. "C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar7.zip" [ ARCHIVE | 671 o ]
80. TC: 18/08/2012,13:46:30 | TM: 18/08/2012,13:46:30 | DA: 18/08/2012,13:46:30
81.
82. Hash MD5: 7456438C94EB8A5A98FCA29873BDC73F
83.
84.
85. =========================
86.
87.
88. "C:\Documents and Settings\Karlla Oliveira\Desktop\Babylones\babylon_spybot.jpg" [ ARCHIVE | 96 Ko ]
89. TC: 18/08/2012,13:46:20 | TM: 18/08/2012,13:46:21 | DA: 18/08/2012,13:46:21
90.
91. Hash MD5: 04B72630F2354D8EA87D3A280FBA5B1E
92.
93.
94. =========================
95.
96.
97. "C:\Documents and Settings\Karlla Oliveira\Favoritos\Home Inicial Babylon Search - Forum do BABOO.url" [ ARCHIVE | 1 Ko ]
98. TC: 14/08/2012,15:40:57 | TM: 14/08/2012,15:40:57 | DA: 19/08/2012,21:28:49
99.
100. Hash MD5: AD94C679239F905F8121F83A2FC8AA79
101.
102.
103. =========================
104.
105.
106. "D:\Karlla\Vídeos\Babylon.txt" [ COMPRESSED|ARCHIVE | 1 Ko ]
107. TC: 13/08/2012,16:42:25 | TM: 13/08/2012,16:42:25 | DA: 14/08/2012,23:23:23
108.
109. Hash MD5: 100224239BFD6DCBBF930A4F09AF8923
110.
111.
112. =========================
113.
114.
115. "D:\Karlla\Vídeos\Removendo Aba Babylon Search - Firefox.3gp" [ COMPRESSED|ARCHIVE | 324 Ko ]
116. TC: 13/08/2012,12:48:20 | TM: 13/08/2012,12:48:27 | DA: 13/08/2012,12:50:54
117.
118. Hash MD5: CCA8544592B2B921CC323E7FC42E2630
119.
120.
121. =========================
122.
123.
124. "D:\Karlla\Vídeos\Removendo Aba Babylon Search - Firefox.txt" [ COMPRESSED|ARCHIVE | 49 o ]
125. TC: 13/08/2012,12:50:51 | TM: 13/08/2012,12:50:51 | DA: 13/08/2012,15:27:21
126.
127. Hash MD5: EB10FE605E747917D9B4416B89D738DC
128.
129.
130. =========================
131.
132.
133.
134. ====== Entrée(s) du registre ======
135.
136.
137. [HKLM\Software\BrowserMngr]
138. "SEREGEXP"="^http://.*(babylon\.com)/\?(affID=|).*" (REG_SZ)
139.
140. [HKLM\Software\Microsoft\Internet Explorer\Toolbar]
141. "{D0F4A166-B8D4-48b8-9D63-80849FE137CB}"="Babylon Toolbar" (REG_SZ)
142.
143. [HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar]
144. DA: 18/08/2012 11:20:56
145.
146. [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]
147. ""="Babylon toolbar helper" (REG_SZ)
148.
149. [HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\BrowserMngr]
150. "SEREGEXP"="^http://.*(babylon\.com)/\?(affID=|).*" (REG_SZ)
151.
152. [HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\BrowserMngr\2.2.565.25]
153. "firefox keywords"="http://isearch.avg.com/search?cid=%7Be0229eeb-13b8-4ba9-be3f-cda36fea9b98%7D&mid=20859d4c9d7047d0a3c9511f09db2a5a-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=yu012&v=11.1.0.7&lang=en&pr=sa&d=2012-05-31%2019%3A44%3A12&sap=ku&q=
154. [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (REG_MULTI_SZ)
155.
156. =========================
157.
158. Fin à: 21:02:13 le 20/08/2012
159. 245369 Éléments analysés
160.
161. =========================
162. E.O.F

Boa Noite! Diva.pop.s

|- Abra a ferramenta OTL.

:reg
[HKLM\Software\BrowserMngr]
"SEREGEXP"=""
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]
"{D0F4A166-B8D4-48b8-9D63-80849FE137CB}"=-
[-HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar]
[-HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]
[HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\BrowserMngr]
"SEREGEXP"=""
[HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\BrowserMngr\2.2.565.25]
"firefox keywords"=""

:files
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar1.zip
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar3.zip
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar4.zip
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar5.zip
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar6.zip
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar7.zip

:commands
[reboot]

|- Copie e cole estas informações,que estão em vermelho,para o campo: Exames personalizados/correções
|- Clique em Consertar.
|- Poste o relatório!

Abs!

========== REGISTRY ==========
HKLM\Software\BrowserMngr\\"SEREGEXP"|"" /E : value set successfully!
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BabylonToolbar\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\BrowserMngr\\"SEREGEXP"|"" /E : value set successfully!
HKU\S-1-5-21-329068152-2111687655-299502267-1003\Software\BrowserMngr\2.2.565.25\\"firefox keywords"|"" /E : value set successfully!
========== FILES ==========
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar1.zip moved successfully.
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip moved successfully.
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar3.zip moved successfully.
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar4.zip moved successfully.
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar5.zip moved successfully.
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar6.zip moved successfully.
C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy\Recovery\BabylonToolbar7.zip moved successfully.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.58.1 log created on 08202012_215857

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.

Boa Noite! Diva.pop.s

|- Caso esteja tudo Ok,apague seus Pontos de restauração.
|- Babylon,ainda,lhe incomoda?

:COMMANDS
[CLEARALLRESTOREPOINTS]
[reboot]

|- Rode este script.
|- Cole as informações que estão no Código,para o campo "Exames Personalizados Correções".
|- Clique em Consertar.
|- Ps: Haverá reboot! <- Aguarde!
|- Abra,novamente,a ferramenta OTL -> Clique em Limpeza. <- Confirme!
|- O computador irá reiniciar!
|- Seus logs estão limpos!

Abs!

Por incrivel que pareça ela continua abrindo como pg inicial...mesmo que eu vá em FERRAMENTAS>>OPÇÕES>>>GERAL>>e mude o link da pg incial p/ qlqr outro site ou mesmo o padrão do firefox, qnd eu incio o mesmo..o babylon search abre como incial...

Diva.pop.s escreveu:Por incrivel que pareça ela continua abrindo como pg inicial...mesmo que eu vá em FERRAMENTAS>>OPÇÕES>>>GERAL>>e mude o link da pg incial p/ qlqr outro site ou mesmo o padrão do firefox, qnd eu incio o mesmo..o babylon search abre como incial...

Boa Noite! Diva.pop.s

|- Desinstale o Firefox,completamente,com o RevoUninstaller.
|- Apague sua pasta.
|- Instale,novamente,o Firefox e configure sua página inicial.
|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >
|- Salve-o no desktop.
|- Instale o utilitário e verifique se na tela principal aparece o programa a ser desinstalado.
|- No seu caso,o Mozilla Firefox.
|- Selecione-o e clique em Desinstalar.
|- Para maiores detalhes,leia o < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >
|- Caso não funcione,desinstale o Firefox e instale,novamente,o tradutor Babylon.
|- À seguir,desinstale-o com o RevoUninstaller e volte a instalar o Firefox.
|- Utilize a desinstalação avançada e opte por limpeza completa,nas entradas ao registro.
|- Ainda estou por aqui,somente vou... [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

Abs!

rsrs..gostei do bonequinho comendo pipoca..rs.

Olha, mas que luta hein? Fiz a primeira parte do procedimento: desinstalei e instalei o Firefox...nada mudou..tudo na mesma..

Agora vc disse p/ desinstalar de novo o Firefox, e sem ele no PC, é p/ eu instalar o Tradutor Babylon?


É que ´so quero confirmar essa parte que eu me confundi...

Esse tradutor Babylon é qlqr um que eu achar no google? Sim, pois..o babylon foi instalado no meu PC junto com o editor de fotos PhotoScape que baixei no site Baixaki.com.br..Não sei onde encontrar esse tradutor...

Diva.pop.s escreveu:rsrs..gostei do bonequinho comendo pipoca..rs.
Agora vc disse p/ desinstalar de novo o Firefox, e sem ele no PC, é p/ eu instalar o Tradutor Babylon?

|- Sim! Interpretou corretamente!

Diva.pop.s escreveu:Esse tradutor Babylon é qlqr um que eu achar no google? Sim, pois..o babylon foi instalado no meu PC junto com o editor de fotos PhotoScape que baixei no site Baixaki.com.br..Não sei onde encontrar esse tradutor...

|- No baixaki tem: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Somente para constar. Mas...vc lembrou de executaresta parte?

Abs!