************************************************************************************ ISeeYouXP v2.0 Beta 14 ISeeYouXP v1.3.0-v2.0 Beta 14 Copyright - ShadowPuterDude ISeeYouXP v1.2.9 and earlier Copyright - PhilliePhan ------------------------------------------------------------------------------------ **** PLEASE NOTE THAT MOST (if not ALL) OF THE ITEMS BELOW ARE NOT BADDIES! **** **** PLEASE CONSULT A KNOWLEDGEABLE PERSON BEFORE TAKING ANY ACTION. **** ************************************************************************************ Windows/Browser/Java Versions: Microsoft (R) Windows Script Host Verso 5.7 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Microsoft Windows XP Professional Version: 5.1.2600 Service Pack: 3.0 Windows Directory: C:\WINDOWS Microsoft (R) Windows Script Host Verso 5.7 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Internet Explorer Version: 8.0.6001.18241 Build: 86001 Language: Ingls (Estados Unidos) Path: C:\Arquivos de programas\Internet Explorer Sun Microsystems Java Runtime Version: 1.6.0_07 Microsoft (R) Windows Script Host Verso 5.7 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Boot State: Normal boot Scan done at 21:23:55,00, ter 18/11/2008 ------------------------------------------------------------------------------------ ISeeYouXP installation folder and files "C:\ISeeYouXP\" bootst~1.vbs 28 May 2007 359 "bootstate.vbs" change.log 8 Jun 2008 5012 "change.log" chodefix.bat 18 Apr 2007 5387 "chodefix.bat" fixchode.reg 18 Apr 2007 528 "fixChode.reg" fixexp~1.bat 24 Feb 2007 487 "FixExplorerPolicies.bat" getunk~1.bat 12 Aug 2006 1478 "GetUnKeys.bat" grep.exe 24 Dec 2004 160768 "grep.exe" hideit.bat 17 Oct 2007 1072 "HideIT.bat" ieinfo.vbs 28 May 2007 514 "ieinfo.vbs" iesecu~1.bat 28 Oct 2007 72 "IESecurityZones.bat" iesecu~1.vbs 8 Nov 2007 2399 "IESecurityZones.vbs" iseeyo~1.bat 8 Jun 2008 211377 "ISeeYouXP.bat" libico~1.dll 16 Mar 2004 898048 "libiconv2.dll" libintl3.dll 9 Oct 2004 101888 "libintl3.dll" locate.com 14 Jan 2005 11254 "locate.com" md5sum.exe 5 Aug 2007 49152 "md5sum.exe" msconf~1.bat 24 Feb 2007 578 "MSConfigFix.bat" osinfo.vbs 28 May 2007 598 "osinfo.vbs" pcbutts.txt 25 Mar 2007 5167 "PCBUTTS.TXT" pcre.dll 14 Nov 2004 183313 "pcre.dll" pv.exe 3 Mar 2006 73728 "pv.exe" regedi~1.bat 30 Mar 2007 650 "RegEditFix.bat" regfix.bat 18 Apr 2007 145 "Regfix.bat" servic~1.vbs 28 May 2007 672 "servicesinfo.vbs" showit.bat 17 Oct 2007 1013 "ShowIT.bat" swreg.exe 5 Apr 2007 139776 "swreg.exe" system~1.bat 28 Feb 2007 369 "SystemRestoreFix.bat" taskmg~1.bat 24 Feb 2007 288 "TaskMgrFix.bat" 28 items found: 28 files, 0 directories. Total of file sizes: 1.856.092 bytes 1,77 M ------------------------------------------------------------------------------------ System Environment Variables ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Administrador\Dados de aplicativos CLASSPATH=.;C:\Arquivos de programas\Java\jre1.6.0_07\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Arquivos de programas\Arquivos comuns COMPUTERNAME=USER-50EB219765 ComSpec=C:\WINDOWS\system32\cmd.exe errcode=0 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Administrador LOGONSERVER=\\USER-50EB219765 NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Arquivos de programas\Smart Projects\IsoBuster;C:\Arquivos de programas\QuickTime\QTSystem;C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 107 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=6b02 ProgramFiles=C:\Arquivos de programas PROMPT=$P$G QTJAVA=C:\Arquivos de programas\Java\jre1.6.0_07\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp TMP=C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp USERDOMAIN=USER-50EB219765 USERNAME=Administrador USERPROFILE=C:\Documents and Settings\Administrador windir=C:\WINDOWS __COMPAT_LAYER=EnableNXShowUI ------------------------------------------------------------------------------------ Showing any Pocket Killbox backup files No matches found. ------------------------------------------------------------------------------------ Displaying BOOT.INI: [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer ------------------------------------------------------------------------------------ Displaying SYSTEM.INI: ; for 16-bit app support [drivers] wave=mmdrv.dll timer=timer.drv [mci] [driver32] [386enh] woafont=app850.FON EGA80WOA.FON=EGA80850.FON EGA40WOA.FON=EGA40850.FON CGA80WOA.FON=CGA80850.FON CGA40WOA.FON=CGA40850.FON [TTFontDimenCacheDBCS] 0 4=2 4 0 5=3 5 0 6=4 6 0 7=4 7 0 8=5 8 0 9=5 9 0 10=6 10 0 11=7 11 0 12=7 12 0 13=8 13 0 14=8 14 0 15=9 15 0 16=10 16 0 18=11 18 0 20=12 20 0 22=13 22 ------------------------------------------------------------------------------------ Displaying WIN.INI: ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 CMCDLLNAME32=mapi32.dll CMCDLLNAME=mapi.dll CMC=1 MAPIX=1 MAPIXVER=1.0.0.1 OLEMessaging=1 [MCI Extensions.BAK] aif=MPEGVideo aifc=MPEGVideo aiff=MPEGVideo asf=MPEGVideo asx=MPEGVideo au=MPEGVideo m1v=MPEGVideo m3u=MPEGVideo mp2=MPEGVideo mp2v=MPEGVideo mp3=MPEGVideo mpa=MPEGVideo mpe=MPEGVideo mpeg=MPEGVideo mpg=MPEGVideo mpv2=MPEGVideo snd=MPEGVideo wax=MPEGVideo wm=MPEGVideo wma=MPEGVideo wmv=MPEGVideo wmx=MPEGVideo wpl=MPEGVideo wvx=MPEGVideo m2v=MPEGVideo mod=MPEGVideo [PARID] ComputerID={80AA8071-9770-4E2E-9801-E6B53A3E252E} ------------------------------------------------------------------------------------ Displaying AUTOEXEC.BAT: ------------------------------------------------------------------------------------ Displaying CONFIG.SYS: ------------------------------------------------------------------------------------ Displaying Running Processes: PROCESS PID PRIO PATH smss.exe 1320 Normal C:\WINDOWS\System32\smss.exe csrss.exe 1368 Normal C:\WINDOWS\system32\csrss.exe winlogon.exe 1392 High C:\WINDOWS\system32\winlogon.exe services.exe 1436 Normal C:\WINDOWS\system32\services.exe lsass.exe 1452 Normal C:\WINDOWS\system32\lsass.exe svchost.exe 1620 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 1676 Normal C:\WINDOWS\system32\svchost.exe svchost.exe 1828 Normal C:\WINDOWS\System32\svchost.exe svchost.exe 2028 Normal C:\WINDOWS\system32\svchost.exe spoolsv.exe 280 Normal C:\WINDOWS\system32\spoolsv.exe Explorer.EXE 644 Normal C:\WINDOWS\Explorer.EXE jusched.exe 904 Normal C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe RTHDCPL.EXE 920 Normal C:\WINDOWS\RTHDCPL.EXE realsched.exe 960 Normal C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe iTunesHelper.exe 996 Normal C:\Arquivos de programas\iTunes\iTunesHelper.exe RUNDLL32.EXE 1024 Normal C:\WINDOWS\system32\RUNDLL32.EXE avp.exe 1048 Normal C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe pctsTray.exe 1056 Normal C:\Arquivos de programas\Spyware Doctor\pctsTray.exe ctfmon.exe 1084 Normal C:\WINDOWS\system32\ctfmon.exe msmsgs.exe 1108 Normal C:\Arquivos de programas\Messenger\msmsgs.exe a2service.exe 1944 Normal C:\Arquivos de programas\a-squared Free\a2service.exe AppleMobileDeviceService.exe 440 Normal C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe guard.exe 532 Normal C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe avp.exe 588 Normal C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe mDNSResponder.exe 720 Normal C:\Arquivos de programas\Bonjour\mDNSResponder.exe nvsvc32.exe 952 Normal C:\WINDOWS\system32\nvsvc32.exe pctsAuxs.exe 432 Normal C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe pctsSvc.exe 1348 Normal C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe StarWindServiceAE.exe 2156 Normal C:\Arquivos de programas\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe svchost.exe 2212 Normal C:\WINDOWS\system32\svchost.exe SearchIndexer.exe 2296 Normal C:\WINDOWS\system32\SearchIndexer.exe firefox.exe 2556 Normal C:\Arquivos de programas\Mozilla Firefox\firefox.exe iPodService.exe 2784 Normal C:\Arquivos de programas\iPod\bin\iPodService.exe TFService.exe 3184 Normal C:\Arquivos de programas\Spyware Doctor\TFEngine\TFService.exe alg.exe 3576 Normal C:\WINDOWS\System32\alg.exe emule.exe 3008 Normal C:\Arquivos de programas\eMule\emule.exe SearchProtocolHost.exe 1252 Below Normal C:\WINDOWS\system32\SearchProtocolHost.exe SearchFilterHost.exe 2732 Below Normal C:\WINDOWS\system32\SearchFilterHost.exe cmd.exe 3084 Normal C:\WINDOWS\system32\cmd.exe ntvdm.exe 3928 Normal C:\WINDOWS\system32\ntvdm.exe wmiprvse.exe 2716 Normal C:\WINDOWS\system32\wbem\wmiprvse.exe pv.exe 3704 Normal C:\ISEEYO~1\pv.exe ------------------------------------------------------------------------------------ Displaying Windows Services: Microsoft (R) Windows Script Host Verso 5.7 Copyright (C) 1996-2001 Microsoft Corporation. Todos os direitos reservados. Name: a2free Display Name: a-squared Free Service Description: Scans the PC for unwanted software and provides protection from malicious code Path Name: "C:\Arquivos de programas\a-squared Free\a2service.exe" Start Mode: Auto State: Running Name: acssrv Display Name: Agnitum Client Security Service Description: Agnitum Client Security Service Path Name: C:\ARQUIV~1\Agnitum\Outpost Firewall Pro\acs.exe Start Mode: Auto State: Running Name: Alerter Display Name: Alerta Description: Notifica os usurios e computadores selecionados de alertas administrativos. Se o servio for interrompido, os programas que usam alertas administrativos no os recebero. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: ALG Display Name: Servio 'Gateway de camada de aplicativo' Description: Fornece suporte a plug-ins de protocolos de terceiros para o Compartilhamento de Conexo com a Internet e o Firewall do Windows. Path Name: C:\WINDOWS\System32\alg.exe Start Mode: Manual State: Running Name: Apple Mobile Device Display Name: Dispositivo Celular da Apple Description: Fornece a interface a dispositivos celulares da Apple. Path Name: "C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" Start Mode: Auto State: Running Name: AppMgmt Display Name: Gerenciamento de aplicativo Description: Fornece servios de instalao de software como 'Atribuir', 'Publicar' e 'Remover'. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: AresChatServer Display Name: Ares Chatroom server Description: Hosts your chatroom on the Ares network. Path Name: Start Mode: Manual State: Stopped Name: aspnet_state Display Name: ASP.NET State Service Description: Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start. Path Name: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe Start Mode: Manual State: Stopped Name: AudioSrv Display Name: udio do Windows Description: Gerencia dispositivos de udio para programas baseados em Windows. Se este servio for interrompido, os dispositivos de udio e efeitos no funcionaro adequadamente. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: AVG Anti-Spyware Guard Display Name: AVG Anti-Spyware Guard Description: Path Name: C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe Start Mode: Auto State: Running Name: AVP Display Name: Kaspersky Anti-Virus Description: Fornece proteco contra vrus e outros softwares maliciosos. Path Name: "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" -r Start Mode: Auto State: Running Name: BITS Display Name: Servio de transferncia inteligente de plano de fundo Description: Transfere arquivos em segundo plano usando largura de banda de rede ociosa. Se o servio for parado, recursos como o Windows Update e o MSN Explorer no podero fazer o download automtico de programas e outras informaes. Se este servio for desativado, os servios que dependerem dele explicitamente talvez no transfiram arquivos, se no tiverem um mecanismo seguro para transferir arquivos diretamente pelo IE, caso o BITS tenha sido desativado. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: Bonjour Service Display Name: Bonjour Service Description: Bonjour allows applications like iTunes and Safari to advertise and discover services on the local network. Having Bonjour running enables you to connect to hardware devices like Apple TV and software services like iTunes sharing and AirTunes. If you disable Bonjour, any network service that explicitly depends on it will fail to start. Path Name: "C:\Arquivos de programas\Bonjour\mDNSResponder.exe" Start Mode: Auto State: Running Name: Browser Display Name: Localizador de computadores Description: Mantm uma lista atualizada de computadores na rede e fornece a computadores designados navegadores. Se este servio for interrompido, esta lista no ser atualizada ou mantida. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: CiSvc Display Name: Indexing Service Description: Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. Path Name: C:\WINDOWS\system32\cisvc.exe Start Mode: Manual State: Stopped Name: ClipSrv Display Name: rea de armazenamento Description: Permite que o 'Visualizador da rea de armazenamento' armazene informaes e compartilhe-as com computadores remotos. Se o servio for parado, o 'Visualizador da rea de armazenamento' no poder compartilhar informaes com computadores remotos. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\clipsrv.exe Start Mode: Disabled State: Stopped Name: clr_optimization_v2.0.50727_32 Display Name: .NET Runtime Optimization Service v2.0.50727_X86 Description: Microsoft .NET Framework NGEN Path Name: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe Start Mode: Manual State: Stopped Name: COMSysApp Display Name: Aplicativo de sistema COM+ Description: Gerencia a configurao e o controle dos componentes baseados no modelo de objeto componente (COM)+. Se o servio parar, a maioria dos componentes baseados no COM+ no funcionar adequadamente. Se o servio for desativado, qualquer servio explicitamente dependente dele falhar ao ser iniciado. Path Name: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} Start Mode: Manual State: Stopped Name: CryptSvc Display Name: Servios de criptografia Description: Fornece trs servios de gerenciamento: servio de banco de dados de catlogo, que confirma as assinaturas dos arquivos do Windows; servio de raiz protegida, que adiciona e remove certificados de autoridades de certificao raiz deste computador, e o servio de chave, que ajuda a registrar este computador para certificados. Se este servio for interrompido, esses servios de gerenciamento no funcionaro adequadamente. Se este servio for desativado, quaisquer servios que dele dependam diretamente deixaro de ser iniciados. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: DcomLaunch Display Name: Inicializador de Processo de Servidor DCOM Description: Fornece funcionalidade de inicializao para servios DCOM. Path Name: C:\WINDOWS\system32\svchost -k DcomLaunch Start Mode: Auto State: Running Name: Dhcp Display Name: Cliente DHCP Description: Gerencia a configurao de rede registrando e atualizando endereos IP e nomes DNS. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: dmadmin Display Name: Servio administrativo do gerenciador de disco lgico Description: Configura volumes e unidades de disco rgido. O servio executado apenas para processos de configurao e depois pra. Path Name: C:\WINDOWS\System32\dmadmin.exe /com Start Mode: Manual State: Stopped Name: dmserver Display Name: Gerenciador de discos lgicos Description: Detecta e monitora novas unidades de disco rgido e envia as informaes de volume de disco para o servio administrativo de gerenciador de discos lgicos para configurao. Se este servio for parado, o status de disco dinmico e as informaes de configurao podem se tornar obsoletos. Se este servio for desativado, os servios que dependerem dele explicittamente no sero iniciados. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: Dnscache Display Name: Cliente DNS Description: Resolve e armazena em cache nomes Domain Name System (DNS) para este computador. Se este servio for parado, o computador no poder resolver nomes DNS nem localizador controladores de domnio do Active Directory. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\svchost.exe -k NetworkService Start Mode: Disabled State: Stopped Name: Dot3svc Display Name: Configurao Automtica com Fio Description: Este servio realiza uma autenticao IEEE 802.1X em interfaces Ethernet Path Name: C:\WINDOWS\System32\svchost.exe -k dot3svc Start Mode: Manual State: Stopped Name: EapHost Display Name: Servio de EAP (Extensible Authentication Protocol) Description: Fornece a clientes Windows o Servio de EAP (Extensible Authentication Protocol) Path Name: C:\WINDOWS\System32\svchost.exe -k eapsvcs Start Mode: Manual State: Stopped Name: ERSvc Display Name: Error Reporting Service Description: Allows error reporting for services and applictions running in non-standard environments. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: Eventlog Display Name: Log de eventos Description: Registra mensagens de eventos emitidas por Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Path Name: C:\WINDOWS\system32\services.exe Start Mode: Auto State: Running Name: EventSystem Display Name: Sistema de eventos COM+ Description: D suporte para o servio de notificao de eventos do sistema (SENS), o qual fornece distribuio automtica dos eventos para inscrever componentes do modelo de objeto componente (COM). Se o servio for interrompido, o SENS ser fechado e no poder fornecer notificaes de logon e logoff. Se o servio for desativado, qualquer servio explicitamente dependente dele ir falhar ao ser iniciado. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Running Name: FastUserSwitchingCompatibility Display Name: Compatibilidade com 'Troca rpida de usurio' Description: Fornece gerenciamento de aplicativos que exigem assistncia em um ambiente de vrios usurios. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: FontCache3.0.0.0 Display Name: Windows Presentation Foundation Font Cache 3.0.0.0 Description: Optimizes performance of Windows Presentation Foundation (WPF) applications by caching commonly used font data. WPF applications will start this service if it is not already running. It can be disabled, though doing so will degrade the performance of WPF applications. Path Name: C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe Start Mode: Manual State: Stopped Name: gusvc Display Name: Google Updater Service Description: Path Name: "C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe" Start Mode: Manual State: Stopped Name: helpsvc Display Name: Ajuda e suporte Description: Permite que o 'Centro de ajuda e suporte' seja executado neste computador. Se esse servio for interrompido, o 'Centro de ajuda e suporte' no estar disponvel. Se esse servio for desativado, haver falha na inicializao de todos os servios que dependem dele de forma explcita. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: HidServ Display Name: Acesso a dispositivo de interface humana Description: Permite acesso de entrada genrica a dispositivos de interface humana (Human Interface Devices, HID), que ativam e mantm o uso de botes ativados predefinidos em teclados, controles remotos e outros dispositivos de multimdia. Se este servio for parado, os botes ativados controlados pelo servio deixaro de funcionar. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: hkmsvc Display Name: Servio de Gerenciamento de Certificados e Chaves de Integridade Description: Gerencia chaves e certificados de integridade (utilizado pelo NAP) Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: HTTPFilter Display Name: HTTP SSL Description: Este servio implementa o protocolo de transferncia segura de hipertexto (HTTPS) para o servio HTTP, usando a camada de soquete seguro (SSL). Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\System32\svchost.exe -k HTTPFilter Start Mode: Manual State: Stopped Name: IDriverT Display Name: InstallDriver Table Manager Description: Provides support for the Running Object Table for InstallShield Drivers Path Name: "C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe" Start Mode: Manual State: Stopped Name: idsvc Display Name: Windows CardSpace Description: Securely enables the creation, management, and disclosure of digital identities. Path Name: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" Start Mode: Manual State: Stopped Name: ImapiService Display Name: IMAPI CD-Burning COM Service Description: Gerencia a gravao de CDs por meio da interface IMAPI. Se esse servio for interrompido, o computador no poder gravar CDs. Se o servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados. Path Name: C:\WINDOWS\system32\imapi.exe Start Mode: Manual State: Stopped Name: iPod Service Display Name: iPod Service Description: Servios de gerenciamento de hardware do iPod Path Name: "C:\Arquivos de programas\iPod\bin\iPodService.exe" Start Mode: Manual State: Running Name: lanmanserver Display Name: Servidor Description: Oferece suporte a compartilhamento na rede de arquivo, impresso e pipes nomeados para este computador. Se este servio for interrompido, quaisquer servios que dele dependam diretamente no sero inicializados. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: lanmanworkstation Display Name: Estao de trabalho Description: Cria e mantm conexes de rede de cliente com servidores remotos. Se este servio for interrompido, essas conexes no estaro disponveis. Se este servio for desativado, quaisquer servios que dele dependam no sero inicializados. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: LmHosts Display Name: Auxiliar NetBIOS TCP/IP Description: Ativa o suporte a NetBIOS atravs do servio TCP/IP (NetBT) e da resoluo de nomes NetBIOS. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Auto State: Running Name: Messenger Display Name: Mensageiro Description: Transmite mensagens net send e do servio 'Alerta' entre clientes e servidores. Este servio no est relacionado ao Windows Messenger. Se este servio for interrompido, as mensagens do servio 'Alerta' no sero transmitidas. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero inicializados. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: mnmsrvc Display Name: Compartilhamento remoto da rea de trabalho do NetMeeting Description: Habilita um usurio autorizado a acessar este computador remotamente por meio do NetMeeting em uma intranet corporativa. Se este servio for interrompido, o compartilhamento da rea de trabalho remota no estar disponvel. Se este servio for desabilitado, quaisquer servios que dele dependam no sero iniciados. Path Name: C:\WINDOWS\system32\mnmsrvc.exe Start Mode: Disabled State: Stopped Name: MSDTC Display Name: Coordenador de transaes distribudas Description: Coordena transaes que abrangem mltiplos gerenciadores de recursos, tais como bancos de dados, filas de mensagens e sistemas de arquivos. Se este servio for interrompido, essas transaes no ocorrero. Se este servio for desativado, os servios que dependem explicitamente dele falharo ao serem iniciados. Path Name: C:\WINDOWS\system32\msdtc.exe Start Mode: Manual State: Stopped Name: MSIServer Display Name: Windows Installer Description: Adiciona, modifica e remove aplicativos fornecidos como um pacote do Windows Installer (*.msi). Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\msiexec.exe /V Start Mode: Manual State: Stopped Name: napagent Display Name: Agente de Proteo de Acesso Rede Description: Permite que clientes Windows participem da Proteo de Acesso Rede Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: NBService Display Name: NBService Description: Nero BackItUp Service is responsible to control all jobs created using Nero BackItUp. These jobs can create backups of selected files/folders/partitions or complete hard disk to hard disk, network drive, CD/DVD or FTP. Path Name: C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe Start Mode: Manual State: Stopped Name: NetDDE Display Name: DDE de rede Description: Fornece transporte e segurana de rede para Dynamic Data Exchange (DDE) para programas executados no mesmo computador ou em computadores diferentes. Se este servio for parado, o transporte e segurana DDE no estaro disponveis. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\netdde.exe Start Mode: Disabled State: Stopped Name: NetDDEdsdm Display Name: DSDM de DDE de rede Description: Gerencia compartilhamentos de rede do tipo DDE (Dynamic Data Exchange). Se este servio for parado, os compartilhamentos de rede DDE no estaro disponveis. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\netdde.exe Start Mode: Disabled State: Stopped Name: Netlogon Display Name: Logon de rede Description: D suporte autenticao de passagem de eventos de logon de contas para os computadores de um domnio. Path Name: C:\WINDOWS\system32\lsass.exe Start Mode: Manual State: Stopped Name: Netman Display Name: Conexes de rede Description: Gerencia objetos da pasta de conexes de rede e Dial-Up, na qual voc pode exibir conexes remotas e de rede local. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Running Name: NetTcpPortSharing Display Name: Net.Tcp Port Sharing Service Description: Provides ability to share TCP ports over the net.tcp protocol. Path Name: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" Start Mode: Disabled State: Stopped Name: Nla Display Name: Reconhecimento de local da rede (NLA) Description: Rene e armazena informaes sobre configuraes e locais da rede, bem como notifica os aplicativos quando essas informaes so alteradas. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Running Name: NMIndexingService Display Name: NMIndexingService Description: Path Name: "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe" Start Mode: Manual State: Stopped Name: NtLmSsp Display Name: Fornecedor de suporte de segurana NT LM Description: Fornece segurana a programas de chamada de procedimento remoto (remote procedure call, RPC) que usam transportes que no pipes nomeados. Path Name: C:\WINDOWS\system32\lsass.exe Start Mode: Disabled State: Stopped Name: NtmsSvc Display Name: Armazenamento removvel Description: Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: NVSvc Display Name: NVIDIA Display Driver Service Description: Provides system and desktop level support to the NVIDIA display driver Path Name: C:\WINDOWS\system32\nvsvc32.exe Start Mode: Auto State: Running Name: ose Display Name: Office Source Engine Description: Salva arquivos de instalao usados em atualizaes e reparos e necessrio para baixar atualizaes da instalao e relatrios de erro do Watson. Path Name: "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE" Start Mode: Manual State: Stopped Name: PlugPlay Display Name: Plug and Play Description: Permite que um computador reconhea e se adapte a alteraes de hardware com pouca ou nenhuma interveno do usurio. Se este servio for parado ou desativado, o sistema se tornar instvel. Path Name: C:\WINDOWS\system32\services.exe Start Mode: Auto State: Running Name: PolicyAgent Display Name: Servios IPSEC Description: Gerencia a diretiva de segurana IP e inicia o ISAKMP/Oakley (IKE) e o driver de segurana IP. Path Name: C:\WINDOWS\system32\lsass.exe Start Mode: Auto State: Running Name: ProtectedStorage Display Name: Armazenamento protegido Description: Fornece o armazenamento protegido para dados sensveis, como chaves privadas, para evitar o acesso de servios, processos ou usurios sem autorizao. Path Name: C:\WINDOWS\system32\lsass.exe Start Mode: Auto State: Running Name: RasAuto Display Name: Gerenciador de conexo de acesso remoto automtico Description: Cria uma conexo a uma rede remota sempre que um programa faz referncia a um nome ou endereo remoto DNS ou NetBios. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: RasMan Display Name: Gerenciador de conexo de acesso remoto Description: Cria uma conexo de rede. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Manual State: Running Name: RDSessMgr Display Name: Gerenciador de sesso de ajuda de rea de trabalho remota Description: Gerencia e controla a 'Assistncia remota'. Se esse servio for interrompido, a 'Assistncia remota' ficar indisponvel. Antes de interromper esse servio, consulte a guia 'Dependncias' da caixa de dilogo 'Propriedades'. Path Name: C:\WINDOWS\system32\sessmgr.exe Start Mode: Disabled State: Stopped Name: RemoteAccess Display Name: Roteamento e acesso remoto Description: Oferece servios de roteamento a empresas em ambientes de rede local e de longa distncia. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: RemoteRegistry Display Name: Registro remoto Description: Permite que usurios remotos modifiquem configuraes do Registro neste computador. Se este servio for parado, o Registro s poder ser modificado por usurios deste computador. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: RpcLocator Display Name: Alocador Remote Procedure Call (RPC) Description: Gerencia o banco de dados do servio de nomes RPC. Path Name: C:\WINDOWS\system32\locator.exe Start Mode: Manual State: Stopped Name: RpcSs Display Name: Chamada de procedimento remoto (RPC) Description: Fornece o mapeador de ponto de extremidade e outros servios RPC variados. Path Name: C:\WINDOWS\system32\svchost -k rpcss Start Mode: Auto State: Running Name: RSVP Display Name: QoS RSVP Description: Fornece a funcionalidade de sinalizao de rede e configurao do controle do trfego local para programas compatveis com QoS e miniaplicativos de controle. Path Name: C:\WINDOWS\system32\rsvp.exe Start Mode: Manual State: Stopped Name: SamSs Display Name: Gerenciador de contas de segurana Description: Armazena informaes sobre segurana para contas de usurio local. Path Name: C:\WINDOWS\system32\lsass.exe Start Mode: Auto State: Running Name: SCardSvr Display Name: Carto inteligente Description: Gerencia o acesso a leitores de carto inteligente por este computador. Se este servio for parado, o computador no poder ler cartes inteligentes. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\System32\SCardSvr.exe Start Mode: Manual State: Stopped Name: Schedule Display Name: Agendador de tarefas Description: Permite que um usurio configure e agende tarefas automatizadas no computador. Se este servio for interrompido, essas tarefas no sero executadas nos horrios agendados. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: sdAuxService Display Name: PC Tools Auxiliary Service Description: Proporciona servios de segurana auxiliares da PC Tools. Se esse servio for desativado a proteo contra spyware ser reduzida. Path Name: C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe Start Mode: Auto State: Running Name: sdCoreService Display Name: PC Tools Security Service Description: Proporciona proteo contra spyware e malware para o sistema. Se esse servio for desativado a proteo contra spyware ser desativada. Path Name: C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe Start Mode: Auto State: Running Name: seclogon Display Name: Logon secundrio Description: Ativa a inicializao de processos sob credenciais alternadas. Se este servio for interrompido, este tipo de acesso por logon no estar disponvel. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: SENS Display Name: Notificao de eventos de sistema Description: Rastreia eventos do sistema como eventos de logon do Windows, rede e energia. Notifica assinantes do Sistema de evento COM+ destes eventos. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: SharedAccess Display Name: Firewall do Windows/Compartilhamento de Conexo com a Internet (ICS) Description: Fornece servios de converso de endereos de rede, endereamento e resoluo de nomes e/ou preveno de invaso para uma rede domstica ou de pequena empresa. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: ShellHWDetection Display Name: Deteco do hardware do shell Description: Fornece notificaes de eventos de hardware 'Reproduo automtica'. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: Spooler Display Name: Spooler de impresso Description: Carrega arquivos na memria para impresso posterior. Path Name: C:\WINDOWS\system32\spoolsv.exe Start Mode: Auto State: Running Name: srservice Display Name: Servio de restaurao do sistema Description: Executa funes de restaurao do sistema. Para interromper o servio, desative a 'Restaurao do sistema' na guia 'Restaurao do sistema' em 'Meu computador' -> 'Propriedades' Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: SSDPSRV Display Name: Servio de descoberta SSDP Description: Ativa a descoberta de dispositivos UPnP na rede domstica. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: StarWindServiceAE Display Name: StarWind AE Service Description: Enables network access to local burners via iSCSI protocol. Path Name: C:\Arquivos de programas\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe Start Mode: Auto State: Running Name: stisvc Display Name: Assistente de aquisio de imagens do Windows (WIA) Description: Fornece servios de aquisio de imagens para scanners e cmeras Path Name: C:\WINDOWS\system32\svchost.exe -k imgsvc Start Mode: Auto State: Running Name: SwPrv Display Name: MS Software Shadow Copy Provider Description: Gerencia cpias de sombra de volume baseadas em software obtidas pelo servio de cpias de sombra de volume. Se o servio for interrompido, as cpias de sombra baseadas em software no podero ser gerenciadas. Se o servio for desativado, os servios que dependerem dele diretamente no sero iniciados. Path Name: C:\WINDOWS\system32\dllhost.exe /Processid:{C34F2775-5AAE-472D-BACF-CB36CAD1B9DF} Start Mode: Manual State: Stopped Name: SysmonLog Display Name: Logs e alertas de desempenho Description: Coleta dados de desempenho de computadores locais ou remotos com base em parmetros de agendamento pr-configurados; em seguida, grava os dados em um log ou dispara um alerta. Se este servio for parado, as informaes de desempenho no sero coletadas. Se este servio for desativado, os servios que dependerem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\smlogsvc.exe Start Mode: Disabled State: Stopped Name: TapiSrv Display Name: Telefonia Description: Fornece suporte telefonia API (TAPI) para programas que controlam dispositivos de telefonia e conexes de voz baseadas em IP no computador local e, atravs da rede local, em servidores que tambm esto executando o servio. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Running Name: TermService Display Name: Servios de terminal Description: Permite que vrios usurios sejam conectados interativamente a um computador e que as reas de trabalho e os aplicativos sejam exibidos a computadores remotos. A base da rea de trabalho remota (inclusive a rea de trabalho remota para administradores), da opo de alternar-se rapidamente entre usurios, da assistncia remota e do Terminal Server. Path Name: C:\WINDOWS\System32\svchost -k DComLaunch Start Mode: Manual State: Running Name: Themes Display Name: Temas Description: Fornece gerenciamento de temas para experincia do usurio. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: ThreatFire Display Name: ThreatFire Description: The ThreatFire engine responsible for monitoring your system for viruses, spyware, and other malware. Turning this service off makes your machine vulnerable to such attacks. Path Name: C:\Arquivos de programas\Spyware Doctor\TFEngine\TFService.exe service Start Mode: Manual State: Running Name: TlntSvr Display Name: Telnet Description: Permite que um usurio remoto faa logon neste computador e execute programas. Fornece suporte a vrios clientes Telnet TCP/IP, inclusive computadores baseados em UNIX e Windows. Se este servio for parado, o acesso de usurios remotos a programas poder no estar disponvel. Se este servio for desativado, os servios que dependem dele explicitamente no sero iniciados. Path Name: C:\WINDOWS\system32\tlntsvr.exe Start Mode: Disabled State: Stopped Name: TrkWks Display Name: Cliente de rastreamento de link distribudo Description: Mantm vnculos entre arquivos NTFS em um computador ou entre computadores em um domnio de rede. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: TuneUp.Defrag Display Name: TuneUp Drive Defrag Service Description: Allows TuneUp Drive Defrag to defragment your disks so that your computer runs faster and more efficiently. Path Name: C:\WINDOWS\System32\TuneUpDefragService.exe Start Mode: Manual State: Stopped Name: upnphost Display Name: Host de dispositivo Plug and Play universal Description: Oferece suporte para hospedar dispositivos Plug and Play universais. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Disabled State: Stopped Name: UPS Display Name: Uninterruptible Power Supply Description: Manages an uninterruptible power supply (UPS) connected to the computer. Path Name: C:\WINDOWS\System32\ups.exe Start Mode: Manual State: Stopped Name: UxTuneUp Display Name: TuneUp Theme Extension Description: Allows to use visual styles without Microsoft signature. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: VSS Display Name: Cpia de volume em memria Description: Gerencia e implementa cpias de volume em memria usados para o backup e outros propsitos. Se este servio for interrompido, as cpias em memria no estaro disponveis para backup e o backup pode falhar. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados. Path Name: C:\WINDOWS\System32\vssvc.exe Start Mode: Manual State: Stopped Name: W32Time Display Name: Horrio do Windows Description: Mantm sincronizao de data e hora em todos os clientes e servidores da rede. Se este servio for interrompido, a sincronizao no ficar disponvel. Se este servio for desativado, os servios que dele dependem explicitamente no sero iniciados. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: WebClient Display Name: Cliente da Web Description: Permite que programas baseados em Windows criem, acessem e modifiquem arquivos baseados na Internet. Se este servio for interrompido, essas funes no estaro disponveis. Se este servio for desativado, quaisquer servios que dele dependam diretamente no sero iniciados. Path Name: C:\WINDOWS\system32\svchost.exe -k LocalService Start Mode: Auto State: Running Name: winmgmt Display Name: Testador de instrumentao de gerenciam. do Windows Description: Fornece uma interface comum e um modelo de objeto para o acesso a informaes de gerenciamento sobre o sistema operacional, dispositivos, aplicativos e servios. Se esse servio for parado, a maioria dos itens de software baseados no Windows no funcionar corretamente. Se este servio for desativado, os servios que dependerem explicitamente dele no sero iniciados. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: WLSetupSvc Display Name: Windows Live Setup Service Description: Windows Live Setup Service Path Name: "C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe" Start Mode: Manual State: Stopped Name: WmdmPmSN Display Name: Servio de Nmero de Srie de Mdia Porttil Description: Recupera o nmero de srie de qualquer player de mdia porttil conectado a seu computador. Se este servio for interrompido, o contedo protegido pode no ser baixado para o dispositivo. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Disabled State: Stopped Name: Wmi Display Name: Extenses de driver de instrum. gerenc. do Windows Description: Fornece informaes sobre gerenciamento de sistemas para drivers e de drivers. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped Name: WmiApSrv Display Name: Adaptador de desempenho WMI Description: Fornece informaes da biblioteca de desempenho dos provedores HiPerf WMI. Path Name: C:\WINDOWS\system32\wbem\wmiapsrv.exe Start Mode: Manual State: Stopped Name: WMPNetworkSvc Display Name: Servio de Compartilhamento de Rede do Windows Media Player Description: Compartilha bibliotecas do Windows Media Player com outros players e dispositivos de mdia da rede por meio de Universal Plug and Play Path Name: "C:\Arquivos de programas\Windows Media Player\WMPNetwk.exe" Start Mode: Manual State: Stopped Name: wscsvc Display Name: Central de Segurana Description: Monita as definies e configuraes de segurana do sistema. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: WSearch Display Name: Windows Search Description: Fornece a indexao de contedo e o cache de propriedade para arquivo, email e outro contedo (via APIs de extensibilidade). O servio responde as notificaes de arquivo e email para indexar o contedo modificado. Se o servio for interrompido ou desabilitado, o Explorer no poder exibir exibies da pasta virtual de itens e a pesquisa no Explorer retornar para a pesquisa lenta item por item. Path Name: C:\WINDOWS\system32\SearchIndexer.exe /Embedding Start Mode: Auto State: Running Name: wuauserv Display Name: Atualizaes Automticas Description: Ativa o download e instalao das atualizaes do Windows. Se este servio for desabilitado, o computador no ser capaz de usar o recurso de Atualizaes Automticas nem o site do Windows Update na web. Path Name: C:\WINDOWS\system32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: WudfSvc Display Name: Windows Driver Foundation - User-mode Driver Framework Description: Manages user-mode driver host processes Path Name: C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup Start Mode: Manual State: Stopped Name: WZCSVC Display Name: Configurao zero sem fio Description: Fornece configurao automtica para os adaptadores 802.11 Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Auto State: Running Name: xmlprov Display Name: Servio de Configurao de Rede Description: Gerencia arquivos de configurao XML por domnio para configurao automtica de rede. Path Name: C:\WINDOWS\System32\svchost.exe -k netsvcs Start Mode: Manual State: Stopped ------------------------------------------------------------------------------------ Displaying LOG for Microsoft Windows Malicious Software Removal Tool: *** Microsoft Windows MRT Log NOT Found! **** ---------------------------------------------------------------------------- Listing HKCU Explorer\Advanced//Hidden and SuperHidden Registry Keys if Hidden = 0 then Hidden Files and Folders are not shown if SuperHidden = 1 is the desired default value. if ShowSuperHidden = 0 then System Files are not shown if HideFileExt = 1 then File Extension are not shown We want their values to be (from top to bottom) 1,1,1,0 ---------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced Hidden REG_DWORD 1 (0x1) SuperHidden REG_DWORD 1 (0x1) ShowSuperHidden REG_DWORD 1 (0x1) HideFileExt REG_DWORD 0 (0x0) ************************************************************************************ Examining Select Windows Registry Keys ------------------------------------------------------------------------------------ -------------------------------------------------------------------------- Items Found in ZoneMap\Domains: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\zonemap\domains REG_SZ ---------------------------------------------------------------------------- Current User ZoneMap ProtocolDefaults ---------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\protocoldefaults REG_SZ http REG_DWORD 3 (0x3) https REG_DWORD 3 (0x3) ftp REG_DWORD 3 (0x3) file REG_DWORD 3 (0x3) @ivt REG_DWORD 1 (0x1) shell REG_DWORD 0 (0x0) ---------------------------------------------------------------------------- Default URL Prefix Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\DefaultPrefix REG_SZ http:// HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\url\Prefixes ftp REG_SZ ftp:// gopher REG_SZ gopher:// home REG_SZ http:// mosaic REG_SZ http:// www REG_SZ http:// -------------------------------------------------------------------------- Startup Items Disabled via MSCONFIG: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\state system.ini REG_DWORD 0 (0x0) win.ini REG_DWORD 0 (0x0) bootini REG_DWORD 0 (0x0) services REG_DWORD 0 (0x0) startup REG_DWORD 0 (0x0) -------------------------------------------------------------------------- Select AutoRun Registry Keys: -------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe MSMSGS REG_SZ "C:\Arquivos de programas\Messenger\msmsgs.exe" /background HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonceex HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run SunJavaUpdateSched REG_SZ "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" SkyTel REG_SZ "C:\WINDOWS\SkyTel.EXE" RTHDCPL REG_SZ "C:\WINDOWS\RTHDCPL.EXE" nwiz REG_SZ nwiz.exe /install amd_dc_opt REG_SZ "C:\Arquivos de programas\AMD\Dual-Core Optimizer\amd_dc_opt.exe" TkBellExe REG_SZ "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot QuickTime Task REG_SZ "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup iTunesHelper REG_SZ "C:\Arquivos de programas\iTunes\iTunesHelper.exe" NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit OutpostMonitor REG_SZ C:\ARQUIV~1\Agnitum\Outpost Firewall Pro\op_mon.exe /tray /noservice AVP REG_SZ "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" ISTray REG_SZ "C:\Arquivos de programas\Spyware Doctor\pctsTray.exe" HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce HKEY_USERS\.default\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce tscuninstall REG_EXPAND_SZ %systemroot%\system32\tscupgrd.exe HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce tscuninstall REG_EXPAND_SZ %systemroot%\system32\tscupgrd.exe HKEY_USERS\s-1-5-19\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\s-1-5-19\software\microsoft\windows\currentversion\runonce tscuninstall REG_EXPAND_SZ %systemroot%\system32\tscupgrd.exe HKEY_USERS\s-1-5-20\software\microsoft\windows\currentversion\run CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE HKEY_USERS\s-1-5-20\software\microsoft\windows\currentversion\runonce tscuninstall REG_EXPAND_SZ %systemroot%\system32\tscupgrd.exe -------------------------------------------------------------------------- WinLogon Notify Registry Key: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon DllName REG_SZ C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll Logon REG_SZ SABWINLOLogon Logoff REG_SZ SABWINLOLogoff Startup REG_SZ SABWINLOStartup Shutdown REG_SZ SABWINLOShutdown Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ crypt32.dll Logoff REG_SZ ChainWlxLogoffEvent HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ cryptnet.dll Logoff REG_SZ CryptnetWlxLogoffEvent HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll DLLName REG_SZ cscdll.dll Logon REG_SZ WinlogonLogonEvent Logoff REG_SZ WinlogonLogoffEvent ScreenSaver REG_SZ WinlogonScreenSaverEvent Startup REG_SZ WinlogonStartupEvent Shutdown REG_SZ WinlogonShutdownEvent StartShell REG_SZ WinlogonStartShellEvent Impersonate REG_DWORD 0 (0x0) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy Asynchronous REG_DWORD 1 (0x1) DllName REG_EXPAND_SZ %SystemRoot%\System32\dimsntfy.dll Startup REG_SZ WlDimsStartup Shutdown REG_SZ WlDimsShutdown Logon REG_SZ WlDimsLogon Logoff REG_SZ WlDimsLogoff StartShell REG_SZ WlDimsStartShell Lock REG_SZ WlDimsLock Unlock REG_SZ WlDimsUnlock HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\klogon REG_SZ Asynchronous REG_DWORD 0 (0x0) Impersonate REG_DWORD 0 (0x0) DllName REG_SZ C:\WINDOWS\system32\klogon.dll Logon REG_SZ WLEventStop Startup REG_SZ WLEventStart Lock REG_SZ WLEventStart Unlock REG_SZ WLEventStop Logoff REG_SZ WLEventStart HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp DLLName REG_SZ wlnotify.dll Logon REG_SZ SCardStartCertProp Logoff REG_SZ SCardStopCertProp Lock REG_SZ SCardSuspendCertProp Unlock REG_SZ SCardResumeCertProp Enabled REG_DWORD 1 (0x1) Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ wlnotify.dll Impersonate REG_DWORD 0 (0x0) StartShell REG_SZ SchedStartShell Logoff REG_SZ SchedEventLogOff HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy Logoff REG_SZ WLEventLogoff Impersonate REG_DWORD 0 (0x0) Asynchronous REG_DWORD 1 (0x1) DllName REG_EXPAND_SZ sclgntfy.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn DLLName REG_SZ WlNotify.dll Lock REG_SZ SensLockEvent Logon REG_SZ SensLogonEvent Logoff REG_SZ SensLogoffEvent Safe REG_DWORD 1 (0x1) MaxWait REG_DWORD 600 (0x258) StartScreenSaver REG_SZ SensStartScreenSaverEvent StopScreenSaver REG_SZ SensStopScreenSaverEvent Startup REG_SZ SensStartupEvent Shutdown REG_SZ SensShutdownEvent StartShell REG_SZ SensStartShellEvent PostShell REG_SZ SensPostShellEvent Disconnect REG_SZ SensDisconnectEvent Reconnect REG_SZ SensReconnectEvent Unlock REG_SZ SensUnlockEvent Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv Asynchronous REG_DWORD 0 (0x0) DllName REG_EXPAND_SZ wlnotify.dll Impersonate REG_DWORD 0 (0x0) Logoff REG_SZ TSEventLogoff Logon REG_SZ TSEventLogon PostShell REG_SZ TSEventPostShell Shutdown REG_SZ TSEventShutdown StartShell REG_SZ TSEventStartShell Startup REG_SZ TSEventStartup MaxWait REG_DWORD 600 (0x258) Reconnect REG_SZ TSEventReconnect Disconnect REG_SZ TSEventDisconnect HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon Logon REG_SZ WLEventLogon Logoff REG_SZ WLEventLogoff Startup REG_SZ WLEventStartup Shutdown REG_SZ WLEventShutdown StartScreenSaver REG_SZ WLEventStartScreenSaver StopScreenSaver REG_SZ WLEventStopScreenSaver Lock REG_SZ WLEventLock Unlock REG_SZ WLEventUnlock StartShell REG_SZ WLEventStartShell PostShell REG_SZ WLEventPostShell Disconnect REG_SZ WLEventDisconnect Reconnect REG_SZ WLEventReconnect Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 0 (0x0) SafeMode REG_DWORD 1 (0x1) MaxWait REG_DWORD -1 (0xffffffff) DllName REG_EXPAND_SZ WgaLogon.dll Event REG_DWORD 0 (0x0) InstallEvent REG_SZ 1.8.0031.9 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon\Settings REG_SZ Data REG_BINARY 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004bbd3b25b564b47a4b700528751eea704000000040000005300000003660000a800000010000000450903206e05f6238ed795c04d5dfdf20000000004800000a0000000100000007acff494840193b5e3c17efdb89b97a2b00100002f4c3c6646b54fa0745ac989f18d62b19b5cc17cc05e7d704894c9b13168985802c73788c04491d9cf23a1515c2f342e5d0cdd94a62820d4b7fe71685c4566982efa2c74f774fa6ffe6a124fe03c42ca2f751c95b14f44038e3e82dfcb93cc922030e29cf7593242cc6c26480b4d9daf487196ac64e2872867c8995899b3f2563943bf71981036e5ac0f7fca3de39e8523d4e08e8e54da848249f76a5ff8779cafddbb1e450528615d7c8924f5ba7357f38fbd59cf4b05d71a3d0738af160a21b9961236a47ba693cf6857a4f5a60c9ea11b9054b847deb842332fac81b2402381130687950978b5637898bdbe59007451b9641b9ecb756db9d7a5451f9e59c269a5e52c70e913351cab663ef7aaa14bb06767732732492f573b0b3026818555be39cd04a40195fe34695f28fcf85b43c77bdba69e9b2711dcff027c780931b753f857bdf7df46bd4cafcc9731584ac22a152b72f0f0298bf11f799ee733904b86744c6c3edc5c88ac6a3254597653ed559335009d18019ca738fa80c2b0109fd07a391ff93a8e7a26f862782a083cfe07e1fe90747a70023b572cc20f4f03df76014dc4dbb7efa0c744654071032b51140000009659eec3237e64c71f527b1da16c2307cd00f6f7 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon DLLName REG_SZ wlnotify.dll Logon REG_SZ RegisterTicketExpiredNotificationEvent Logoff REG_SZ UnregisterTicketExpiredNotificationEvent Impersonate REG_DWORD 1 (0x1) Asynchronous REG_DWORD 1 (0x1) -------------------------------------------------------------------------- Shared Task Scheduler Registry Items: -------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler {438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Pr-carregador Browseui {8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Daemon de cache de categorias de componente -------------------------------------------------------------------------- Scheduled Tasks: -------------------------------------------------------------------------- O volume na unidade C no tem nome. O nmero de srie do volume B89F-8597 Pasta de C:\WINDOWS\tasks 19/10/2008 14:34 . 19/10/2008 14:34 .. 18/11/2008 21:00 518 1-Click Maintenance.job 13/11/2008 20:21 300 AppleSoftwareUpdate.job 28/10/2001 14:07 65 desktop.ini 18/11/2008 16:25 6 SA.DAT 18/11/2008 21:12 454 User_Feed_Synchronization-{CEE752F2-D385-460C-B0E1-A3AC005319A7}.job 5 arquivo(s) 1.343 bytes Total de arquivos na lista: 5 arquivo(s) 1.343 bytes 2 pasta(s) 66.978.299.904 bytes disponveis A C:\WINDOWS\tasks\1-Click Maintenance.job A C:\WINDOWS\tasks\AppleSoftwareUpdate.job HR C:\WINDOWS\tasks\desktop.ini A H C:\WINDOWS\tasks\SA.DAT A H C:\WINDOWS\tasks\User_Feed_Synchronization-{CEE752F2-D385-460C-B0E1-A3AC005319A7}.job ---------------------------------------------------------------------------- ShellExecuteHooks Registry Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ {56F9679E-7826-4C84-81F3-532071A8BCC5} REG_SZ {57B86673-276A-48B2-BAE7-C6DBB3020EB8} REG_SZ AVG Anti-Spyware 7.5 {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} REG_SZ ---------------------------------------------------------------------------- ShellServiceObjectDelayLoad Registry Keys ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload PostBootReminder REG_SZ {7849596a-48ea-486e-8937-a2a3009f31a9} CDBurn REG_SZ {fbeb8a05-beee-4442-804e-409d6c4515e9} WebCheck REG_SZ {E6FB5E20-DE35-11CF-9C87-00AA005127ED} SysTray REG_SZ {35CEC8A3-2BE6-11D2-8773-92E220524153} WPDShServiceObj REG_SZ {AAA288BA-9A4C-45B0-95D7-94D524869DB5} ---------------------------------------------------------------------------- ModuleUsage Registry Keys: ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/LegitCheckControl.DLL .Owner REG_SZ Unknown Owner {17492023-C23A-453E-A040-C7C580BBF700} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/system32/muweb.dll .Owner REG_SZ {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} REG_SZ ---------------------------------------------------------------------------- BHO Registry Keys: ---------------------------------------------------------------------------- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3049C3E9-B461-4BC5-8870-4C09146192CA} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} REG_SZ BitComet ClickCapture HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} REG_SZ IEVkbdBHO NoExplorer REG_DWORD 1 (0x1) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB} REG_SZ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -------------------------------------------------------------------------- Select Policy Keys: -------------------------------------------------------------------------- HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0) NoDrives REG_DWORD 0 (0x0) HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system HideLegacyLogonScripts REG_DWORD 0 (0x0) HideLogoffScripts REG_DWORD 0 (0x0) HideStartupScripts REG_DWORD 0 (0x0) RunLogonScriptSync REG_DWORD 1 (0x1) RunStartupScriptSync REG_DWORD 0 (0x0) DisableRegistryTools REG_DWORD 0 (0x0) HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\Shell HKEY_CURRENT_USER\software\policies\microsoft\internet explorer HKEY_CURRENT_USER\software\policies\microsoft\internet explorer\Control Panel HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer LinkResolveIgnoreLinkInfo REG_DWORD 0 (0x0) NoResolveSearch REG_DWORD 1 (0x1) NoResolveTrack REG_DWORD 1 (0x1) NoDriveTypeAutoRun REG_DWORD 227 (0xe3) NoDrives REG_DWORD 0 (0x0) NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1) DisableRegistryTools REG_DWORD 0 (0x0) HideLegacyLogonScripts REG_DWORD 0 (0x0) HideLogoffScripts REG_DWORD 0 (0x0) RunLogonScriptSync REG_DWORD 1 (0x1) RunStartupScriptSync REG_DWORD 0 (0x0) HideStartupScripts REG_DWORD 0 (0x0) HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\.default\software\microsoft\windows\currentversion\policies HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\Explorer HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system ************************************************************************************ Checking File System for suspicious Files -------------------------------------------------------------------------- Items in the Root Directory: -------------------------------------------------------------------------- Locating all files created in C:\ "C:\" ARQUIV~1 17 Apr 2008 "Arquivos de programas" autoexec.bat 17 Apr 2008 0 "AUTOEXEC.BAT" boot.bak 18 Aug 2008 223 "Boot.bak" boot.ini 4 Nov 2008 293 "boot.ini" bootfont.bin 28 Oct 2001 4952 "Bootfont.bin" CMDCONS 4 Nov 2008 "cmdcons" cmldr 3 Aug 2004 261856 "cmldr" combofix.txt 4 Nov 2008 23528 "ComboFix.txt" config.sys 17 Apr 2008 0 "CONFIG.SYS" DOCUME~1 17 Apr 2008 "Documents and Settings" io.sys 17 Apr 2008 0 "IO.SYS" iph.ph 15 Aug 2008 735 "IPH.PH" ISEEYO~1 18 Nov 2008 "ISeeYouXP" msdos.sys 17 Apr 2008 0 "MSDOS.SYS" ntdetect.com 3 Aug 2004 47564 "NTDETECT.COM" ntldr 9 Jun 2008 251696 "ntldr" pagefile.sys 18 Nov 2008 1509949440 "pagefile.sys" PROGRA~1 18 Apr 2008 "Program Files" QOOBOX 4 Nov 2008 "Qoobox" RECYCLER 4 Nov 2008 "RECYCLER" SYSTEM~1 17 Apr 2008 "System Volume Information" TEMP 17 Jun 2008 "temp" WINDOWS 17 Apr 2008 "WINDOWS" 23 items found: 13 files (8 H/S), 10 directories (3 H/S). Total of file sizes: 1.510.540.287 bytes 1,41 G -------------------------------------------------------------------------- Items in the C:\TEMP Directory: -------------------------------------------------------------------------- Locating all files created in C:\TEMP "C:\temp\" debug.txt 6 Oct 2008 9216 "debug.txt" 1 item found: 1 file, 0 directories. Total of file sizes: 9.216 bytes 9,00 K -------------------------------------------------------------------------- Locating all Backup files on C: -------------------------------------------------------------------------- Locating all *.BAK* files "C:\" boot.bak 18 Aug 2008 223 "Boot.bak" "C:\Arquivos de programas\eMule\" downlo~1.bak 18 Nov 2008 2096 "downloads.bak" "C:\Arquivos de programas\eMule\Temp\" 001par~1.bak 18 Nov 2008 589 "001.part.met.bak" 002par~1.bak 18 Nov 2008 727 "002.part.met.bak" 003par~1.bak 18 Nov 2008 1087 "003.part.met.bak" 005par~1.bak 18 Nov 2008 754 "005.part.met.bak" 006par~1.bak 18 Nov 2008 723 "006.part.met.bak" 007par~1.bak 18 Nov 2008 677 "007.part.met.bak" "C:\WINDOWS\system32\config\" default.bak 4 Nov 2008 3145728 "default.bak" sam.bak 4 Nov 2008 24576 "SAM.bak" security.bak 4 Nov 2008 262144 "SECURITY.bak" software.bak 4 Nov 2008 40894464 "software.bak" system.bak 4 Nov 2008 4980736 "system.bak" "C:\Documents and Settings\Administrador\Dados de aplicativos\LimeWire\" fileurns.bak 13 Aug 2008 10086 "fileurns.bak" "C:\WINDOWS\system32\drivers\etc\" hosts.bak 28 Aug 2008 259274 "HOSTS.bak" "C:\Documents and Settings\Administrador\Configuraes locais\Dados de aplicativos\Microsoft\Internet Explorer\" brndlog.bak 18 May 2008 8311 "brndlog.bak" "C:\Documents and Settings\All Users\Dados de aplicativos\McAfee\MSC\Cache\" mcsubdb.bak 18 Sep 2008 1513 "McSubDB.Bak" "C:\Documents and Settings\All Users\Dados de aplicativos\McAfee.com\Agent\Cache\" mcsubdb.bak 7 Sep 2008 340 "McSubDB.Bak" "C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\OFFICE\DATA\" opa11.bak 17 Oct 2002 8200 "OPA11.BAK" 19 items found: 19 files, 0 directories. Total of file sizes: 49.602.248 bytes 47,30 M -------------------------------------------------------------------------- Locating all copies of Internet Explorer on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer "C:\Arquivos de programas\Internet Explorer\" iexplore.exe 22 Aug 2008 637984 "iexplore.exe" "C:\WINDOWS\ie7\" iexplore.exe 4 Aug 2004 93184 "iexplore.exe" "C:\WINDOWS\ie8\" iexplore.exe 23 Jun 2008 625664 "iexplore.exe" "C:\WINDOWS\ie7updates\KB944533-IE7\" iexplore.exe 13 Aug 2007 622080 "iexplore.exe" "C:\WINDOWS\ie7updates\KB947864-IE7\" iexplore.exe 6 Dec 2007 625664 "iexplore.exe" "C:\WINDOWS\system32\dllcache\" iexplore.exe 22 Aug 2008 637984 "iexplore.exe" "C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\" iexplore.exe 6 Dec 2007 625664 "iexplore.exe" "C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\" iexplore.exe 22 Feb 2008 625664 "iexplore.exe" 8 items found: 8 files, 0 directories. Total of file sizes: 4.493.888 bytes 4,29 M -------------------------------------------------------------------------- Locating all copies of beep.sy_ on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer No matches found. -------------------------------------------------------------------------- Locating all copies of beep.sys on C: -------------------------------------------------------------------------- Locating all copies of Internet Explorer "C:\WINDOWS\system32\drivers\" beep.sys 28 Oct 2001 4224 "beep.sys" 1 item found: 1 file, 0 directories. Total of file sizes: 4.224 bytes 4,13 K -------------------------------------------------------------------------- Locating all copies of Windows Explorer on C: -------------------------------------------------------------------------- Locating all copies of Windows Explorer "C:\WINDOWS\" explorer.exe 13 Apr 2008 1035776 "explorer.exe" "C:\WINDOWS\$NtUninstallKB938828$\" explorer.exe 4 Aug 2004 1034240 "explorer.exe" "C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\" explorer.exe 13 Jun 2007 1035264 "explorer.exe" 3 items found: 3 files, 0 directories. Total of file sizes: 3.105.280 bytes 2,96 M -------------------------------------------------------------------------- Items in Document and Settings: -------------------------------------------------------------------------- Listing contents of C:\Documents and Settings OhhGOw676N+w6pw >k} - 1252, "C:\Documents and Settings\" ADMINI~1 17 Apr 2008 "Administrador" ALLUSE~1 17 Apr 2008 "All Users" DEFAUL~1 17 Apr 2008 "Default User" LOCALS~1 17 Apr 2008 "LocalService" NETWOR~1 17 Apr 2008 "NetworkService" 5 items found: 0 files, 5 directories (3 H/S). -------------------------------------------------------------------------- Desktop Items: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Administrador\Desktop within the last 90 days. "C:\Documents and Settings\Administrador\Desktop\" bitcomet.lnk 22 Aug 2008 780 "BitComet.lnk" ccleaner.lnk 7 Oct 2008 1620 "CCleaner.lnk" iseeyo~1.exe 10 Nov 2008 1106604 "ISeeYouXP.exe" iseeyo~1.lnk 18 Nov 2008 534 "ISeeYouXP.lnk" ultraiso.lnk 5 Sep 2008 1620 "UltraISO.lnk" winrar.lnk 5 Sep 2008 784 "WinRAR.lnk" torrent.lnk 12 Nov 2008 670 "Torrent.lnk" 7 items found: 7 files, 0 directories. Total of file sizes: 1.112.612 bytes 1,06 M Locating all files created in C:\Documents and Settings\All Users\Desktop\ within the last 90 days. "C:\Documents and Settings\All Users\Desktop\" emule.lnk 21 Oct 2008 708 "eMule.lnk" itunes.lnk 21 Oct 2008 2169 "iTunes.lnk" opera.lnk 30 Oct 2008 632 "Opera.lnk" picasa 3.lnk 4 Sep 2008 815 "Picasa 3.lnk" videoget.lnk 19 Oct 2008 797 "VideoGet.lnk" 5 items found: 5 files, 0 directories. Total of file sizes: 5.121 bytes 5,00 K -------------------------------------------------------------------------- Start Menu Items: -------------------------------------------------------------------------- Locating all files created inC:\Documents and Settings\Administrador\Start Menu within the last 90 days. No matches found. Locating all files created in C:\Documents and Settings\Administrador\Start Menu\Programs\Startup within the last 90 days. No matches found. Locating all files created in C:\Documents and Settings\All Users\Start Menu within the last 90 days. No matches found. Locating all files created in C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ within the last 90 days. No matches found. -------------------------------------------------------------------------- Application Data Items: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Administrador\Application Data\ within the last 90 days. No matches found. Locating all files created in C:\Documents and Settings\Administrador\Local Settings\Application Data\ within the last 90 days. No matches found. Locating all files created in C:\Documents and Settings\All Users\Application Data\ within the last 90 days. No matches found. -------------------------------------------------------------------------- C:\Documents and Settings\Administrador\Local Settings\TEMP: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Administrador\Local Settings\TEMP within the last 90 days. -------------------------------------------------------------------------- Items in Templates Folder: -------------------------------------------------------------------------- Locating all files created in C:\Documents and Settings\Administrador\Templates No matches found. -------------------------------------------------------------------------- Items in Program Files: -------------------------------------------------------------------------- Locating all files created in C:\Arquivos de programas\ within the last 90 days. "C:\Arquivos de programas\" AGNITUM 13 Oct 2008 "Agnitum" BITCOMET 22 Aug 2008 "BitComet" BONJOUR 14 Sep 2008 "Bonjour" EA GAMES 3 Sep 2008 "EA GAMES" EMULE 21 Oct 2008 "eMule" GRISOFT 28 Aug 2008 "GRISOFT" IPOD 15 Oct 2008 "iPod" ITUNES 15 Oct 2008 "iTunes" KODAK 10 Sep 2008 "Kodak" OPERA 14 Sep 2008 "Opera" STELLA 1 Nov 2008 "Stella" 11 items found: 0 files, 11 directories. Locating all files created in C:\Arquivos de programas\Arquivos comuns\ within the last 90 days. "C:\Arquivos de programas\Arquivos comuns\" APPLE 14 Sep 2008 "Apple" KODAK 10 Sep 2008 "Kodak" PC TOOLS 13 Oct 2008 "PC Tools" 3 items found: 0 files, 3 directories. Locating all files created in C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders within the last 90 days. No matches found. -------------------------------------------------------------------------- Items in the Windows Directory: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\ within the last 90 days. "C:\WINDOWS\" $N500F~1 12 Nov 2008 "$NtUninstallKB957097$" $N60EE~1 12 Nov 2008 "$NtUninstallKB955069$" $N74DE~1 12 Nov 2008 "$NtUninstallKB954459$" 0.log 18 Nov 2008 0 "0.log" bootstat.dat 18 Nov 2008 2048 "bootstat.dat" cdplayer.ini 14 Sep 2008 50 "cdplayer.ini" CSC 23 Aug 2008 "CSC" diiunin.dat 19 Sep 2008 41631 "DIIUnin.dat" diiunin.exe 19 Sep 2008 94208 "DIIUnin.exe" diiunin.pif 19 Sep 2008 2829 "DIIUnin.pif" ERDNT 4 Nov 2008 "ERDNT" gsatcmp.ini 18 Oct 2008 5 "gsatcmp.ini" IE8 14 Sep 2008 "ie8" mafosav.ini 23 Aug 2008 238 "mafosav.INI" mozver.dat 18 Sep 2008 7533 "mozver.dat" nerodi~1.ini 18 Nov 2008 69 "NeroDigital.ini" odbc.ini 5 Sep 2008 421 "ODBC.INI" photos~1.ini 3 Sep 2008 151 "PhotoSnapViewer.INI" PROFILES 18 Oct 2008 "profiles" rometw.ini 18 Sep 2008 248 "RomeTW.ini" schedlgu.txt 18 Nov 2008 32622 "SchedLgU.Txt" scunin.dat 16 Sep 2008 39437 "scunin.dat" scunin.exe 16 Sep 2008 94208 "ScUnin.exe" scunin.pif 16 Sep 2008 967 "ScUnin.pif" sti_tr~1.log 12 Nov 2008 0 "Sti_Trace.log" system.ini 4 Nov 2008 435 "system.ini" war3unin.dat 15 Oct 2008 97388 "War3Unin.dat" war3unin.exe 15 Oct 2008 139264 "War3Unin.exe" war3unin.pif 15 Oct 2008 2829 "War3Unin.pif" wiadebug.log 18 Nov 2008 159 "wiadebug.log" wiaservc.log 18 Nov 2008 50 "wiaservc.log" win.ini 16 Oct 2008 663 "win.ini" window~1.log 18 Nov 2008 118481 "WindowsUpdate.log" wlxpgss.scr 5 Sep 2008 288768 "WLXPGSS.SCR" _msrstrt.exe 5 Sep 2008 2560 "_MSRSTRT.EXE" 35 items found: 28 files (1 H/S), 7 directories (5 H/S). Total of file sizes: 967.262 bytes 944,59 K -------------------------------------------------------------------------- C:\WINDOWS\Downloaded Program Files: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\Downloaded Program Files\ within the last 90 days. No matches found. -------------------------------------------------------------------------- C:\WINDOWS\PCHealth\HelpCtr\Binaries: -------------------------------------------------------------------------- Locating all files in C:\WINDOWS\PCHealth\HelpCtr\Binaries "C:\WINDOWS\pchealth\helpctr\binaries\" brpinfo.dll 28 Oct 2001 21504 "brpinfo.dll" hcappres.dll 28 Oct 2001 7168 "HCAppRes.dll" helpctr.exe 13 Apr 2008 769024 "helpctr.exe" helphost.exe 28 Oct 2001 99840 "HelpHost.exe" helpsvc.exe 13 Apr 2008 744448 "helpsvc.exe" hscsp_w3.cab 17 Jul 2004 324700 "hscsp_w3.cab" hscupd.exe 13 Apr 2008 18432 "hscupd.exe" msconfig.exe 13 Apr 2008 171520 "msconfig.exe" msinfo.dll 13 Apr 2008 381440 "msinfo.dll" notiflag.exe 28 Oct 2001 35328 "notiflag.exe" pchdt_w3.cab 4 Aug 2004 2768982 "pchdt_w3.cab" pchshell.dll 13 Apr 2008 102912 "pchshell.dll" pchsvc.dll 13 Apr 2008 38400 "pchsvc.dll" 13 items found: 13 files, 0 directories. Total of file sizes: 5.483.698 bytes 5,23 M -------------------------------------------------------------------------- C:\WINDOWS\system: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system within the last 90 days. No matches found. -------------------------------------------------------------------------- C:\WINDOWS\system32: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32 within the last 90 days. "C:\WINDOWS\system32\" 8104297.jun 13 Sep 2008 0 "8104297.jun" admparse.dll 22 Aug 2008 72704 "admparse.dll" advpack.dll 22 Aug 2008 128512 "advpack.dll" amcompat.tlb 23 Aug 2008 16832 "amcompat.tlb" corpol.dll 22 Aug 2008 18944 "corpol.dll" dns-sd.exe 29 Aug 2008 87336 "dns-sd.exe" dnssd.dll 29 Aug 2008 61440 "dnssd.dll" dxtmsft.dll 22 Aug 2008 346624 "dxtmsft.dll" dxtrans.dll 22 Aug 2008 217088 "dxtrans.dll" FILT 13 Oct 2008 "Filt" fntcache.dat 16 Oct 2008 140440 "FNTCACHE.DAT" gphotos.scr 10 Nov 2008 2306113 "GPhotos.scr" icardie.dll 22 Aug 2008 61952 "icardie.dll" ie4uinit.exe 22 Aug 2008 162304 "ie4uinit.exe" ieakeng.dll 22 Aug 2008 124928 "ieakeng.dll" ieaksie.dll 22 Aug 2008 228864 "ieaksie.dll" ieakui.dll 22 Aug 2008 163840 "ieakui.dll" ieapfltr.dll 22 Aug 2008 443392 "ieapfltr.dll" iedkcs32.dll 22 Aug 2008 385024 "iedkcs32.dll" ieframe.dll 22 Aug 2008 11985408 "ieframe.dll" iepeers.dll 22 Aug 2008 186880 "iepeers.dll" iernonce.dll 22 Aug 2008 55808 "iernonce.dll" iertutil.dll 22 Aug 2008 1778688 "iertutil.dll" iesetup.dll 22 Aug 2008 71680 "iesetup.dll" ieudinit.exe 22 Aug 2008 36864 "ieudinit.exe" ieui.dll 22 Aug 2008 181760 "ieui.dll" ieuinit.inf 22 Aug 2008 56413 "ieuinit.inf" imgutil.dll 22 Aug 2008 35840 "imgutil.dll" inetcpl.cpl 22 Aug 2008 1415680 "inetcpl.cpl" inseng.dll 22 Aug 2008 94720 "inseng.dll" IOSUBSYS 4 Sep 2008 "IOSUBSYS" jscript.dll 22 Aug 2008 552960 "jscript.dll" jsproxy.dll 22 Aug 2008 28672 "jsproxy.dll" keystone.exe 17 Sep 2008 436768 "keystone.exe" licmgr10.dll 22 Aug 2008 43008 "licmgr10.dll" LOGFILES 23 Aug 2008 "LogFiles" mrt.exe 3 Nov 2008 17318336 "MRT.exe" msfeeds.dll 22 Aug 2008 580608 "msfeeds.dll" mshta.exe 22 Aug 2008 45568 "mshta.exe" mshtml.dll 22 Aug 2008 5699584 "mshtml.dll" mshtml.tlb 22 Aug 2008 1659392 "mshtml.tlb" mshtmled.dll 22 Aug 2008 70656 "mshtmled.dll" mshtmler.dll 22 Aug 2008 48128 "mshtmler.dll" msls31.dll 22 Aug 2008 156160 "msls31.dll" msrating.dll 22 Aug 2008 193536 "msrating.dll" mstime.dll 22 Aug 2008 630272 "mstime.dll" msxml3.dll 4 Sep 2008 1106944 "msxml3.dll" msxml4.dll 30 Sep 2008 1286152 "msxml4.dll" msxml6.dll 9 Sep 2008 1307648 "msxml6.dll" netapi32.dll 15 Oct 2008 337408 "netapi32.dll" nscompat.tlb 23 Aug 2008 23392 "nscompat.tlb" nv4_disp.dll 17 Sep 2008 6057472 "nv4_disp.dll" nvapi.dll 17 Sep 2008 475136 "nvapi.dll" nvappbar.exe 17 Sep 2008 449056 "nvappbar.exe" nvapps.xml 18 Nov 2008 196060 "nvapps.xml" nvcod.dll 17 Sep 2008 122880 "nvcod.dll" nvcodins.dll 17 Sep 2008 122880 "nvcodins.dll" nvcolor.exe 17 Sep 2008 143360 "nvcolor.exe" nvcpl.cpl 17 Sep 2008 420384 "nvcpl.cpl" nvcpl.dll 17 Sep 2008 13574144 "nvcpl.dll" nvcplui.exe 17 Sep 2008 797216 "nvcplui.exe" nvcpluir.dll 17 Sep 2008 1108512 "nvcpluir.dll" nvcuda.dll 17 Sep 2008 1368064 "nvcuda.dll" nvdisp.nvu 17 Sep 2008 18394 "nvdisp.nvu" nvdisps.dll 17 Sep 2008 3989504 "nvdisps.dll" nvdispsr.dll 17 Sep 2008 5799936 "nvdispsr.dll" nvdspsch.exe 17 Sep 2008 1346080 "nvdspsch.exe" nvgames.dll 17 Sep 2008 3444736 "nvgames.dll" nvgamesr.dll 17 Sep 2008 3457024 "nvgamesr.dll" nview.dll 17 Sep 2008 1503232 "nview.dll" nvmccs.dll 17 Sep 2008 229376 "nvmccs.dll" nvmccsrs.dll 17 Sep 2008 45056 "nvmccsrs.dll" nvmccss.dll 17 Sep 2008 188416 "nvmccss.dll" nvmccssr.dll 17 Sep 2008 458752 "nvmccssr.dll" nvmctray.dll 17 Sep 2008 86016 "nvmctray.dll" nvmobls.dll 17 Sep 2008 1257472 "nvmobls.dll" nvmoblsr.dll 17 Sep 2008 2854912 "nvmoblsr.dll" nvnt4cpl.dll 17 Sep 2008 286720 "nvnt4cpl.dll" nvoglnt.dll 17 Sep 2008 8826880 "nvoglnt.dll" nvrsar.dll 17 Sep 2008 331776 "nvrsar.dll" nvrscs.dll 17 Sep 2008 245760 "nvrscs.dll" nvrsda.dll 17 Sep 2008 253952 "nvrsda.dll" nvrsde.dll 17 Sep 2008 278528 "nvrsde.dll" nvrsel.dll 17 Sep 2008 282624 "nvrsel.dll" nvrseng.dll 17 Sep 2008 245760 "nvrseng.dll" nvrses.dll 17 Sep 2008 282624 "nvrses.dll" nvrsesm.dll 17 Sep 2008 274432 "nvrsesm.dll" nvrsfi.dll 17 Sep 2008 249856 "nvrsfi.dll" nvrsfr.dll 17 Sep 2008 282624 "nvrsfr.dll" nvrshe.dll 17 Sep 2008 331776 "nvrshe.dll" nvrshu.dll 17 Sep 2008 258048 "nvrshu.dll" nvrsit.dll 17 Sep 2008 278528 "nvrsit.dll" nvrsja.dll 17 Sep 2008 270336 "nvrsja.dll" nvrsko.dll 17 Sep 2008 262144 "nvrsko.dll" nvrsnl.dll 17 Sep 2008 274432 "nvrsnl.dll" nvrsno.dll 17 Sep 2008 253952 "nvrsno.dll" nvrspl.dll 17 Sep 2008 253952 "nvrspl.dll" nvrspt.dll 17 Sep 2008 270336 "nvrspt.dll" nvrsptb.dll 17 Sep 2008 266240 "nvrsptb.dll" nvrsru.dll 17 Sep 2008 266240 "nvrsru.dll" nvrssk.dll 17 Sep 2008 258048 "nvrssk.dll" nvrssl.dll 17 Sep 2008 258048 "nvrssl.dll" nvrssv.dll 17 Sep 2008 253952 "nvrssv.dll" nvrsth.dll 17 Sep 2008 253952 "nvrsth.dll" nvrstr.dll 17 Sep 2008 253952 "nvrstr.dll" nvrszhc.dll 17 Sep 2008 225280 "nvrszhc.dll" nvrszht.dll 17 Sep 2008 122880 "nvrszht.dll" nvshell.dll 17 Sep 2008 466944 "nvshell.dll" nvsvc32.exe 17 Sep 2008 163908 "nvsvc32.exe" nvtuicpl.cpl 17 Sep 2008 73728 "nvtuicpl.cpl" nvudisp.exe 17 Sep 2008 453152 "nvudisp.exe" nvuninst.exe 17 Sep 2008 453152 "NVUNINST.EXE" nvvitvs.dll 17 Sep 2008 3764224 "nvvitvs.dll" nvvitvsr.dll 17 Sep 2008 4149248 "nvvitvsr.dll" nvwddi.dll 17 Sep 2008 81920 "nvwddi.dll" nvwdmcpl.dll 17 Sep 2008 1724416 "nvwdmcpl.dll" nvwimg.dll 17 Sep 2008 1101824 "nvwimg.dll" nvwrsar.dll 17 Sep 2008 282624 "nvwrsar.dll" nvwrscs.dll 17 Sep 2008 286720 "nvwrscs.dll" nvwrsda.dll 17 Sep 2008 294912 "nvwrsda.dll" nvwrsde.dll 17 Sep 2008 311296 "nvwrsde.dll" nvwrsel.dll 17 Sep 2008 335872 "nvwrsel.dll" nvwrseng.dll 17 Sep 2008 286720 "nvwrseng.dll" nvwrses.dll 17 Sep 2008 335872 "nvwrses.dll" nvwrsesm.dll 17 Sep 2008 327680 "nvwrsesm.dll" nvwrsfi.dll 17 Sep 2008 303104 "nvwrsfi.dll" nvwrsfr.dll 17 Sep 2008 327680 "nvwrsfr.dll" nvwrshe.dll 17 Sep 2008 278528 "nvwrshe.dll" nvwrshu.dll 17 Sep 2008 315392 "nvwrshu.dll" nvwrsit.dll 17 Sep 2008 323584 "nvwrsit.dll" nvwrsja.dll 17 Sep 2008 212992 "nvwrsja.dll" nvwrsko.dll 17 Sep 2008 196608 "nvwrsko.dll" nvwrsnl.dll 17 Sep 2008 319488 "nvwrsnl.dll" nvwrsno.dll 17 Sep 2008 299008 "nvwrsno.dll" nvwrspl.dll 17 Sep 2008 294912 "nvwrspl.dll" nvwrspt.dll 17 Sep 2008 323584 "nvwrspt.dll" nvwrsptb.dll 17 Sep 2008 319488 "nvwrsptb.dll" nvwrsru.dll 17 Sep 2008 315392 "nvwrsru.dll" nvwrssk.dll 17 Sep 2008 299008 "nvwrssk.dll" nvwrssl.dll 17 Sep 2008 303104 "nvwrssl.dll" nvwrssv.dll 17 Sep 2008 294912 "nvwrssv.dll" nvwrsth.dll 17 Sep 2008 290816 "nvwrsth.dll" nvwrstr.dll 17 Sep 2008 303104 "nvwrstr.dll" nvwrszhc.dll 17 Sep 2008 163840 "nvwrszhc.dll" nvwrszht.dll 17 Sep 2008 167936 "nvwrszht.dll" nvwss.dll 17 Sep 2008 2686976 "nvwss.dll" nvwssr.dll 17 Sep 2008 2981888 "nvwssr.dll" nwiz.exe 17 Sep 2008 1657376 "nwiz.exe" occache.dll 22 Aug 2008 116224 "occache.dll" perfc009.dat 16 Oct 2008 72230 "perfc009.dat" perfc016.dat 16 Oct 2008 81062 "perfc016.dat" perfh009.dat 16 Oct 2008 444224 "perfh009.dat" perfh016.dat 16 Oct 2008 477228 "perfh016.dat" perfst~1.ini 16 Oct 2008 1088148 "PerfStringBackup.INI" pid.pnf 23 Aug 2008 4444 "pid.PNF" pngfilt.dll 22 Aug 2008 45056 "pngfilt.dll" privacie.dll 22 Aug 2008 48640 "PrivacIE.dll" sirenacm.dll 9 Sep 2008 51712 "sirenacm.dll" tdc.ocx 22 Aug 2008 66560 "tdc.ocx" url.dll 22 Aug 2008 105984 "url.dll" urlmon.dll 22 Aug 2008 1206784 "urlmon.dll" URTTEMP 23 Aug 2008 "URTTEMP" vbscript.dll 22 Aug 2008 434176 "vbscript.dll" webcheck.dll 22 Aug 2008 236544 "webcheck.dll" wgalogon.dll 5 Sep 2008 267304 "WgaLogon.dll" wgatray.exe 5 Sep 2008 951336 "WgaTray.exe" win32k.sys 15 Sep 2008 1846528 "win32k.sys" wininet.dll 22 Aug 2008 878592 "wininet.dll" wpa.dbl 18 Nov 2008 2262 "wpa.dbl" 169 items found: 165 files, 4 directories. Total of file sizes: 154.656.942 bytes 147,49 M -------------------------------------------------------------------------- C:\WINDOWS\system32\com: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\com within the last 90 days. No matches found. -------------------------------------------------------------------------- C:\WINDOWS\system32\components: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\components within the last 90 days. No matches found. -------------------------------------------------------------------------- C:\WINDOWS\system32\drivers: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\drivers within the last 90 days. "C:\WINDOWS\system32\drivers\" fidbox.dat 18 Nov 2008 3541024 "fidbox.dat" fidbox.idx 18 Nov 2008 28744 "fidbox.idx" fidbox2.dat 18 Nov 2008 786464 "fidbox2.dat" fidbox2.idx 18 Nov 2008 3768 "fidbox2.idx" iksysflt.sys 25 Aug 2008 66952 "iksysflt.sys" iksyssec.sys 25 Aug 2008 81288 "iksyssec.sys" isdrv122.sys 30 Oct 2008 211893 "IsDrv122.sys" klick.dat 13 Oct 2008 87855 "klick.dat" klif.sys 13 Oct 2008 213008 "klif.sys" klin.dat 13 Oct 2008 96976 "klin.dat" mrxsmb.sys 24 Oct 2008 455296 "mrxsmb.sys" nv4_mini.sys 17 Sep 2008 6132576 "nv4_mini.sys" pctfw2.sys 13 Oct 2008 160792 "pctfw2.sys" srv.sys 8 Sep 2008 333824 "srv.sys" tffsmon.sys 13 Oct 2008 51520 "TfFsMon.sys" tfkbmon.sys 13 Oct 2008 12608 "TfKbMon.sys" tfnetmon.sys 13 Oct 2008 33088 "TfNetMon.sys" tfsysmon.sys 13 Oct 2008 38208 "TfSysMon.sys" UMDF 23 Aug 2008 "UMDF" 19 items found: 18 files (4 H/S), 1 directory. Total of file sizes: 12.335.884 bytes 11,76 M -------------------------------------------------------------------------- C:\WINDOWS\system32\drivers\etc: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\system32\drivers\etc within the last 90 days. "C:\WINDOWS\system32\drivers\etc\" hosts 4 Nov 2008 27 "hosts" hosts.bak 28 Aug 2008 259274 "HOSTS.bak" 2 items found: 2 files, 0 directories. Total of file sizes: 259.301 bytes 253,22 K -------------------------------------------------------------------------- C:\WINDOWS\TEMP: -------------------------------------------------------------------------- Locating all files created in C:\WINDOWS\TEMP within the last 90 days. "C:\WINDOWS\Temp\" cch~1a~2.htp 15 Nov 2008 8192 "cch~1a84f058.htp" cch~1a~3.htp 15 Nov 2008 8192 "cch~1a850303.htp" cch~1c~2.htp 14 Nov 2008 8192 "cch~1c14140c.htp" cch~1c~3.htp 14 Nov 2008 8192 "cch~1c142ad2.htp" cch~f7~2.htp 15 Nov 2008 8192 "cch~f76e95b9c.htp" cch~f7~3.htp 15 Nov 2008 8192 "cch~f76e9740c.htp" NSE2F.TMP 12 Nov 2008 "nse2F.tmp" sdb2e.tmp 18 Nov 2008 0 "sdb2E.tmp" sdb42.tmp 13 Nov 2008 0 "sdb42.tmp" sdb6b.tmp 14 Nov 2008 0 "sdb6B.tmp" sdba9.tmp 12 Nov 2008 0 "sdbA9.tmp" testtime.tmp 18 Nov 2008 4 "testtime.tmp" wgaerr~1.txt 18 Nov 2008 483 "WGAErrLog.txt" 13 items found: 12 files, 1 directory. Total of file sizes: 49.639 bytes 48,47 K ************************************************************************************ Checking for .COM files to Delete. They will only print if deleted! Locating .COM files in the C:\WINDOWS\System32 folder "C:\WINDOWS\system32\" chcp.com 28 Oct 2001 7680 "chcp.com" command.com 28 Oct 2001 52472 "command.com" diskcomp.com 28 Oct 2001 9216 "diskcomp.com" diskcopy.com 28 Oct 2001 7168 "diskcopy.com" edit.com 28 Oct 2001 70750 "edit.com" format.com 13 Apr 2008 29696 "format.com" graftabl.com 28 Oct 2001 26112 "graftabl.com" graphics.com 28 Oct 2001 19918 "graphics.com" kb16.com 28 Oct 2001 14950 "kb16.com" loadfix.com 28 Oct 2001 1153 "loadfix.com" locate.com 14 Jan 2005 11254 "locate.com" mode.com 28 Oct 2001 19456 "mode.com" more.com 13 Apr 2008 16896 "more.com" tree.com 13 Apr 2008 12800 "tree.com" win.com 28 Oct 2001 18432 "win.com" 15 items found: 15 files, 0 directories. Total of file sizes: 317.953 bytes 310,50 K ************************************************************************************ Miscellaneous Malware Detections: ------------------------------------------------------------------------------------ **** Delfin Media {31EE3286-D785-4E3F-95FC-51D00FDABC01} NOT FOUND by this tool! **** **** SmitFraud {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! **** **** SpywareStrike {C1A2FDA2-1A5B-2A8F-F3A2-B22DA1A3C41D} NOT FOUND by this tool! **** **** SpywareStrike {C1A2FDA2-2A5B-2C8A-F2A2-BA2DB3A2C31C} NOT FOUND by this tool! **** **** SpywareStrike {D81E2FC4-B0A2-11D3-21AC-07C04C21A18A} NOT FOUND by this tool! **** **** SpyAxe {A1D9D3F0-8C2A-9A1D-A376-2CACFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72} NOT FOUND by this tool! **** **** SpyAxe {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! **** **** SpyFalcon {A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F} NOT FOUND by this tool! **** **** SpyFalcon {C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D} NOT FOUND by this tool! **** **** SpyFalcon {CA14EE13-ED15-C4A2-17FF-DA4D15C1BC5E} NOT FOUND by this tool! **** **** SpyFalcon {35a88e51-b53d-43e9-b8a7-75d4c31b4676} NOT FOUND by this tool! **** **** SpyFalcon {64ba30a2-811a-4597-b0af-d551128be340} NOT FOUND by this tool! **** **** SpyFalcon {89aef01d-d237-49c7-84dc-4e1904c1fd31} NOT FOUND by this tool! **** **** SpyFalcon {e04408db-4812-4478-8d4d-e46edcffd3b6} NOT FOUND by this tool! **** **** SpyFalcon {336ec37f-54bf-4f13-8237-03f64fa591e7} NOT FOUND by this tool! **** **** SpyFalcon {5bc82bdb-bc03-4671-9a78-3ef2b68449de} NOT FOUND by this tool! **** **** SpyFalcon {24c60b9b-26b5-4201-9f7a-fb9219356ae9} NOT FOUND by this tool! **** **** SpyFalcon {a0c51615-738a-4542-801a-5af61614e182} NOT FOUND by this tool! **** **** SpyFalcon {70fbd528-2d3c-4a00-9b8c-bbf441e534be} NOT FOUND by this tool! **** **** SpyFalcon {a566f298-05a6-4b3d-b672-da7c27316430} NOT FOUND by this tool! **** **** SpyFalcon {f5947202-e9cb-4a72-88e7-22f2cbd2b124} NOT FOUND by this tool! **** **** SpyFalcon {5aaf6542-f4ba-4df4-873d-4902ecbe794c} NOT FOUND by this tool! **** **** SpyFalcon {3e4155b8-5a4a-4e95-83b2-ab032da9acbc} NOT FOUND by this tool! **** **** SpyFalcon {9952355f-fefb-4764-bcd7-a993d03dd7e2} NOT FOUND by this tool! **** **** SpyFalcon {55059d4f-a1ac-4837-ae07-4859101f598d} NOT FOUND by this tool! **** **** SpyFalcon {c3786a8d-6426-4c29-a23f-f36e47b31e0c} NOT FOUND by this tool! **** **** SpyLocked {25b7d2fd-4f71-46d1-801a-7de323e4ec82} NOT FOUND by this tool! **** **** SpyLocked {4233AC08-A2C4-4742-A0B4-83719613D62C} NOT FOUND by this tool! **** **** SpyLocked {716002DB-288C-4BF0-80CD-A467E78D8B55} NOT FOUND by this tool! **** **** SpyLocked {735E980D-45D2-4777-AF82-9923D3C8D3AE} NOT FOUND by this tool! **** **** SpyLocked {B23DC537-3E13-44C7-BF67-D8405EB377F7} NOT FOUND by this tool! **** **** SpyLocked {B292EC9F-A074-4115-8342-1F459702D8D2} NOT FOUND by this tool! **** **** SpyLocked {CECA6F2B-247B-4ECE-9B7A-D0135C8036FC} NOT FOUND by this tool! **** **** SpyLocked {DA3B49F6-8C54-4429-A275-21A86DCCA413} NOT FOUND by this tool! **** **** SpyLocked {EDE8BED5-92CF-4482-8F51-A01CD9B3EA37} NOT FOUND by this tool! **** **** SpyLocked {FA4FBF53-C766-4622-8011-A87A805EEBF0} NOT FOUND by this tool! **** **** SpywareLocked {0E4E5110-A772-4C4A-A7DC-137FE10ABD6E} NOT FOUND by this tool! **** **** SpywareLocked {07A582E8-BAE3-457D-9D29-2048DE45A369} NOT FOUND by this tool! **** **** SpywareLocked {3BAA1AD8-EE49-4772-BF0B-F55083E0F7AA} NOT FOUND by this tool! **** **** SpywareLocked {9D6FAC42-A7BE-4702-87EF-75D8DC14249E} NOT FOUND by this tool! **** **** SpywareLocked {ABEF791F-947E-4CDF-83C3-E72A240AFB67} NOT FOUND by this tool! **** **** SpywareLocked {BD0FC212-0A36-4232-83CC-2063FB9282E0} NOT FOUND by this tool! **** **** SpywareLocked {B0DED443-5E68-4001-A81B-0A0001621AB8} NOT FOUND by this tool! **** **** SpywareLocked {F38B1B2B-4976-46DD-9FE5-60FDE72F0B4D} NOT FOUND by this tool! **** **** SpywareQuake {0c7416f0-dd23-420f-97f5-aae352ea2bf1} NOT FOUND by this tool! **** **** SpywareQuake {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} NOT FOUND by this tool! **** **** SpywareQuake {AC1B4DA2-12FA-31F2-1A7D-CD2B14E6AD4E} NOT FOUND by this tool! **** **** SpywareQuake {CD5E2AC9-25CE-A1C5-D1E2-DC6B28A6ED5A} NOT FOUND by this tool! **** **** SpywareQuake {EA26CE12-DE64-A1C5-9A4F-FC1A64E6AC2E} NOT FOUND by this tool! **** **** SpywareQuake {e5b1e382-817e-4b74-8a96-ec78751e6acf} NOT FOUND by this tool! **** **** SpywareQuake {a0aa3e4b-31cb-4ea2-9049-22b7f5b65edb} NOT FOUND by this tool! **** **** SpywareQuake {cbb430e6-5b1b-474a-9d7e-160d4fe74bea} NOT FOUND by this tool! **** **** SpywareQuake {62eb0924-19d2-4226-b4b9-8ad1f70904c1} NOT FOUND by this tool! **** **** SpywareQuake {6c69e319-0d03-47da-997a-36586cbc53b3} NOT FOUND by this tool! **** **** SpywareQuake {aea3d2df-2b2c-4d7b-81a0-d975c6dc088e} NOT FOUND by this tool! **** **** SpywareSheriff {1C3B31AE-FD16-D2CE-43FF-DC4CD5C1BC5E} NOT FOUND by this tool! **** **** VirusBurster {9d635a36-6b3c-4146-8625-f3aaf507bbf8} NOT FOUND by this tool! **** **** TrustCleaner {24E27EA9-FCF3-444F-BD80-20543BA5D946} NOT FOUND by this tool! **** **** Troj/Small-ER {4F141CBA-1457-6CCA-03A7-7AA21B61EA0F} NOT FOUND by this tool! **** **** Troj/Spabot-E {429F4BB8-7BF7-4152-8011-3C6F9EB7E892} NOT FOUND by this tool! **** **** Troj/Dloader-OF {203B1C4D9-BC71-8916-38AD-9DEA5D213614} NOT FOUND by this tool! **** **** Troj/Crafted-A {0BC9BC01-54D4-4CCE-2B7D-955164314CD4} NOT FOUND by this tool! **** **** Troj/Agent-FG {2C1CD3D7-86AC-4068-93BC-A02304BB8C34} NOT FOUND by this tool! **** **** TX 4 BrowserAd adware {8e99f990-b75a-4568-b3c8-24cbc8cbbfc1} NOT FOUND by this tool! **** **** Trojan-Proxy.Win32.Small {87A3E824-A726-4CF4-8A66-6314B11BDA0C} NOT FOUND by this tool! **** **** Trojan-Downloader.Win32.Delf.ks {786C369D-409A-456f-A13C-971EADA850C6} NOT FOUND by this tool! **** **** W32/Almanahe.a Worm NOT FOUND by this tool! **** **** msctl32.dll SpamBot NOT FOUND by this tool! **** **** KeyLogger NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR BOT-TYPE WORMS: -------------------------------------------------------------------------- **** W32/Sdbot Worm NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR KNOWN ROOTKIT STEALTHING AGENTS: -------------------------------------------------------------------------- **** i386p.* Stealthing Agent NOT FOUND by this tool! **** **** ErrorSafe erssdd.* Stealthing Agent NOT FOUND by this tool! **** **** VUNDO DP.* Stealthing Agent NOT FOUND by this tool! **** **** Troj/NTRootK-BP main.* Stealthing Agent NOT FOUND by this tool! **** **** W32/Almanahe.sys RioDrvrs.* Stealthing Agent NOT FOUND by this tool! **** **** W32/Almanahe.sys DKIS6.* Stealthing Agent NOT FOUND by this tool! **** -------------------------------------------------------------------------- CHECKING FOR VISIBLE ROOTKIT-TYPE REGISTRY KEYS: -------------------------------------------------------------------------- **** Rustock.B trojan, PE386 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, huy32 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, lzx32 rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, msguard rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, xpdt.sy_ rootkit NOT FOUND by this tool! **** **** Rustock.B trojan, xpdt.sys rootkit NOT FOUND by this tool! **** **** CmdService adware NOT FOUND by this tool! **** **** Network_Monitor adware NOT FOUND by this tool! **** **** Trojan.Peacomm NOT FOUND by this tool! **** **** Trojan.Peacomm windev NOT FOUND by this tool! **** **** AVPE Haxdoor NOT FOUND by this tool! **** **** MEMLOW Haxdoor NOT FOUND by this tool! **** **** VDMT Haxdoor NOT FOUND by this tool! **** **** YCSVGA Haxdoor NOT FOUND by this tool! **** **** PPTP Haxdoor FOUND by this tool! **** CAREFULL HERE THIS WILL ALSO FIND WinLanMiniport DisplayName REG_SZ Miniporta de rede remota (PPTP) Description REG_SZ Miniporta de rede remota (PPTP) DisplayName REG_SZ Miniporta de rede remota (PPTP) Description REG_SZ Miniporta de rede remota (PPTP) DisplayName REG_SZ Miniporta de rede remota (PPTP) Description REG_SZ Miniporta de rede remota (PPTP) **** DVB Haxdoor NOT FOUND by this tool! **** **** YVBB Haxdoor NOT FOUND by this tool! **** **** YVPP Haxdoor NOT FOUND by this tool! **** **** NKGFS Haxdoor NOT FOUND by this tool! **** **** XMSK Haxdoor NOT FOUND by this tool! **** **** AVPX Haxdoor NOT FOUND by this tool! **** **** MMXF Haxdoor NOT FOUND by this tool! **** **** DP1112 Vundo Rootkit NOT FOUND by this tool! **** **** SYSBUS32 Rootkit Driver NOT FOUND by this tool! **** **** I386P Rootkit Driver NOT FOUND by this tool! **** **** ERSSDD Rootkit NOT FOUND by this tool! **** **** GencTurK RootKit NOT FOUND by this tool! **** **** Troj/NTRootK-BP RootKit NOT FOUND by this tool! **** **** W32/Almanahe.sys NOT FOUND by this tool! **** ************************************************************************************ Dumping HKLM Uninstall Programs list DisplayName REG_SZ DisplayName REG_SZ a-squared Free 3.5 DisplayName REG_SZ Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) DisplayName REG_SZ Adobe Flash Player 10 Plugin DisplayName REG_SZ Adobe Flash Player ActiveX DisplayName REG_SZ Adobe Reader 8.1.2 - Portugus DisplayName REG_SZ Age of Empires III DisplayName REG_SZ Age of Empires III DisplayName REG_SZ Age of Empires III - The Asian Dynasties DisplayName REG_SZ Age of Empires III - The Asian Dynasties DisplayName REG_SZ Age of Empires III - The WarChiefs DisplayName REG_SZ Age of Empires III - The WarChiefs DisplayName REG_SZ Age of Mythology DisplayName REG_SZ Agnitum Outpost Firewall Pro DisplayName REG_SZ AMD Processor Driver DisplayName REG_SZ Apple Mobile Device Support DisplayName REG_SZ Apple Software Update DisplayName REG_SZ Arquivo do WinRAR DisplayName REG_SZ Assistente de Conexo do Windows Live DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player (KB911564) DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player 10 (KB936782) DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player 11 (KB936782) DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player 11 (KB954154) DisplayName REG_SZ Atualizao de Segurana para o Windows Media Player 9 (KB936782) DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB938127) DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB944533) DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB950759) DisplayName REG_SZ Atualizao de Segurana para Windows Internet Explorer 7 (KB953838) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB938464) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB941569) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB946648) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB950760) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB950762) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB950974) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951066) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951376-v2) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951376) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951698) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB951748) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB952954) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB953839) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB954211) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB954459) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB955069) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB956391) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB956803) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB956841) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB957095) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB957097) DisplayName REG_SZ Atualizao de Segurana para Windows XP (KB958644) DisplayName REG_SZ Atualizao para o Windows XP (KB943729) DisplayName REG_SZ Atualizao para Windows XP (KB951072-v2) DisplayName REG_SZ Atualizao para Windows XP (KB951618-v2) DisplayName REG_SZ Atualizao para Windows XP (KB951978) DisplayName REG_SZ AVG Anti-Rootkit Free DisplayName REG_SZ AVG Anti-Spyware 7.5 DisplayName REG_SZ BitComet 1.03 DisplayName REG_SZ Bonjour DisplayName REG_SZ CCleaner (remove only) DisplayName REG_SZ CCScore DisplayName REG_SZ Choice Guard DisplayName REG_SZ Company of Heroes DisplayName REG_SZ Contacts DisplayName REG_SZ Diablo II DisplayName REG_SZ Dual-Core Optimizer DisplayName REG_SZ eMule DisplayName REG_SZ ESSBrwr DisplayName REG_SZ ESSCDBK DisplayName REG_SZ ESScore DisplayName REG_SZ ESSgui DisplayName REG_SZ ESSini DisplayName REG_SZ ESSPCD DisplayName REG_SZ ESSPDock DisplayName REG_SZ ESSSONIC DisplayName REG_SZ ESSTOOLS DisplayName REG_SZ essvatgt DisplayName REG_SZ fflink DisplayName REG_SZ Google Earth DisplayName REG_SZ High Definition Audio Driver Package - KB888111 DisplayName REG_SZ Hotfix for Windows Media Format 11 SDK (KB929399) DisplayName REG_SZ Hotfix for Windows XP (KB915800-v4) DisplayName REG_SZ Hotfix para o Windows Media Player 11 (KB939683) DisplayName REG_SZ Hotfix para Windows Internet Explorer 7 (KB947864) DisplayName REG_SZ Hotfix para Windows XP (KB952287) DisplayName REG_SZ iTunes DisplayName REG_SZ Java(TM) 6 Update 5 DisplayName REG_SZ Java(TM) 6 Update 7 DisplayName REG_SZ K-Lite Mega Codec Pack 3.9.0 DisplayName REG_SZ Kaspersky Anti-Virus 2009 DisplayName REG_SZ Kaspersky Anti-Virus 2009 DisplayName REG_SZ kgcbaby DisplayName REG_SZ kgcbase DisplayName REG_SZ kgchday DisplayName REG_SZ kgchlwn DisplayName REG_SZ kgcinvt DisplayName REG_SZ kgckids DisplayName REG_SZ kgcmove DisplayName REG_SZ kgcvday DisplayName REG_SZ LimeWire 4.18.8 DisplayName REG_SZ Microsoft .NET Framework 1.1 DisplayName REG_SZ Microsoft .NET Framework 1.1 DisplayName REG_SZ Microsoft .NET Framework 1.1 Brazilian Portuguese Language Pack DisplayName REG_SZ Microsoft .NET Framework 1.1 Hotfix (KB928366) DisplayName REG_SZ Microsoft .NET Framework 2.0 Language Pack - PTB DisplayName REG_SZ Microsoft .NET Framework 2.0 Language Pack - PTB DisplayName REG_SZ Microsoft .NET Framework 2.0 Service Pack 1 DisplayName REG_SZ Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PTB DisplayName REG_SZ Microsoft .NET Framework 3.0 Service Pack 1 DisplayName REG_SZ Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PTB DisplayName REG_SZ Microsoft .NET Framework 3.5 DisplayName REG_SZ Microsoft .NET Framework 3.5 DisplayName REG_SZ Microsoft .NET Framework 3.5 Language Pack - ptb DisplayName REG_SZ Microsoft .NET Framework 3.5 Language Pack - ptb DisplayName REG_SZ Microsoft Application Error Reporting DisplayName REG_SZ Microsoft Compression Client Pack 1.0 for Windows XP DisplayName REG_SZ Microsoft Internationalized Domain Names Mitigation APIs DisplayName REG_SZ Microsoft National Language Support Downlevel APIs DisplayName REG_SZ Microsoft Office Professional Edio 2003 DisplayName REG_SZ Microsoft Silverlight DisplayName REG_SZ Microsoft SQL Server 2005 Compact Edition [ENU] DisplayName REG_SZ Microsoft User-Mode Driver Framework Feature Pack 1.0 DisplayName REG_SZ Microsoft Visual C Runtime DisplayName REG_SZ Microsoft Visual C++ 2005 Redistributable DisplayName REG_SZ Mozilla Firefox (3.0.4) DisplayName REG_SZ MSVCRT DisplayName REG_SZ MSXML 4.0 SP2 (KB936181) DisplayName REG_SZ MSXML 4.0 SP2 (KB954430) DisplayName REG_SZ MSXML 4.0 SP2 Parser and SDK DisplayName REG_SZ MSXML 6.0 Parser (KB933579) DisplayName REG_SZ MSXML4 Parser DisplayName REG_SZ Multimedia Launcher DisplayName REG_SZ MV AntiSpy 4.0 DisplayName REG_SZ MV RegClean 5.5 DisplayName REG_SZ Nero 7 Essentials DisplayName REG_SZ neroxml DisplayName REG_SZ netbrdg DisplayName REG_SZ Nuclear Coffee - VideoGet DisplayName REG_SZ NVIDIA Drivers DisplayName REG_SZ OfotoXMI DisplayName REG_SZ Opera 9.62 DisplayName REG_SZ Picasa 3 DisplayName REG_SZ PowerDVD DisplayName REG_SZ QuickTime DisplayName REG_SZ RealPlayer DisplayName REG_SZ Realtek High Definition Audio Driver DisplayName REG_SZ Rome - Total War(TM) DisplayName REG_SZ Rome - Total War(TM) DisplayName REG_SZ Rome Total War - patch 1.3 DisplayName REG_SZ Segoe UI DisplayName REG_SZ SFR DisplayName REG_SZ SHASTA DisplayName REG_SZ skin0001 DisplayName REG_SZ SKINXSDK DisplayName REG_SZ Software Kodak EasyShare DisplayName REG_SZ SONIC ADVENTURE DX-Director's Cut DisplayName REG_SZ SONIC HEROES DisplayName REG_SZ Spyware Doctor 6.0 DisplayName REG_SZ Starcraft DisplayName REG_SZ staticcr DisplayName REG_SZ Stella 2.6.1 DisplayName REG_SZ SUPERAntiSpyware Free Edition DisplayName REG_SZ The Battle for Middle-earth (tm) DisplayName REG_SZ The Battle for Middle-earth (tm) II DisplayName REG_SZ The KMPlayer (remove only) DisplayName REG_SZ Tomb Raider: Legend Demo 1.0 DisplayName REG_SZ tooltips DisplayName REG_SZ TuneUp Utilities 2008 DisplayName REG_SZ UltraISO Premium V9.3 DisplayName REG_SZ VPRINTOL DisplayName REG_SZ WebFldrs XP DisplayName REG_SZ Winamp DisplayName REG_SZ Windows Essentials Media Codec Pack 1.0 DisplayName REG_SZ Windows Imaging Component DisplayName REG_SZ Windows Internet Explorer 8 Beta 2 DisplayName REG_SZ Windows Live Beta (todos os programas) DisplayName REG_SZ Windows Live Beta (todos os programas) DisplayName REG_SZ Windows Live Call DisplayName REG_SZ Windows Live Galeria de Fotos Beta DisplayName REG_SZ Windows Live Mail DisplayName REG_SZ Windows Live Messenger DisplayName REG_SZ Windows Media Format 11 runtime DisplayName REG_SZ Windows Media Format 11 runtime DisplayName REG_SZ Windows Media Player 11 DisplayName REG_SZ Windows Media Player 11 DisplayName REG_SZ Windows Search 4.0 DisplayName REG_SZ Windows XP Service Pack 3 DisplayName REG_SZ WIRELESS DisplayName REG_SZ XML Paper Specification Shared Components Language Pack 1.0 DisplayName REG_SZ XML Paper Specification Shared Components Pack 1.0 DisplayName REG_SZ XP Codec Pack ParentDisplayName REG_SZ ParentDisplayName REG_SZ ParentDisplayName REG_SZ Windows Desktop Search ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software ParentDisplayName REG_SZ Windows Internet Explorer 7 - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Atualizaes de Software ParentDisplayName REG_SZ Windows XP - Software Updates ##################################################################################################### -- All DONE! :) ~ ShadowPuterDude ~