Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

all HDD free space(900 gb) was taken by instaling a game

Started by guimezzadre , Aug 20 2012 06:58 PM

  • Please log in to reply

#1
guimezzadre
Posted 20 August 2012 - 06:58 PM

guimezzadre

    New Member

  • Member
  • Pip
  • 2 posts
Attached File  Extras.Txt   67.67KB   121 downloadsAttached File  OTL.Txt   90.68KB   69 downloads

Here the results of the scam.

OTL logfile created on: 20/08/2012 21:39:50 - Run 1
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\Guri\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy

3,87 Gb Total Physical Memory | 2,03 Gb Available Physical Memory | 52,59% Memory free
7,73 Gb Paging File | 5,53 Gb Available in Paging File | 71,54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 6,16 Gb Free Space | 0,66% Space Free | Partition Type: NTFS

Computer Name: GURI-PC | User Name: Guri | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/20 21:38:36 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Guri\Downloads\OTL.exe
PRC - [2012/08/15 13:49:18 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
PRC - [2012/07/27 17:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/20 20:27:48 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012/07/13 21:13:42 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/05/15 07:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/05/15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2008/01/22 10:13:32 | 001,201,448 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2008/01/22 10:13:20 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/12/19 09:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\Windows\SysWOW64\IoctlSvc.exe


========== Modules (No Company Name) ==========

MOD - [2012/08/15 13:49:17 | 009,465,032 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll
MOD - [2012/07/13 21:14:07 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/05/15 02:21:26 | 000,368,448 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/07/13 22:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012/08/15 20:51:14 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/08/15 13:49:18 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/27 17:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/20 20:27:48 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012/07/19 18:08:04 | 000,738,152 | ---- | M] (Tunngle.net GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2012/07/13 21:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/06/27 12:29:24 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012/05/15 07:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/05/15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Arquivos de Programas\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Arquivos de Programas\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2011/04/01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/03/28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Arquivos de Programas\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 18:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2006/12/19 09:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) [Auto | Running] -- C:\Windows\SysWOW64\IoctlSvc.exe -- (PLFlash DeviceIoControl Service)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/04/18 14:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012/03/01 03:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/06/10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/03/11 03:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 03:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/01/15 13:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010/12/16 19:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010/11/20 10:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 08:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 08:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010/03/23 02:17:06 | 002,061,856 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTL85n64.sys -- (RTL85n64)
DRV:64bit: - [2009/09/17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009/09/16 08:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t)
DRV:64bit: - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/03/18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.br/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://br.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pt-BR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE 40 1C 81 8F 66 CD 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylo...00000ff57a741d5
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{9FB24F17-15CD-45CA-BE9C-A66C89B656AD}: "URL" = http://www.google.co...ie=utf8&oe=utf8
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..keyword.URL: "http://search.babylo...st&babTrack&q="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll (OnLive)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Guri\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/20 13:42:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/17 07:31:45 | 000,000,000 | ---D | M]

[2012/07/20 13:42:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Guri\AppData\Roaming\mozilla\Extensions
[2012/08/19 10:48:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Guri\AppData\Roaming\mozilla\Firefox\Profiles\ntgwz0kg.default\extensions
[2012/08/04 12:13:08 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Guri\AppData\Roaming\mozilla\Firefox\Profiles\ntgwz0kg.default\extensions\[email protected]
[2012/07/20 13:42:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012/07/13 21:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/08/04 11:45:38 | 000,002,361 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/07/13 22:31:50 | 000,001,027 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\buscape.xml
[2012/07/13 22:31:50 | 000,001,212 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\mercadolivre.xml
[2012/07/13 22:31:50 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
[2012/07/13 22:31:50 | 000,001,168 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-br.xml
[2012/07/13 22:31:50 | 000,000,952 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-br.xml

O1 HOSTS File: ([2009/06/10 18:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask.com)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Guri\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [LerappW] c:\ProgramData\GxhvntV\OyobtxG\LerappW.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57A741D5-0E84-4779-8CF6-0CD4CFE39520}: DhcpNameServer = 7.254.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EC017F9D-81C1-46DF-8D06-E01224ABBE49}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{53400bb9-e53e-11e1-b896-40618677fccb}\Shell - "" = AutoRun
O33 - MountPoints2\{53400bb9-e53e-11e1-b896-40618677fccb}\Shell\AutoRun\command - "" = G:\Setup\rsrc\Autorun.exe
O33 - MountPoints2\{53400bb9-e53e-11e1-b896-40618677fccb}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe
O33 - MountPoints2\{e4293ad8-d390-11e1-a043-40618677fccb}\Shell - "" = AutoRun
O33 - MountPoints2\{e4293ad8-d390-11e1-a043-40618677fccb}\Shell\AutoRun\command - "" = F:\steambackup2.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/20 01:53:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\GxhvntV
[2012/08/20 01:53:03 | 000,054,272 | ---- | C] (sdfsdfsda) -- C:\ProgramData\lS59sC8E.exe
[2012/08/15 00:06:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012/08/14 14:35:53 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\OnLive App
[2012/08/14 14:35:41 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\OnLive App
[2012/08/14 14:35:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OnLive
[2012/08/14 14:35:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OnLive
[2012/08/14 13:35:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Valve
[2012/08/13 18:54:15 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenCoop
[2012/08/13 18:54:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenCoop
[2012/08/13 18:11:46 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012/08/13 18:08:14 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Doom 3
[2012/08/13 18:07:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOOM 3 Resurrection of Evil
[2012/08/13 17:57:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Doom 3
[2012/08/13 17:55:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012/08/13 17:55:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DOOM 3
[2012/08/13 14:13:24 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\Ahead
[2012/08/13 14:13:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 7 Ultra Edition
[2012/08/13 14:12:36 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Ahead
[2012/08/13 14:12:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Ahead
[2012/08/13 14:11:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nero
[2012/08/13 14:11:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Ahead
[2012/08/13 14:06:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com
[2012/08/13 13:55:02 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2012/08/13 13:26:41 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Nero
[2012/08/13 13:14:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2012/08/09 22:05:13 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\CAPCOM
[2012/08/09 22:05:13 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\CAPCOM
[2012/08/09 21:31:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CAPCOM
[2012/08/06 23:47:44 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\BioWare
[2012/08/06 22:44:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2012/08/06 22:44:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
[2012/08/06 22:44:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\BioWare
[2012/08/06 22:36:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mass Effect
[2012/08/04 11:46:37 | 000,000,000 | ---D | C] -- C:\Users\Guri\PSafe
[2012/08/04 11:46:09 | 000,289,952 | R--- | C] (360.cn) -- C:\Windows\SysNative\drivers\360FltOEM.sys
[2012/08/04 11:45:33 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Babylon
[2012/08/04 11:45:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/08/04 11:44:40 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\ArcticLine
[2012/08/04 11:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Folder Marker
[2012/08/04 11:42:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Folder Marker
[2012/08/03 20:45:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2012/08/03 20:43:20 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2012/08/03 20:43:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2012/08/03 20:43:19 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2012/08/03 20:43:02 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012/08/03 20:42:41 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2012/08/03 20:42:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2012/08/03 19:12:54 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\Windows Live
[2012/08/03 19:12:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2012/08/03 12:05:03 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\LogMeIn Hamachi
[2012/08/03 12:04:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/08/03 12:04:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
[2012/08/03 12:04:31 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\Mount&Blade With Fire and Sword
[2012/08/03 12:04:31 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Mount&Blade With Fire and Sword
[2012/08/02 15:00:02 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mount&Blade With Fire and Sword
[2012/08/02 15:00:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mount&Blade With Fire and Sword
[2012/08/02 14:54:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mount&Blade With Fire and Sword
[2012/08/02 01:00:36 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\Diablo III
[2012/08/01 11:36:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Batman Arkham City Game Of The Year Edition
[2012/08/01 11:25:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rocksteady
[2012/07/30 20:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012/07/30 20:57:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Diablo III
[2012/07/30 20:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012/07/30 20:57:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2012/07/30 20:51:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012/07/27 18:05:12 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\WB Games
[2012/07/26 18:03:37 | 000,000,000 | -H-D | C] -- C:\Users\Guri\Desktop\.picasaoriginals
[2012/07/26 17:42:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
[2012/07/24 07:53:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2012/07/24 07:53:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012/07/24 07:53:22 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\Google
[2012/07/23 23:50:24 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\QQSM
[2012/07/23 23:46:52 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MARS
[2012/07/23 23:41:10 | 000,000,000 | ---D | C] -- C:\MARS
[2012/07/23 22:49:48 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\Facebook
[2012/07/22 03:59:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012/07/22 01:43:11 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\NVIDIA
[2012/07/22 01:42:48 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Local\PAYDAY
[2012/07/22 01:31:32 | 000,000,000 | ---D | C] -- C:\Users\Guri\Documents\Tunngle
[2012/07/22 01:31:32 | 000,000,000 | ---D | C] -- C:\Users\Guri\AppData\Roaming\Tunngle
[2012/07/22 01:31:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Tunngle
[2012/07/22 01:31:26 | 000,031,232 | ---- | C] (Tunngle.net) -- C:\Windows\SysNative\drivers\tap0901t.sys
[2012/07/22 01:31:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tunngle
[2012/07/22 01:31:25 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Tunngle
[2012/07/22 01:31:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tunngle
[2012/07/22 01:14:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Payday The Heist
[2012/07/22 01:13:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012/07/22 01:13:24 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012/07/22 01:02:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
[2012/07/22 01:02:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Elaborate Bytes
[2012/07/22 01:00:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam
[2012/07/22 01:00:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012/07/22 01:00:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/20 21:03:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/20 20:57:09 | 000,083,565 | ---- | M] () -- C:\Users\Guri\Desktop\3.jpg
[2012/08/20 20:53:58 | 000,058,016 | ---- | M] () -- C:\Users\Guri\Desktop\2.jpg
[2012/08/20 20:53:30 | 000,071,219 | ---- | M] () -- C:\Users\Guri\Desktop\1.jpg
[2012/08/20 20:52:40 | 000,101,310 | ---- | M] () -- C:\Users\Guri\Desktop\Carrancas.jpg
[2012/08/20 20:52:31 | 000,073,371 | ---- | M] () -- C:\Users\Guri\Desktop\Sem título.jpg
[2012/08/20 20:51:51 | 000,050,668 | ---- | M] () -- C:\Users\Guri\Desktop\Girassóis.jpg
[2012/08/20 20:51:48 | 000,014,675 | ---- | M] () -- C:\Users\Guri\Desktop\01.jpg
[2012/08/20 20:49:02 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/20 20:44:53 | 2621,449,282 | ---- | M] () -- C:\ProgramData\sdr.bmp
[2012/08/20 19:54:35 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1448051340-1360208331-3978243735-1001UA.job
[2012/08/20 17:59:42 | 000,019,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/20 17:59:42 | 000,019,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/20 16:56:21 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/20 16:56:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/20 16:55:57 | 3113,574,400 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/20 11:36:48 | 002,420,984 | ---- | M] () -- C:\Users\Guri\Documents\APOSTILA DE CONHENCIMENTOS BANCARIOS[1].pdf
[2012/08/20 01:53:08 | 035,546,134 | ---- | M] () -- C:\ProgramData\eASc4vW6MC9Q.exe
[2012/08/20 01:53:06 | 000,413,879 | ---- | M] () -- C:\ProgramData\eASc4vW6MC9Q.exe.bmp
[2012/08/20 01:53:04 | 000,054,272 | ---- | M] (sdfsdfsda) -- C:\ProgramData\lS59sC8E.exe
[2012/08/19 22:54:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1448051340-1360208331-3978243735-1001Core.job
[2012/08/19 19:38:20 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012/08/19 19:38:20 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012/08/19 19:37:54 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012/08/18 11:35:24 | 001,523,558 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/18 11:35:24 | 000,665,706 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat
[2012/08/18 11:35:24 | 000,617,910 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/08/18 11:35:24 | 000,128,896 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat
[2012/08/18 11:35:24 | 000,107,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/08/16 14:21:48 | 392,288,571 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/08/16 08:04:17 | 000,275,520 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/08/15 20:41:02 | 000,001,233 | ---- | M] () -- C:\Users\Guri\Desktop\Dead Island.lnk
[2012/08/14 21:10:52 | 000,000,930 | ---- | M] () -- C:\Users\Guri\Desktop\SmartSteam - Atalho.lnk
[2012/08/14 14:35:40 | 000,001,853 | ---- | M] () -- C:\Users\Public\Desktop\OnLive.lnk
[2012/08/14 13:37:43 | 000,001,928 | ---- | M] () -- C:\Users\Guri\Desktop\Dedicated Server.lnk
[2012/08/14 13:35:20 | 000,001,676 | ---- | M] () -- C:\Users\Public\Desktop\Counter-Strike 1.6.lnk
[2012/08/13 18:54:15 | 000,001,904 | ---- | M] () -- C:\Users\Guri\Desktop\Doom 3 OpenCoop.lnk
[2012/08/13 18:08:14 | 000,000,976 | ---- | M] () -- C:\Users\Guri\Desktop\Doom3.lnk
[2012/08/13 18:07:20 | 000,001,680 | ---- | M] () -- C:\Users\Public\Desktop\DOOM 3 Resurrection of Evil.lnk
[2012/08/13 18:07:15 | 000,000,350 | ---- | M] () -- C:\Windows\d3xp.ini
[2012/08/13 17:58:37 | 000,001,634 | ---- | M] () -- C:\Users\Public\Desktop\Doom 3.lnk
[2012/08/13 17:57:58 | 000,000,343 | ---- | M] () -- C:\Windows\doom3.ini
[2012/08/13 14:24:09 | 000,033,936 | ---- | M] () -- C:\Users\Guri\Documents\ISO1_DVD.nri
[2012/08/13 14:13:18 | 000,002,786 | ---- | M] () -- C:\Users\Public\Desktop\Nero StartSmart.lnk
[2012/08/13 14:13:18 | 000,002,646 | ---- | M] () -- C:\Users\Public\Desktop\Nero Home.lnk
[2012/08/06 22:44:07 | 000,001,082 | ---- | M] () -- C:\Users\Public\Desktop\Mass Effect.lnk
[2012/08/04 11:45:51 | 000,000,316 | ---- | M] () -- C:\user.js
[2012/08/04 11:44:38 | 000,001,962 | ---- | M] () -- C:\Users\Guri\Desktop\Folder Marker.lnk
[2012/08/03 12:02:13 | 000,001,209 | ---- | M] () -- C:\Users\Guri\Desktop\Mount&Blade With Fire and Sword.lnk
[2012/08/01 11:36:51 | 000,001,473 | ---- | M] () -- C:\Users\Public\Desktop\Batman Arkham City.lnk
[2012/07/30 20:59:54 | 000,001,167 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012/07/26 18:00:11 | 000,001,110 | ---- | M] () -- C:\Users\Public\Desktop\Picasa 3.lnk
[2012/07/25 22:44:45 | 000,034,559 | ---- | M] () -- C:\Users\Guri\Desktop\Sem título.png
[2012/07/23 23:46:52 | 000,000,608 | ---- | M] () -- C:\Users\Guri\Desktop\MARS.lnk
[2012/07/23 11:22:48 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/07/22 01:33:16 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat
[2012/07/22 01:31:27 | 000,000,995 | ---- | M] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2012/07/22 01:16:41 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Payday The Heist.lnk
[2012/07/22 01:03:58 | 000,001,254 | ---- | M] () -- C:\Users\Public\Desktop\Virtual CloneDrive.lnk
[2012/07/22 01:00:24 | 000,000,917 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/20 20:57:09 | 000,083,565 | ---- | C] () -- C:\Users\Guri\Desktop\3.jpg
[2012/08/20 20:53:58 | 000,058,016 | ---- | C] () -- C:\Users\Guri\Desktop\2.jpg
[2012/08/20 20:53:30 | 000,071,219 | ---- | C] () -- C:\Users\Guri\Desktop\1.jpg
[2012/08/20 20:52:39 | 000,101,310 | ---- | C] () -- C:\Users\Guri\Desktop\Carrancas.jpg
[2012/08/20 20:52:31 | 000,073,371 | ---- | C] () -- C:\Users\Guri\Desktop\Sem título.jpg
[2012/08/20 20:51:49 | 000,050,668 | ---- | C] () -- C:\Users\Guri\Desktop\Girassóis.jpg
[2012/08/20 20:51:38 | 000,014,675 | ---- | C] () -- C:\Users\Guri\Desktop\01.jpg
[2012/08/20 11:36:48 | 002,420,984 | ---- | C] () -- C:\Users\Guri\Documents\APOSTILA DE CONHENCIMENTOS BANCARIOS[1].pdf
[2012/08/20 01:53:09 | 2621,449,282 | ---- | C] () -- C:\ProgramData\sdr.bmp
[2012/08/20 01:53:07 | 035,546,134 | ---- | C] () -- C:\ProgramData\eASc4vW6MC9Q.exe
[2012/08/20 01:53:04 | 000,413,879 | ---- | C] () -- C:\ProgramData\eASc4vW6MC9Q.exe.bmp
[2012/08/15 20:41:02 | 000,001,233 | ---- | C] () -- C:\Users\Guri\Desktop\Dead Island.lnk
[2012/08/14 21:10:52 | 000,000,930 | ---- | C] () -- C:\Users\Guri\Desktop\SmartSteam - Atalho.lnk
[2012/08/14 14:35:40 | 000,001,853 | ---- | C] () -- C:\Users\Public\Desktop\OnLive.lnk
[2012/08/14 13:37:43 | 000,001,928 | ---- | C] () -- C:\Users\Guri\Desktop\Dedicated Server.lnk
[2012/08/14 13:35:20 | 000,001,676 | ---- | C] () -- C:\Users\Public\Desktop\Counter-Strike 1.6.lnk
[2012/08/13 18:54:15 | 000,001,904 | ---- | C] () -- C:\Users\Guri\Desktop\Doom 3 OpenCoop.lnk
[2012/08/13 18:08:14 | 000,000,976 | ---- | C] () -- C:\Users\Guri\Desktop\Doom3.lnk
[2012/08/13 18:07:20 | 000,001,680 | ---- | C] () -- C:\Users\Public\Desktop\DOOM 3 Resurrection of Evil.lnk
[2012/08/13 18:07:15 | 000,000,350 | ---- | C] () -- C:\Windows\d3xp.ini
[2012/08/13 17:58:37 | 000,001,634 | ---- | C] () -- C:\Users\Public\Desktop\Doom 3.lnk
[2012/08/13 17:57:58 | 000,000,343 | ---- | C] () -- C:\Windows\doom3.ini
[2012/08/13 14:24:09 | 000,033,936 | ---- | C] () -- C:\Users\Guri\Documents\ISO1_DVD.nri
[2012/08/13 14:13:18 | 000,002,786 | ---- | C] () -- C:\Users\Public\Desktop\Nero StartSmart.lnk
[2012/08/13 14:13:18 | 000,002,646 | ---- | C] () -- C:\Users\Public\Desktop\Nero Home.lnk
[2012/08/06 22:44:07 | 000,001,082 | ---- | C] () -- C:\Users\Public\Desktop\Mass Effect.lnk
[2012/08/04 11:45:51 | 000,000,316 | ---- | C] () -- C:\user.js
[2012/08/04 11:42:45 | 000,001,962 | ---- | C] () -- C:\Users\Guri\Desktop\Folder Marker.lnk
[2012/08/03 20:45:27 | 000,001,305 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012/08/03 20:45:09 | 000,001,374 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/08/03 20:44:42 | 000,001,458 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/08/03 20:44:25 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/08/02 15:00:01 | 000,001,209 | ---- | C] () -- C:\Users\Guri\Desktop\Mount&Blade With Fire and Sword.lnk
[2012/08/01 11:36:51 | 000,001,473 | ---- | C] () -- C:\Users\Public\Desktop\Batman Arkham City.lnk
[2012/07/30 20:57:52 | 000,001,167 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012/07/26 18:00:11 | 000,001,110 | ---- | C] () -- C:\Users\Public\Desktop\Picasa 3.lnk
[2012/07/25 22:44:33 | 000,034,559 | ---- | C] () -- C:\Users\Guri\Desktop\Sem título.png
[2012/07/24 07:53:29 | 000,001,064 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/24 07:53:28 | 000,001,060 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/23 23:46:52 | 000,000,608 | ---- | C] () -- C:\Users\Guri\Desktop\MARS.lnk
[2012/07/23 22:49:52 | 000,000,924 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1448051340-1360208331-3978243735-1001UA.job
[2012/07/23 22:49:52 | 000,000,902 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1448051340-1360208331-3978243735-1001Core.job
[2012/07/23 11:22:48 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012/07/22 01:33:16 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2012/07/22 01:31:27 | 000,000,995 | ---- | C] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2012/07/22 01:16:41 | 000,000,922 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Payday The Heist.lnk
[2012/07/22 01:16:41 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Payday The Heist.lnk
[2012/07/22 01:03:58 | 000,001,254 | ---- | C] () -- C:\Users\Public\Desktop\Virtual CloneDrive.lnk
[2012/07/22 01:00:24 | 000,000,917 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2012/07/20 19:40:26 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012/07/20 19:40:25 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012/07/20 13:43:51 | 001,508,738 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/05/15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

========== LOP Check ==========

[2012/08/04 11:44:40 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\ArcticLine
[2012/08/04 11:45:33 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\Babylon
[2012/08/03 12:23:20 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\Mount&Blade With Fire and Sword
[2012/08/14 14:35:41 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\OnLive App
[2012/08/09 11:59:04 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\Origin
[2012/07/22 04:02:52 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\Tunngle
[2012/08/20 17:01:13 | 000,000,000 | ---D | M] -- C:\Users\Guri\AppData\Roaming\uTorrent
[2012/08/19 22:54:00 | 000,000,902 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1448051340-1360208331-3978243735-1001Core.job
[2012/08/20 19:54:35 | 000,000,924 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1448051340-1360208331-3978243735-1001UA.job
[2012/08/19 10:39:33 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
  • 0

Advertisements

#2
RKinner
Posted 20 August 2012 - 10:51 PM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
This should help a bit:

Copy the text in the code box by highlighting and Ctrl + c 


:OTL
[2012/08/20 01:53:10 | 000,000,000 | -HSD | C] -- C:\ProgramData\GxhvntV
[2012/08/20 01:53:09 | 2621,449,282 | ---- | C] () -- C:\ProgramData\sdr.bmp
[2012/08/20 01:53:07 | 035,546,134 | ---- | C] () -- C:\ProgramData\eASc4vW6MC9Q.exe
[2012/08/20 01:53:04 | 000,413,879 | ---- | C] () -- C:\ProgramData\eASc4vW6MC9Q.exe.bmp
[2012/08/20 01:53:04 | 000,054,272 | ---- | M] (sdfsdfsda) -- C:\ProgramData\lS59sC8E.exe
     
:Commands
[EMPTYTEMP]
[purity]
[Reboot]

then Rightclick on OTL and select Run As Administrator to start. Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the RUN FIX button (NOT THE QUICK SCAN button!) at the top
Let the program run unhindered, OTL will reboot the PC when it is done.

Ron
  • 0

#3
guimezzadre
Posted 21 August 2012 - 08:44 AM

guimezzadre

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Thanks man, it worked and helped a lot :happy:
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP