ComboFix 11-08-19.02 - SONIA 20/08/2011   9:25.1.2 - x86
Microsoft� Windows Vista� Home Premium   6.0.6002.2.1252.55.1033.18.2046.927 [GMT -3:00]
Executando de: c:\users\SONIA\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((   Outras Exclus�es   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Hotspot Shield\HssIE\HsSIe.dll
c:\program files\StartNow Toolbar
c:\program files\StartNow Toolbar\Resources\images\engine_images.png
c:\program files\StartNow Toolbar\Resources\images\engine_maps.png
c:\program files\StartNow Toolbar\Resources\images\engine_news.png
c:\program files\StartNow Toolbar\Resources\images\engine_videos.png
c:\program files\StartNow Toolbar\Resources\images\engine_web.png
c:\program files\StartNow Toolbar\Resources\images\icon_amazon.png
c:\program files\StartNow Toolbar\Resources\images\icon_ebay.png
c:\program files\StartNow Toolbar\Resources\images\icon_facebook.png
c:\program files\StartNow Toolbar\Resources\images\icon_games.png
c:\program files\StartNow Toolbar\Resources\images\icon_msn.png
c:\program files\StartNow Toolbar\Resources\images\icon_shopping.png
c:\program files\StartNow Toolbar\Resources\images\icon_travel.png
c:\program files\StartNow Toolbar\Resources\images\icon_twitter.png
c:\program files\StartNow Toolbar\Resources\images\startnow_logo.png
c:\program files\StartNow Toolbar\Resources\installer.xml
c:\program files\StartNow Toolbar\Resources\protect\index.html
c:\program files\StartNow Toolbar\Resources\protect\NotIE6.css
c:\program files\StartNow Toolbar\Resources\protect\OnlyIE6.css
c:\program files\StartNow Toolbar\Resources\protect\SearchProtectIcon.png
c:\program files\StartNow Toolbar\Resources\protect\window.css
c:\program files\StartNow Toolbar\Resources\protect\window.js
c:\program files\StartNow Toolbar\Resources\reactivate\index.html
c:\program files\StartNow Toolbar\Resources\reactivate\LeftImage.png
c:\program files\StartNow Toolbar\Resources\reactivate\NotIE6.css
c:\program files\StartNow Toolbar\Resources\reactivate\OnlyIE6.css
c:\program files\StartNow Toolbar\Resources\reactivate\window.css
c:\program files\StartNow Toolbar\Resources\reactivate\window.js
c:\program files\StartNow Toolbar\Resources\skin\chevron_button.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_hover.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_normal.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_background.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_left.png
c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_middle.png
c:\program files\StartNow Toolbar\Resources\skin\separator.png
c:\program files\StartNow Toolbar\Resources\skin\splitter.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png
c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png
c:\program files\StartNow Toolbar\Resources\toolbar.xml
c:\program files\StartNow Toolbar\Resources\update.xml
c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe
c:\program files\StartNow Toolbar\Toolbar32.dll
c:\program files\StartNow Toolbar\ToolbarUpdaterService.exe
c:\program files\StartNow Toolbar\uninstall.dat
c:\users\SONIA\AppData\Roaming\Desktopicon
c:\users\SONIA\AppData\Roaming\Desktopicon\mc.ico
c:\windows\IsUn0416.exe
c:\windows\system32\KBL.LOG
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Servi�os   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Updater Service for StartNow Toolbar
-------\Service_Updater Service for StartNow Toolbar
.
.
((((((((((((((((   Arquivos/Ficheiros criados de 2011-07-20 to 2011-08-20  ))))))))))))))))))))))))))))
.
.
2011-08-16 19:28 . 2011-08-16 19:28	--------	d-----w-	C:\temp
2011-08-16 18:09 . 2011-08-20 11:43	--------	d-----w-	c:\programdata\Trend Micro
2011-08-16 16:36 . 2011-06-03 19:25	625984	----a-w-	c:\program files\Common Files\ZugoInstaller.exe
2011-08-16 12:19 . 2011-08-16 12:30	--------	d-----w-	c:\users\SONIA\AppData\Roaming\Nokia Ovi Suite
2011-08-16 12:19 . 2011-08-16 12:30	--------	d-----w-	c:\users\SONIA\AppData\Roaming\Nokia
2011-08-16 12:19 . 2011-08-16 12:19	--------	d-----w-	c:\programdata\Nokia
2011-08-16 11:11 . 2009-07-14 17:45	445008	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
2011-08-16 11:11 . 2009-07-14 17:45	38480	----a-w-	c:\windows\system32\drivers\WdfLdr.sys
2011-08-16 11:09 . 2011-08-16 11:09	--------	d-----w-	c:\users\SONIA\AppData\Local\Nokia
2011-08-16 11:09 . 2011-08-16 11:09	--------	d-----w-	c:\programdata\PC Suite
2011-08-16 11:09 . 2011-08-16 12:19	--------	d-----w-	c:\users\SONIA\AppData\Roaming\PC Suite
2011-08-16 11:06 . 2011-08-16 11:07	--------	d-----w-	c:\program files\Common Files\Nokia
2011-08-16 11:06 . 2011-08-16 11:06	--------	d-----w-	c:\program files\DIFX
2011-08-16 11:06 . 2008-08-26 13:26	18816	----a-w-	c:\windows\system32\drivers\pccsmcfd.sys
2011-08-16 11:05 . 2011-08-16 11:05	--------	d-----w-	c:\program files\PC Connectivity Solution
2011-08-16 11:00 . 2011-05-18 13:13	75264	----a-w-	c:\windows\system32\nmwcdcls.dll
2011-08-16 10:59 . 2011-08-16 11:06	--------	d-----w-	c:\program files\Nokia
2011-08-11 02:52 . 2011-08-11 02:52	--------	d-----w-	c:\program files\iPod
2011-08-11 02:52 . 2011-08-11 02:53	--------	d-----w-	c:\program files\iTunes
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-08-11 02:38 . 2011-08-11 02:38	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-08-11 02:37 . 2011-08-11 02:38	--------	d-----w-	c:\program files\QuickTime
2011-08-10 20:19 . 2011-06-17 16:03	375808	----a-w-	c:\windows\system32\winsrv.dll
2011-08-10 20:19 . 2011-04-21 13:55	508416	----a-w-	c:\windows\system32\drivers\bthport.sys
2011-08-10 20:19 . 2009-06-17 13:23	30208	----a-w-	c:\windows\system32\drivers\BTHUSB.SYS
2011-08-10 20:19 . 2011-07-06 15:31	214016	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 20:19 . 2011-06-02 13:34	2043392	----a-w-	c:\windows\system32\win32k.sys
2011-08-10 20:15 . 2011-04-20 15:50	49152	----a-w-	c:\windows\system32\csrsrv.dll
2011-08-10 20:14 . 2011-06-20 08:54	3602832	----a-w-	c:\windows\system32\ntkrnlpa.exe
2011-08-10 20:14 . 2011-06-20 08:54	3550096	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-08-10 20:13 . 2011-06-17 20:13	913296	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-08-10 20:13 . 2011-06-17 13:31	31232	----a-w-	c:\windows\system32\drivers\tcpipreg.sys
.
.
.
(((((((((((((((((((((((((((((((((((((   Relat�rio Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-12 14:20 . 2011-07-12 14:20	83816	----a-w-	c:\windows\system32\dns-sd.exe
2011-07-12 14:20 . 2011-07-12 14:20	73064	----a-w-	c:\windows\system32\dnssd.dll
2011-07-05 21:37 . 2011-07-05 21:37	94208	----a-w-	c:\windows\system32\QuickTimeVR.qtx
2011-07-05 21:37 . 2011-07-05 21:37	69632	----a-w-	c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e leg�timas por padr�o n�o s�o apresentadas. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2010-04-17 3872080]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-11-30 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2011-08-04 966712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-09 4702208]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 178712]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-20 468264]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-06-08 236016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"CardScanAgent"="c:\program files\CardScan\CardScan\CardScanAgent.exe" [2006-10-20 176128]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-07-19 421736]
.
c:\users\SONIA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Ferramenta de Verifica��o de M�dia do Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-8-4 376832]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-9-5 727592]
HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R1 MpKslc597533b;MpKslc597533b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{410452C8-DF36-44F2-B37E-474AAF75F792}\MpKslc597533b.sys [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-30 136176]
R3 gupdatem;Servi�o do Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-30 136176]
S2 GbpSv;Gbp Service;c:\progra~1\GbPlugin\GbpSv.exe [2008-05-16 47080]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [2010-10-15 326704]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 20:34	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Conte�do da pasta 'Tarefas Agendadas'
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-30 16:37]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-30 16:37]
.
2011-08-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1632812723-1272325004-1081256398-1000Core.job
- c:\users\SONIA\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 20:02]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1632812723-1272325004-1081256398-1000UA.job
- c:\users\SONIA\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 20:02]
.
2011-08-20 c:\windows\Tasks\User_Feed_Synchronization-{60FB8529-D952-401F-B2D2-B5BD64201300}.job
- c:\windows\system32\msfeedssync.exe [2011-08-10 09:26]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_br&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: rie.com.br\www
Trusted Zone: secureweb.com.br\www
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORF�OS REMOVIDOS - - - -
.
HKCU-Run-CardScan AutoSync - (no file)
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
AddRemove-L&H Power Translator Pro 7.0 - c:\windows\ISUN0416.EXE
AddRemove-StartNow Toolbar - c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe
.
.
.
**************************************************************************
Procurando processos ocultos ... 
.
Procurando entradas auto inicializ�veis ocultas ... 
.
Procurando ficheiros/arquivos ocultos ... 
.
Varredura completada com sucesso
arquivos/ficheiros ocultos: 
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GbpSv]
"ImagePath"="c:\progra~1\GbPlugin\GbpSv.exe"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Carregadas Sob os Processos em Execu��o ---------------------
.
- - - - - - - > 'Explorer.exe'(2088)
c:\windows\system32\btmmhook.dll
c:\windows\system32\btncopy.dll
.
------------------------ Outros Processos em Execu��o ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Hotspot Shield\HssWPR\hsssrv.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\WIDCOMM\Bluetooth Software\BtStackServer.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
.
**************************************************************************
.
Tempo para conclus�o: 2011-08-20  09:46:43 - M�quina reiniciou
ComboFix-quarantined-files.txt  2011-08-20 12:46
.
Pr�-execu��o: 59.213.008.896 bytes free
P�s execu��o: 60.346.748.928 bytes free
.
- - End Of File - - 8067C44D3F251E55D1F4E4524C70D8E0