ComboFix 14-01-23. 01 Vanessa Benko 23/01/2014 14: 13: 05 4 x86

[2014/01/13 15:05:11 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[2014/01/08 16:30:48 | 000,283,236 | ---- | M] () -- C:\Users\Vanessa Benko\Desktop\print sephora2.png

[2014/01/08 15:58:35 | 000,271,671 | ---- | M] () -- C:\Users\Vanessa Benko\Desktop\print sephora.png

[2013/12/26 12:57:24 | 000,019,326 | ---- | M] () -- C:\Users\Vanessa Benko\AppData\Roaming\unins002.dat

[2013/12/26 11:59:00 | 000,064,168 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswstm.sys

[2013/12/26 11:58:14 | 000,775,952 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys

[2013/12/26 11:58:14 | 000,410,528 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys

[2013/12/26 11:58:14 | 000,180,248 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys

[2013/12/26 11:58:14 | 000,067,824 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys

[2013/12/26 11:58:13 | 000,270,240 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe

[2013/12/26 11:58:13 | 000,043,152 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

[2013/12/19 16:52:44 | 000,000,909 | ---- | M] () -- C:\Users\Public\Desktop\Syncios.lnk

[2013/12/10 17:49:18 | 000,016,284 | ---- | M] () -- C:\Windows\System32\ieuinit.inf

[2013/12/05 13:28:24 | 000,079,720 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr2.sys

[2013/12/05 13:28:24 | 000,049,944 | ---- | M] () -- C:\Windows\System32\drivers\aswRvrt.sys

[2013/12/05 13:28:00 | 000,259,928 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswNdisFlt.sys

[2013/12/05 13:19:43 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt

[2013/11/22 09:48:48 | 000,046,392 | ---- | M] (GAS Tecnologia) -- C:\Windows\System32\drivers\gbpkm.sys

[2013/11/13 11:03:01 | 000,009,197 | ---- | M] () -- C:\Users\Vanessa Benko\.recently-used.xbel

[2013/10/31 04:46:14 | 000,104,752 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFW.sys

[3 C:\Users\Vanessa Benko\Desktop\*.tmp files -> C:\Users\Vanessa Benko\Desktop\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2014/01/23 14:10:28 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2014/01/23 14:10:28 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2014/01/23 14:10:28 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2014/01/23 14:10:28 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2014/01/23 14:10:28 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2014/01/20 14:35:31 | 000,001,953 | ---- | C] () -- C:\Users\Vanessa Benko\Desktop\transf 200 gerson.pdf

[2014/01/08 16:30:48 | 000,283,236 | ---- | C] () -- C:\Users\Vanessa Benko\Desktop\print sephora2.png

[2014/01/08 15:58:35 | 000,271,671 | ---- | C] () -- C:\Users\Vanessa Benko\Desktop\print sephora.png

[2013/12/26 12:57:21 | 000,019,326 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\unins002.dat

[2013/12/19 16:52:43 | 000,000,909 | ---- | C] () -- C:\Users\Public\Desktop\Syncios.lnk

[2013/12/19 09:53:02 | 000,000,082 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\WB.CFG

[2013/12/10 17:49:18 | 000,016,284 | ---- | C] () -- C:\Windows\System32\ieuinit.inf

[2013/11/13 11:03:01 | 000,009,197 | ---- | C] () -- C:\Users\Vanessa Benko\.recently-used.xbel

[2013/11/01 11:03:28 | 000,214,528 | ---- | C] () -- C:\Windows\System32\WSCM32.dll

[2013/08/20 10:12:07 | 000,720,082 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\unins001.exe

[2013/08/16 15:32:25 | 000,033,938 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\unins001.dat

[2013/07/03 14:02:39 | 000,720,594 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\unins000.exe

[2013/07/03 14:02:39 | 000,012,844 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\unins000.dat

[2013/06/24 19:16:46 | 000,000,000 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Local\{9792C865-FF13-4457-AB35-BD677B7372C3}

[2013/05/16 15:51:18 | 000,180,248 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys

[2013/05/16 15:51:15 | 000,049,944 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys

[2013/04/10 15:34:27 | 000,003,584 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/03/13 16:08:15 | 000,002,110 | ---- | C] () -- C:\Users\Vanessa Benko\config.xml

[2013/02/22 18:35:43 | 000,000,176 | ---- | C] () -- C:\Windows\REC-NET.INI

[2012/09/14 11:00:15 | 000,007,887 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\pcouffin.cat

[2012/09/14 11:00:15 | 000,001,144 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\pcouffin.inf

[2012/09/04 17:07:27 | 000,675,774 | ---- | C] () -- C:\Windows\unins000.exe

[2012/09/04 17:07:27 | 000,000,979 | ---- | C] () -- C:\Windows\unins000.dat

[2012/05/17 15:05:33 | 000,000,131 | ---- | C] () -- C:\Users\Vanessa Benko\AppData\Roaming\default.rss

[2012/03/15 16:53:10 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini

[2012/03/09 10:46:11 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe

[2012/03/09 10:45:31 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2012/03/07 16:10:16 | 000,000,043 | ---- | C] () -- C:\Users\Vanessa Benko\sistemaRecebimento.conf

[2012/03/06 14:24:11 | 000,027,136 | ---- | C] () -- C:\Windows\System32\WiseDLL.dll

[2012/03/05 17:20:11 | 000,106,496 | ---- | C] () -- C:\Windows\System32\vshp1020.dll

[2012/03/05 17:20:10 | 000,442,368 | ---- | C] () -- C:\Windows\System32\zshp1020.exe

[2012/03/05 15:33:49 | 000,000,418 | ---- | C] () -- C:\Windows\ODBC.INI

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 02:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013/07/25 23:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 10:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 23:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

[color=#E56717]========== LOP Check ==========[/color]

[2012/09/04 17:28:39 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\AssistenteCertificadoDigital

[2013/12/06 09:08:19 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\AVAST Software

[2013/09/23 11:32:28 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Baidu Security

[2013/08/18 13:58:32 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Betcat

[2012/05/17 15:26:18 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\BrOffice.org

[2014/01/22 14:41:01 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Dropbox

[2013/05/21 10:57:54 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\DSite

[2012/06/13 15:21:11 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\GetRightToGo

[2013/11/13 11:03:01 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\gtk-2.0

[2013/12/16 10:38:14 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\iFunbox_UserCache

[2014/01/13 10:59:57 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Mp3tag

[2012/03/21 17:23:25 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\MumboJumbo

[2013/11/04 09:11:07 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Nico Mak Computing

[2012/10/05 11:23:30 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Opera

[2012/06/26 12:56:55 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Skinux

[2014/01/14 15:47:51 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Syncios

[2014/01/21 13:58:04 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\uTorrent

[2012/09/14 11:01:18 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Vso

[2012/04/11 10:13:40 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Watchtower

[2012/04/10 17:48:12 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\WinAVI

[2012/03/07 18:00:39 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Windows Live Writer

[2013/11/22 09:57:35 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\Wondershare

[2012/06/15 11:33:50 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\XnConvert

[2012/07/13 17:09:44 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\XnRetro

[2012/05/04 18:22:09 | 000,000,000 | ---D | M] -- C:\Users\Vanessa Benko\AppData\Roaming\ZapWallPaper

[color=#E56717]========== Purity Check ==========[/color]

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 412 bytes -> C:\Windows\System32\drivers:GbpKmAp.lst

@Alternate Data Stream - 143 bytes -> C:\Users\Vanessa Benko\AppData\Roaming\default.rss:OECustomProperty
< End of report >

OTL EXTRA

OTL Extras logfile created on: 28/01/2014 15:28:17 - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Vanessa Benko\Desktop

Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16476)

Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy

3,49 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 43,21% Memory free

6,98 Gb Paging File | 4,60 Gb Available in Paging File | 65,90% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 146,48 Gb Total Space | 27,46 Gb Free Space | 18,75% Space Free | Partition Type: NTFS

Drive D: | 319,18 Gb Total Space | 37,08 Gb Free Space | 11,62% Space Free | Partition Type: NTFS

Computer Name: MICRO050 | User Name: Vanessa Benko | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]

[color=#E56717]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_USERS\S-1-5-21-770461102-1528469112-2676766293-1000\SOFTWARE\Classes\]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

[color=#E56717]========== Shell Spawning ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[color=#E56717]========== System Restore Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[color=#E56717]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{12FB143C-2C22-49E5-8EB1-64D9D4A6C983}" = lport=445 | protocol=6 | dir=in | app=system |

"{1772C314-AE14-4474-8097-1F7A2929734C}" = rport=139 | protocol=6 | dir=out | app=system |

"{259FA77B-9A2D-47D2-9CE9-F3ABAC0A9F22}" = rport=445 | protocol=6 | dir=out | app=system |

"{295DDA57-BE7D-4368-A85A-879FAE845B35}" = lport=137 | protocol=17 | dir=in | app=system |

"{29845D84-2504-401E-B3B4-D60646ACCB3A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{43521C95-6977-42A8-87B4-74549D5FF209}" = lport=2013 | protocol=6 | dir=in | name=prx |

"{69D2F43F-5845-4E4E-913E-2F6E6FB8902A}" = lport=139 | protocol=6 | dir=in | app=system |

"{747EEA4B-5F3D-40A4-B99F-9AC191DC027B}" = lport=138 | protocol=17 | dir=in | app=system |

"{7AED80B4-20F3-4E7B-BA05-5EEEE426B360}" = rport=138 | protocol=17 | dir=out | app=system |

"{90ED9032-3AC0-4B8A-AB2F-2394B0F6A4D4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{A299624C-E74A-4EA4-8E2E-7C6D7F95B8BF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

"{A8A5C96A-C4E7-45D1-9169-ADAD68CC8C11}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{B1E87E7E-F356-49C9-A75B-BEDB296719DC}" = rport=137 | protocol=17 | dir=out | app=system |

"{CC9897EC-9600-4ADF-9EA0-6092ED12020B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

"{CD0667DB-BA72-44B3-8F6A-23743C4B0517}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

"{F7DFBCF6-EF71-4483-BEB8-9AE51FA0F66E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

"{FB6A97FA-AC8C-4E5B-A9E2-0BE14C29970C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

[color=#E56717]========== Vista Active Application Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{2C7A1536-34A2-44F1-AEF8-872FBF7C95B7}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |

"{37F36699-6846-49EF-AD37-E825D59EBC14}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{5F47E7F9-30AE-44E6-8A47-68970EE01125}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |

"{67C1096F-5AED-4A98-BEB9-0E967F28EE82}" = dir=in | app=c:\program files\itunes\itunes.exe |

"{7908196F-DE4B-40A8-ADB9-5D9F171EEEC4}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{9EAF04BD-487A-4084-93C0-FE438AFA8167}" = protocol=17 | dir=in | app=d:\documents\vane benko\particular\instaladores\utorrent.exe |

"{A9E4874E-8735-4747-B458-C646BF754D1D}" = protocol=6 | dir=in | app=d:\documents\vane benko\particular\instaladores\utorrent.exe |

"{B75B376F-7077-41FE-B971-0B89BA524A44}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{B94378CE-9F79-4DD0-886B-22837CC5CE5B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

"{C11AD3CF-A1FE-4841-A7DF-0D90B80E7194}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{C38E257C-8708-42E2-A04A-218EACF34F21}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |

"{E50B2ABD-57B5-44CD-BCB0-AFC4834AAB13}" = dir=in | app=c:\program files\skype\phone\skype.exe |

"{F5483EE5-C5BE-4B43-9079-758BF105BF78}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{FE25338E-1F59-4E53-A917-6348B39EE3CB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

"TCP Query User{59904D83-14AA-4B5F-9A98-91F84BBF0839}D:\documents\vane benko\instaladores\utorrent.exe" = protocol=6 | dir=in | app=d:\documents\vane benko\instaladores\utorrent.exe |

"TCP Query User{87664DC3-92FD-459E-9BDA-2970AC19AC04}D:\documents\vane benko\instaladores\utorrent.exe" = protocol=6 | dir=in | app=d:\documents\vane benko\instaladores\utorrent.exe |

"TCP Query User{9598E29F-AAF7-42E8-A642-505ABB7B2C30}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" = protocol=6 | dir=in | app=c:\program files\dsnet corp\atube catcher 2.0\yct.exe |

"TCP Query User{97ACA47A-8017-43DC-9697-F1F6F9C00FA9}D:\documents\vane benko\particular\instaladores\utorrent.exe" = protocol=6 | dir=in | app=d:\documents\vane benko\particular\instaladores\utorrent.exe |

"TCP Query User{D1D58A96-AD0F-4AFD-A3C9-3E7E2B4B7B73}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |

"UDP Query User{0FD531A9-7A4B-4D86-A2BC-096D406821A6}C:\program files\dsnet corp\atube catcher 2.0\yct.exe" = protocol=17 | dir=in | app=c:\program files\dsnet corp\atube catcher 2.0\yct.exe |

"UDP Query User{11DB96A6-4E53-4F08-927C-7D9D70BEA70D}D:\documents\vane benko\instaladores\utorrent.exe" = protocol=17 | dir=in | app=d:\documents\vane benko\instaladores\utorrent.exe |

"UDP Query User{28279D50-0DBA-41E8-92D7-9B1342239934}D:\documents\vane benko\instaladores\utorrent.exe" = protocol=17 | dir=in | app=d:\documents\vane benko\instaladores\utorrent.exe |

"UDP Query User{655C3350-18EA-41E2-8B43-096D0F88EF63}D:\documents\vane benko\particular\instaladores\utorrent.exe" = protocol=17 | dir=in | app=d:\documents\vane benko\particular\instaladores\utorrent.exe |

"UDP Query User{DE361DF1-11C5-4F6F-89BC-D883339060F1}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |

[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00A61104-74B5-4056-AD00-4397EF4FB141}" = iCloud

"{068A5D84-8419-4BDE-9689-FE65F412EFBB}_is1" = Syncios versão 3.0.3

"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help

"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0ED24A05-DCEA-4CBE-BF3F-398ACFF2693B}" = SafeNet Authentication Client 8.1 SP1

"{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}" = Apple Mobile Device Support

"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1

"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool

"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM

"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights

"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM

"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{20A15757-4AE4-3C82-9711-863C84AFE6AA}" = Microsoft .NET Framework 4 Client Profile PTB Language Pack

"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1

"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart

"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax

"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2

"{32D39568-3B77-11E3-88CE-00163E98E7D0}" = Evernote v. 5.0.3

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor

"{36386dc9-8543-4b12-ae6b-220fd52f19f3}_is1" = GBBD Banco do Brasil

"{3889988F-762B-4B85-AB17-71C9CC3AE445}" = Messenger Companion

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3DC873BB-FFE3-46BF-9701-26B9AE371F9F}" = RealDownloader

"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help

"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials

"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources

"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11

"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter

"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap

"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml