What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

vmmdiag32.exe

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi! it's my first post! if i do anything that is not correct please tell me!
well… i'm not the only user of my house… and yet… i'm not quite skilled in
defending my pc… but please! be patient with me! e really need help!

These days when i start my computer a error message appears on my screen…
that ''vmmdiag.32'' wasn't found, and yet that my video configuration is not properly,
but i can't figure out any problems… i've already seen some guys with the same
problem as mine… can you help me??? i'm desesperated… 7 day without pc!!!

here is my log! (it's this that i have to put here, huh?)
thx for your help!




Logfile of HijackThis v1.99.1
Scan saved at 15:29:16, on 28/10/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\SISAUDUT.EXE
C:\WINDOWS\WINPOS.EXE
C:\WINDOWS\LOADQM.EXE
C:\ARQUIVOS DE PROGRAMAS\ARQUIVOS COMUNS\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHAGENT.EXE
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHSURVEY.EXE
C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\ARQUIVOS DE PROGRAMAS\MSN MESSENGER\MSNMSGR.EXE
C:\SHAREAZA\SHAREAZA.EXE
C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.EXE
C:\ARQUIVOS DE PROGRAMAS\SAMSUNG\DIGIMAX VIEWER 2.0\STIMGBROWSER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE
C:\ARQUIVOS DE PROGRAMAS\VELOX\DISCADOR\DISCADOR.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\ARQUIVOS DE PROGRAMAS\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HJT\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Arquivos de programas\NewDotNet\newdotnet7_22.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SiS7012Utility] C:\WINDOWS\SYSTEM\SiSAudUt.exe -wdm
O4 - HKLM\..\Run: [winpos] C:\WINDOWS\winpos.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\ARQUIV~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\SYSTEM\cmrss.exe
O4 - HKLM\..\Run: [msbcs] C:\WINDOWS\SYSTEM\msbcs.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [lsass32] c:\lsass32.exe
O4 - HKLM\..\Run: [ ] C:\WINDOWS\Expert_Corp.exe
O4 - HKLM\..\Run: [kav] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE -r"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\SHAREAZA\SHAREAZA.EXE" -tray
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O4 - Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Digimax Viewer 2.0.lnk = C:\Arquivos de programas\Samsung\Digimax Viewer 2.0\STImgBrowser.exe
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\SCIEPLUGIN.DLL
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
Post #2
As you saw I had the same issue. I am unqualified to give advice. Here are some fact to my case.

For me the little bugger stopped me from safe boot, ad-aware even reloaded would not work and it was progressive in nature.

Eventually I was down to starting all programs from the ctrl-alt-dlt menu as everything else was missing.

Ever impatient I simply stuck in my xp disk after backing up all my pics and music etc.., typed r format c: /q /ntsf, and viola here I am reinstalling all my freaking apps which I hate but its over…

I had 3 exe's that didn't belong one I remember from name was sniffer.exe. I am sorry the others I deleted without recording names.

(done post repair)I can tell you NONE of the curent programs I had inclusive of avg, adaware, norton corp ed, spybot, etc could find them, except sniffer, AVG found it. Knowing when the problem occured I searched all programs by modified date, and checked locations. Two exe's popped up located right on the c: and I knew I had no exe's loaded there.

Whatever it was was not friendly I did a search and found this:

Description of vmmdiag32.exe
This is a component of Trojan Goldun. Trojan Goldun is a Windows platform Trojan. Upon execution, it drops files in the registry, and latches itself onto startup processes, running every time the system boots.

Taken without permission from http://www.fbmsoftware.com/spyware-net/pro…iag32_exe/3429/

Good luck friend this one sucks pretty bad! :angry:
Post #3
:huh: well… in fact… i didn't understood much you said… should i delete these "exe"s? someone here, in my house, deleted vmmdiag.32.exe, and now everytime i boot my pc an error message appears tellind that "vmmdiag.32'' is missing… so this is where my problem starts, cause i can't boot my pc on nomal mode, just security it says that my video is configured improperly, but i can't even adjust it, this dayam trojan don't even let me configure my video, so i have to keep at 16 bits… i really need apropriate help here… cause i don't have how to create backups from my current files… i have no cd-recorder… at least not yet… so is there anybody that can really save me?
Post #4
Hi i_know_nothing

Welcome to the TomCoyote Forums
My name is mschroe919 and I am going to read your log.
I would like to help you So if you would….
Please be patient and I will be back as soon as possible.
Don't delete anything till I tell you, you could
mess up your PC.
Please post back and tell me what your PC is doing right now.
Can you get on the internet?
I will be around yet tonight for a while.
mschroe919
Post #5
DON'T DELETE (DO) ANYTHING ON MY ACCOUNT PLEASE! Sorry I wish I could help. Like I said I am not really qualified. I only know enough to be dangerous. I am sure one of the chaps will eventually be able to help. I was only hoping some additional input might help them help you. If you look there is a new post on the average of every 4-5 mins so it might take a couple days. I didn't delete anything and it told me vmmdaig was missing and that my video was jacked right from the get go I think that this is part of the virus. Sorry to confuse you and I hope you get it fixed soon. Because I couldn't wait to fix mine…I had to do a search on the net on how to reinstall windows xp home without losing my data, of course xp has an option to save data but I backed mine up as I wanted to FORMAT (erase) the entire folder containing the Windows® program as the write up said it was windows based. I wrote down the directions and followed them. It worked but I bet there is a better easier way as this took 5 hrs to do and I still have to reinstall all my stuff like office.
Post #6
Hi i_know_nothing,

I have read your log and there is a lot to do,
You might want to print out these instructions and
follow them in order.

First:
Instructions:

Download LSP-Fix from the following link and save it to a location you can find later if necessary.

LSP-Fix Download Link here:
http://www.bleepingcomputer.com/files/lspfix.php

Follow these steps to remove Webhancer:

1. Click on start, settings, control panel.

2. Double-click on the Add/Remove Programs icon.

3. Uninstall Webhancer from the listing of programs
Also Look through the installed programs for a program called New.Net or NewDotNet.
. If there is no uninstall program listed then do the following:
1. Go to www.newdotnet.com/removal.html
2. Scroll down to Procedure 4and follow the removal instructions.

4. Delete the files in RED

c:\program files\webhancer
c:\windows\webhdll.dll
c:\windows\whagent.inf
c:\windows\whInstaller.exe
c:\windows\whInstaller.ini
Note:
If you can not connect to the Internet after removing Webhancer,and or New.Net or NewDotNet, please run the LSP-Fix program I had you download earlier, and click on the finish button. Reboot and you should be able to get back on.

At this point, Webhancer should now be removed from your computer.

Then reboot to safe mode and delete the file in RED C:\Program Files\NewDotNet\ directory.
Not to worry if can't find any of these I asked to delete.
Note:
While in safe mode Please run a scan on HijackThis and put a check by the following:

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Arquivos de programas\NewDotNet\newdotnet7_22.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O4 - HKLM\..\Run: [winpos] C:\WINDOWS\winpos.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\ARQUIV~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\SYSTEM\cmrss.exe
O4 - HKLM\..\Run: [msbcs] C:\WINDOWS\SYSTEM\msbcs.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [lsass32] c:\lsass32.exe
O4 - HKLM\..\Run: [ ] C:\WINDOWS\Expert_Corp.exe

Please remember to close all other windows, including browsers then click Fix checked
NEXT:

Still in safe mode:

we need to show some hidden files. Click Start>>>>Control Panel>>>>Folder Options and double click.
Under the View tab scroll down to Hidden Files and Folders
Check Show hidden files and folders
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files (Recommended} Answer Yes
Click Apply and click OK

Still in safe mode:

Using Windows Explorer, navigate and delete the following folders and files,the ones inRED if found:(not to worry if not there).

C:\Arquivos de programas\NewDotNet\newdotnet7_22.dll
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
C:\WINDOWS\winpos.exe
C:\WINDOWS\SYSTEM\cmrss.exe
C:\WINDOWS\SYSTEM\msbcs.exe
C:\lsass32.exe
C:\WINDOWS\Expert_Corp.exe

Reboot and Rescan with HJT and post a new log here.

Also please describe how your computer behaves now.
There will be more to do when I see the next post
Your doing well
Good luck mschroe919
Post #8
HI!
well… I've done everything you said… i found almost all files, and fixed what you asked, and deleted the files you asked…
up to now… well didn't change much, but i can boot my pc on normal mode, but i can't configure my video, everytime i try an error message appears… the vmmdiag.32 keeps ginving my pc error messages…
but i can connect my net, and do eerything… my video is configured to 640*480*16…

here is the new log file!

Logfile of HijackThis v1.99.1
Scan saved at 10:34:51, on 29/10/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\SISAUDUT.EXE
C:\WINDOWS\LOADQM.EXE
C:\ARQUIVOS DE PROGRAMAS\ARQUIVOS COMUNS\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\MEUS DOCUMENTOS\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SiS7012Utility] C:\WINDOWS\SYSTEM\SiSAudUt.exe -wdm
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE -r"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Shareaza] "C:\SHAREAZA\SHAREAZA.EXE" -tray
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O4 - Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab


thanks for your help! and ready for the next step!
Post #9
Hi i_know_nothing
Lets give this a try:
Please download/unzip this:

Registry Search 2.0 by Bobbi Flekman © 2005

on regsearch.exe, and search for this:

vmmdiag

[external image: Posted Image] Make sure ALL the boxes are checked under "Search".

It may take a while to run, so be patient. When finished, the search results will appear in your text editor,

Post back to here the contents of the search results.
Good luck mschroe919
Post #10
don't know if it's exactly what you expected… but i did as you said… the log is showed right below… REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 29/10/06 13:53:40 for strings: ; 'vmmdiag' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS ; End Of The Log… ah! that program you asked me to download… it stopped runing after the search ended, i don't know as you call in U.S.A, but here it's like it "buged", i had to "ctrl+alt+del" to finish it!… well… expecting the next step! just please don't tell me that my pc has no way!!! thanks!
Post #11
what you did was okay.
Now lets try this:

Copy the text in the following quote box into Notepad: Not word pad

cd c:\
dir vmm*.* /ah /s > files.txt
dir vmm*.* /s >> files.txt
notepad files.txt


Save it to your desktop as ff.bat

CLOSE NOTEPAD!!! NOT "MINIMIZE", CLOSE IT!!!!

Now, the ff.bat file on the desktop.

A Notepad window will open up.

It may take a while so be patient.

Please post it's contents.
good luck
mschroe919
Post #12
here it is! O volume da unidade C ‚ RONALD 1 O n£mero de s‚rie do volume ‚ 1767-14D9 Pasta de C:\ 14.246.44 MB livre(s) O volume da unidade C ‚ RONALD 1 O n£mero de s‚rie do volume ‚ 1767-14D9 Pasta de C:\WINDOWS\SYSTEM VMM32 26/02/06 13:33 VMM32 VMM32 VXD 936.574 26/02/06 13:36 VMM32.VXD 1 arquivo(s) 936.574 bytes Total de arquivos na lista: 1 arquivo(s) 936.574 bytes 1 pasta(s) 14.246.44 MB livre(s) that's all tha showed on the file… i did exactly what you did… and Closed the note pad! waiting for the next step! thankz!
Post #15
hi!
well… i'm in a kind of a big trouble here… i took a scan with avast, and it found kind of…. huhhh… all of my ".exe'' files infected with that virus… "Win32:Sality-O", well… so i moved all ''.exe'' files from my pc to that cage… "quarentena", don't know how it's called in english, but that place with a skull symbol… well, now it's like i can't use a single ".exe" file on my pc… so i had to move a few .exe files back, i still have the option to send them all back, but they're infected…. and i prefer wait until tell me what to do… i can connect for now on… but it took me sometime to find a way to do it!

here is the new logfile…



Logfile of HijackThis v1.99.1
Scan saved at 22:02:42, on 31/10/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\ARQUIVOS DE PROGRAMAS\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\TEMP\WZ1BDE\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARQUIVOS DE PROGRAMAS\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\GBIEH.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll
O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [avast! Web Scanner] C:\ARQUIV~1\ALWILS~1\AVAST4\ashWebSv.exe
O4 - HKLM\..\Run: [LightStart] E:\STFLASH.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\ARQUIV~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AVP] "C:\ARQUIVOS DE PROGRAMAS\KASPERSKY LAB\KASPERSKY ANTI-VIRUS 6.0\AVP.EXE -r"
O4 - HKLM\..\RunServices: [avast!] C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARQUIVOS DE PROGRAMAS\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab


everything was closed… for sure! thank you!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI