Como deletar desktop.ini do pc

Boa tarde Danilo Marsaro, os desktop.ini ainda continuam aparecendo ?

• Baixe: <[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]> <(...by Farbar)>
  
• Salve-a na Área de trabalho
  
• Para Windows Vista ou 7, execute "FSS.exe" como administrador
  
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Marque as caixas conforme a imagem !
  
• Clique em "Scan" e aguarde o término !
  
• Poste o relatório ! (FSS.txt)
  

Um grande abraço.

Os icones desktop.ini eu apaguei todos manualmente sobraram alguns icones desktop nas pastas de músicas mais mu problema agora é que o pc não quer fazer a restauração do sistema, acho que vou ter que formatar o pc.

Boa tarde Danilo Marsaro, vamos tentar resolver sem formatar. Faça o procedimento anterior que eu te enviei. Um grande abraço.

ok!

Farbar Service Scanner Version: 17-01-2015
Ran by USUARIO (administrator) on 10-02-2015 at 13:29:39
Running from "C:\Users\USUARIO\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

• Baixe: <[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]> (...by Tweaking)
  
• Extraia os arquivos para a Desktop (área de trabalho).
  
• Execute o arquivo Repair_Windows.exe para iniciar a ferramenta !
  
• Clique na aba Repairs > > Certifique que a opção Automatically do a registry backup esteja marcada.
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Clique no botão Open Repairs.
  Clique no botão Unselect All para desmarcar todas as opções. Então marque:
  

  Código:

  
Reset Registry Permissions
Reset File Permissions
Register System Files
Repair WMI
Repair Windows Firewall
Remove Policies Set By Infections
Remove Temp Files
Repair Proxy Settings
Repair Windows Updates
Repair Volume Shadow Copy Service
Set Windows Services To Default Startup
Repair MSI (Windows Installer)

  
  
• Em seguida deixe marcado como está na imagem e dê o Start Repairs.
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Aguarde e ao término o PC será reiniciado.
  
• Aguarde e ao término o PC será reiniciado. Verifique se a restauração do sistema voltou a funcionar.
  

Um grande abraço.

Onde eu colo o código em verde?

não consegui usar a ferramenta pois não consigo colar o código em verde na ferramenta.

ah entendi, tem que marcar as caixinhas

Executei a ferramenta seguindo os passos indicados acima, reiniciei o pc, fiz a restauração do sistema mas ela trava na tela " Aguarde enquanto as configurações e aquivos do windows são restaurados A restauração do sintema está sendo inicializada"... fica travada nessa tela e tive que forçar o desligamento e reiniciar novamente...

Fiz novamente a restauração do sistema e dessa vez a tela não travou porem a restauração do sistema deu erro novamente.

Boa tarde Danilo, eu nao te respondi antes porque estava ocupado, mais tarde vamos tentar outro procedimento. Vamos esgotar todas as possibilidades antes de recorrer a formatacao. Um grande abraco.

Ok! fico no aguardo aqui.

Boa noite Danilo Marsaro, foi incluído no script a remoção de entradas ou referências ao Counter Strike.

Desinstale: C:\Program Files (x86)\ShowMyPC <<

• Selecione e copie o texto dentro do CODE, clique com o direito sobre a seleção e escolha a opção copiar:
  
• OBS: Certifique-se de copiar começando pela letra e sinal de dois pontos ":O" de OTL.
  

  Código:

  :OTL
O13 - gopher Prefix: missing
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[2015/02/09 17:43:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ShowMyPCService
[2015/02/05 11:45:49 | 000,000,000 | ---D | C] -- C:\AdsFix
[2015/01/25 10:29:36 | 000,000,000 | ---D | C] -- C:\Users\USUARIO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
[2015/01/24 18:34:40 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2015/01/24 18:34:40 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2015/01/24 18:34:40 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2015/02/09 17:42:47 | 002,029,954 | ---- | M] () -- C:\Users\USUARIO\Desktop\ShowMyPC3160 (1).zip
[2015/02/09 17:43:10 | 002,146,552 | ---- | C] () -- C:\Users\USUARIO\Desktop\ShowMyPC3160.exe
[2015/02/09 17:38:09 | 002,029,954 | ---- | C] () -- C:\Users\USUARIO\Desktop\ShowMyPC3160 (1).zip
[2015/01/24 18:34:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2015/01/24 18:34:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2015/01/08 20:43:30 | 000,000,823 | ---- | M] () -- C:\Users\USUARIO\Comandos  jogo Counter-Strike.txt
[2014/09/18 14:45:14 | 000,000,022 | ---- | M] () -- C:\Users\USUARIO\Configurar Wi-Fi.txt
[2014/07/17 17:08:36 | 000,000,065 | ---- | M] () -- C:\Users\USUARIO\Jackie Brown.txt
[2014/06/23 19:42:55 | 000,000,275 | ---- | M] () -- C:\Users\USUARIO\provedor speedy.txt

:Files
Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0 /f
type C:\Windows\SysNative\Tasks\{17D1591B-7F3F-43CB-B0BD-FDE478C58852} /C
type C:\Windows\SysNative\Tasks\{6D8AF99D-5815-460D-AE6E-2D2CB629EA4D} /C
type C:\Windows\SysNative\Tasks\{C24A606B-DDA7-46FE-8A8B-2696F4AC0DCB} /C
type C:\Windows\SysNative\Tasks\{CD12B747-AA70-4BC0-A3EE-7C0464ECEC62} /C
net start srservice
ipconfig /flushdns /c

:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"TCP Query User{5333097E-96A6-4B6F-8374-A8F705936B53}C:\games\counter-strike\hlds.exe" = -
"TCP Query User{69DFFE9B-7014-470C-A674-3350FD7FA53D}C:\games\counter-strike\hl.exe" = -
"TCP Query User{82CFE247-1208-4BE9-8879-AEA4C94A5126}C:\users\usuario\appdata\local\temp\showmypc\smpc3160\smpcph.exe" = -
"UDP Query User{1A07C505-1171-4F28-825F-EFE77ACF9AC1}C:\games\counter-strike\hl.exe" = -
"UDP Query User{31316E9C-182F-435E-9DF6-B4ABD5123145}C:\users\usuario\appdata\local\temp\showmypc\smpc3160\smpcph.exe" = -
"UDP Query User{5E6A53FE-D190-447F-9E0F-B14212E9E28B}C:\games\counter-strike\hlds.exe" = -
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000000
"SuperHidden"=dword:00000000
"Hidden"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"Gopher"="gopher://"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"

:Commands
[CREATERESTOREPOINT]
[purity]
[emptytemp]
[Reboot]



  
  
• Clique com o direito sobre o arquivo OTL.exe, depois clique em [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Clique com o direito em qualquer parte branca, da sessão "Exames Personalizados/Correções" e escolha a opção colar !
  
• Feche "TODAS" as janelas (exceto o próprio OTL).
  
• Clique no botão [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• O programa executará o script e poderá ser necessário reiniciar o seu computador.
  
• Quando o Windows for carregado, o OTL será executado automaticamente. Permita a sua execução.
  
• Um bloco de notas será aberto, contendo algumas informações.
  
• Copie "TODO" o conteúdo deste bloco de notas e cole na sua resposta.
  
• Uma cópia deste log ficará armazenado na pasta C:\_OTL\MovedFiles\*.log com o nome no seguinte formato data_hora.log.
  

Um grande abraço.

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.
File Protocol\Handler\wlpg - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
C:\Program Files (x86)\ShowMyPCService folder moved successfully.
C:\AdsFix\Whitelist folder moved successfully.
C:\AdsFix\Save\Registry [05.02.2015 @ 11_48_13]\Users\00000002 folder moved successfully.
C:\AdsFix\Save\Registry [05.02.2015 @ 11_48_13]\Users\00000001 folder moved successfully.
C:\AdsFix\Save\Registry [05.02.2015 @ 11_48_13]\Users folder moved successfully.
C:\AdsFix\Save\Registry [05.02.2015 @ 11_48_13] folder moved successfully.
C:\AdsFix\Save\Registry folder moved successfully.
C:\AdsFix\Save folder moved successfully.
C:\AdsFix\Res folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\Livros\Biologia.AdsFix folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\Livros folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Google\Chrome\User Data\Default folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Google\Chrome\User Data folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Google\Chrome folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Google folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Comodo\Dragon\User Data\Default folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Comodo\Dragon\User Data folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Comodo\Dragon folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\Comodo folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local\1941791.AdsFix folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData\Local folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO\AppData folder moved successfully.
C:\AdsFix\Quarantine\C\Users\USUARIO folder moved successfully.
C:\AdsFix\Quarantine\C\Users folder moved successfully.
C:\AdsFix\Quarantine\C folder moved successfully.
C:\AdsFix\Quarantine folder moved successfully.
C:\AdsFix folder moved successfully.
C:\Users\USUARIO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike folder moved successfully.
C:\Windows\SWREG.exe moved successfully.
C:\Windows\SWSC.exe moved successfully.
C:\Windows\NIRCMD.exe moved successfully.
C:\Users\USUARIO\Desktop\ShowMyPC3160 (1).zip moved successfully.
File C:\Users\USUARIO\Desktop\ShowMyPC3160.exe not found.
File C:\Users\USUARIO\Desktop\ShowMyPC3160 (1).zip not found.
C:\Windows\grep.exe moved successfully.
C:\Windows\zip.exe moved successfully.
C:\Users\USUARIO\Comandos jogo Counter-Strike.txt moved successfully.
C:\Users\USUARIO\Configurar Wi-Fi.txt moved successfully.
C:\Users\USUARIO\Jackie Brown.txt moved successfully.
C:\Users\USUARIO\provedor speedy.txt moved successfully.
========== FILES ==========
Invalid Switch: f
< type C:\Windows\SysNative\Tasks\{17D1591B-7F3F-43CB-B0BD-FDE478C58852} /C >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\system32\pcalua.exe</Command>
<Arguments>-a C:\Users\USUARIO\Downloads\wlsetup-all.exe -d C:\Users\USUARIO\Downloads</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>USUARIO-PC\USUARIO</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>
C:\Users\USUARIO\Desktop\cmd.bat deleted successfully.
C:\Users\USUARIO\Desktop\cmd.txt deleted successfully.
< type C:\Windows\SysNative\Tasks\{6D8AF99D-5815-460D-AE6E-2D2CB629EA4D} /C >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\system32\pcalua.exe</Command>
<Arguments>-a C:\Users\USUARIO\Desktop\Setup.exe -d C:\Users\USUARIO\Desktop</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>USUARIO-PC\USUARIO</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>
C:\Users\USUARIO\Desktop\cmd.bat deleted successfully.
C:\Users\USUARIO\Desktop\cmd.txt deleted successfully.
< type C:\Windows\SysNative\Tasks\{C24A606B-DDA7-46FE-8A8B-2696F4AC0DCB} /C >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Author>SkypeSetup</Author>
</RegistrationInfo>
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>"C:\Users\USUARIO\AppData\Local\Google\Chrome\Application\chrome.exe"</Command>
<Arguments>http://ui.skype.com/ui/0/6.16.0.105.202/pt/abandoninstall?page=tsMain</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<GroupId>S-1-5-32-545</GroupId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>
C:\Users\USUARIO\Desktop\cmd.bat deleted successfully.
C:\Users\USUARIO\Desktop\cmd.txt deleted successfully.
< type C:\Windows\SysNative\Tasks\{CD12B747-AA70-4BC0-A3EE-7C0464ECEC62} /C >
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo />
<Triggers>
<RegistrationTrigger>
<Enabled>true</Enabled>
</RegistrationTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>C:\Windows\system32\pcalua.exe</Command>
<Arguments>-a "C:\Users\USUARIO\Downloads\wlsetup-web (2).exe" -d C:\Users\USUARIO\Downloads</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>USUARIO-PC\USUARIO</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>
C:\Users\USUARIO\Desktop\cmd.bat deleted successfully.
C:\Users\USUARIO\Desktop\cmd.txt deleted successfully.
File\Folder net start srservice not found.
< ipconfig /flushdns /c >
Configura‡Æo de IP do Windows
Libera‡Æo do Cache do DNS Resolver bem-sucedida.
C:\Users\USUARIO\Desktop\cmd.bat deleted successfully.
C:\Users\USUARIO\Desktop\cmd.txt deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{5333097E-96A6-4B6F-8374-A8F705936B53}C:\games\counter-strike\hlds.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{69DFFE9B-7014-470C-A674-3350FD7FA53D}C:\games\counter-strike\hl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{82CFE247-1208-4BE9-8879-AEA4C94A5126}C:\users\usuario\appdata\local\temp\showmypc\smpc3160\smpcph.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{1A07C505-1171-4F28-825F-EFE77ACF9AC1}C:\games\counter-strike\hl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{31316E9C-182F-435E-9DF6-B4ABD5123145}C:\users\usuario\appdata\local\temp\showmypc\smpc3160\smpcph.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{5E6A53FE-D190-447F-9E0F-B14212E9E28B}C:\games\counter-strike\hlds.exe deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000000 /E : value set successfully!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000000 /E : value set successfully!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000000 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\"Gopher"|"gopher://" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default

User: Default User

User: Public

User: Todos os Usuários

User: USUARIO
->Temp folder emptied: 19358411 bytes
->Temporary Internet Files folder emptied: 301956 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 23550936 bytes
->Flash cache emptied: 291 bytes

User: Usuário Padrão

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 533023 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 181492 bytes

Total Files Cleaned = 42,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02102015_215127

Files\Folders moved on Reboot...
C:\Users\USUARIO\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Boa noite Danilo, como esta o PC ?

O PC ainda não está fazendo a restauração do sistema, já tentei em vários pontos mais da erro.

Boa noite Danilo Marsaro, você teria o DVD de instalação do Windows 7?

infelizmente não ! apenas um cd q veio junto com o pc o Motherboard...

Boa noite Danilo, vamos fazer mais algumas tentativas. Daqui a pouco eu retorno.

ok!

Boa noite Danilo Marsaro,

• Baixe:<[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]> ( ... de g3n-h@chm@n )
  
• Estando na página,clique: <[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]>
  
• Salve-a no Desktop (Área de trabalho)
  
• Desative temporariamente seu antivírus e/ou antispywares ativos para evitar conflitos.
  
• Feche o(s) navegador (es) e outros programas que estejam abertos.
  
  
• Usuários do Windows Vista, Windows 7 ou Windows 8: Clique com o botão direito do mouse sobre o arquivo Pre_Scan.exe, depois clique em [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
  
• Já se o Windows for o XP, dê um duplo clique com o botão esquerdo do mouse sobre o executável para iniciá-lo.
  
  
• Caso surja uma mensagem de confirmação do Windows com a pergunta Deseja permitir que o programa de um fornecedor desconhecido faça alterações neste computador? > Clique em Sim.
  
  
• Surgirá esta mensagem abaixo na qual você clicará em OK:
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• OBS: Durante o scan, sua área de trabalho irá desaparecer e somente este banner abaixo que é o representativo do programa irá aparecer e logo na parte inferior dele você poderá ver os arquivos que estão sendo escaneados pelo programa, isso é normal e faz parte do funcionamento da ferramenta:
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Se forem encontradas infecções, aparecerá uma mensagem pedindo reinicialização do PC para completar a limpeza. Clique em OK para confirmar.
  
• Assim que o computador tiver reiniciado ou então o escaneamento tiver terminado sem reiniciar, o relatório do Pre_scan estará em C:\Pre_Scan\Pre_Scan_07_05_2014_17_05_22.txt(estes números em vermelho irão variar pois eles mostram a data e hora em que o escaneamento foi realizado).
  

Um grande abraço.

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | g3n-h@ckm@n | 05.02.10.1 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤ - Start 01:20:17

Updated 10/02/2015 | 20.30 by g3n-h@ckm@n
Contact : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Pre_scan Feedbacks : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

[USUARIO (Administrator)] - [USUARIO-PC]
SID = S-1-5-21-175776811-1190452811-461850122-1000

Boot: Normal boot
System : Windows 7 Home Premium (64 bits) HomePremium Service Pack 1
ProcessorNameString : Intel(R) Core(TM)2 Duo CPU     E7500  @ 2.93GHz
Identifier : Intel64 Family 6 Model 23 Stepping 10


Memory RAM = Total (MB) : 3136 | Free (MB) : 1973
Pagefile = Total (MB) : 6270 | Free (MB) : 4984
Virtual = Total (MB) : 4194 | Free (MB) : 4024

¤¤¤¤¤¤¤¤¤¤ # Components of starting up


¤¤¤¤¤¤¤¤¤¤¤ # Drives

C:\-> [Fixed] | [] | Total : 476840 Mo | Free : 213440 Mo -> NTFS

¤¤¤¤¤¤¤¤¤¤ # Windows updates

No detected update !!!


¤¤¤¤¤¤¤¤¤¤ # Sessions

C:\Windows\system32\config\systemprofile
C:\Windows\ServiceProfiles\LocalService
C:\Windows\ServiceProfiles\NetworkService
C:\Users\USUARIO

Registry saved , to restore : C:\Pre_Scan\Save\Scan\ERDNT.exe


¤¤¤¤¤¤¤¤¤¤ # Browsers

IE : 11.0.9600.17239     (© Microsoft Corporation. Todos os direitos reservados.)
GC : 40.0.2214.111     (Copyright 2012 Google Inc.)

¤¤¤¤¤¤¤¤¤¤ # FlashPlayer

ActiveX : 16.0.0.305

?????????? | Security

AS : Windows Defender Enabled
FW :
WMI : OK
WU: Windows Update Service [Auto(2)] = stopped
AS: Windows Defender [Auto(2)] = stopped
FW: Windows FireWall Service [Auto(2)] = stopped

¤¤¤¤¤¤¤¤¤¤ # Stopped processes

1264 | [Owner : USUARIO |Parent : 596] - (.Microsoft Corporation - Processo de Host para Tarefas do Windows.) - (6.1.7601.18010) = C:\Windows\System32\taskhost.exe
1300 | [Owner :  |Parent : 596] - (.Microsoft Corporation - Aplicativo de subsistema de spooler.) - (6.1.7601.17777) = C:\Windows\System32\spoolsv.exe
1424 | [Owner : SISTEMA |Parent : 596] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - (1.802.11.4130) = C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
1432 | [Owner : USUARIO |Parent : 1220] - (.Microsoft Corporation - Windows Explorer.) - (6.1.7601.17567) = C:\Windows\explorer.exe
1640 | [Owner : SISTEMA |Parent : 596] - (.Microsoft Corporation - Updates Skype Click to Call.) - (7.3.16540.9015) = C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
1688 | [Owner : SERVIÇO DE REDE |Parent : 596] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) - (7.3.16540.9015) = C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
1956 | [Owner : SISTEMA |Parent : 596] - (.Motorola Mobility LLC - MotoHelper Service.) - (2.3.8.0) = C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
2020 | [Owner : USUARIO |Parent : 1432] - (.VIA - VIA HD Audio CPL.) - (10.12.0.30) = C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
2036 | [Owner : USUARIO |Parent : 1432] - (.Intel Corporation - hkcmd Module.) - (8.14.10.1930) = C:\Windows\System32\hkcmd.exe
2044 | [Owner : USUARIO |Parent : 1432] - (.Nero AG - Nero Home.) - (2.0.17.0) = C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
1492 | [Owner : SISTEMA |Parent : 596] - (.Motorola - ForwardDemon.) - (1.0.0.0) = C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
2176 | [Owner : SISTEMA |Parent : 596] - (.VIA Technologies, Inc. - Service binary.) - (0.1.0.0) = C:\Windows\System32\ViakaraokeSrv.exe
2288 | [Owner : SISTEMA |Parent : 596] - (.Microsoft Corp. - Microsoft® Windows Live ID Service.) - (7.250.4311.0) = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2312 | [Owner : SERVIÇO DE REDE |Parent : 596] - (.Microsoft Corporation - Serviço de Compartilhamento de Rede do Windows Media Player.) - (12.0.7601.17514) = C:\Program Files\Windows Media Player\wmpnetwk.exe
2356 | [Owner : SISTEMA |Parent : 596] - (.Microsoft Corporation - Indexador do Microsoft Windows Search.) - (7.0.7601.17610) = C:\Windows\System32\SearchIndexer.exe
2372 | [Owner : USUARIO |Parent : 1956] - (.Motorola Mobility LLC - MotoHelperAgent.) - (2.3.7.0) = C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
2432 | [Owner : SISTEMA |Parent : 2288] - (.Microsoft Corp. - Microsoft® Windows Live ID Service Monitor.) - (7.250.4311.0) = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2880 | [Owner : SISTEMA |Parent : 596] - (.Nero AG - Nero Home.) - (2.0.17.0) = C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
3052 | [Owner : USUARIO |Parent : 724] - (.Nero AG - Nero Home.) - (2.0.17.0) = C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
3196 | [Owner : SERVIÇO LOCAL |Parent : 940] - (.Microsoft Corporation - Windows Driver Foundation - Processo de Host da Estrutura de Driver de Modo de Usuário.) - (6.2.9200.16384) = C:\Windows\System32\WUDFHost.exe
4464 | [Owner : SISTEMA |Parent : 2356] - (.Microsoft Corporation - Microsoft Windows Search Protocol Host.) - (7.0.7601.17610) = C:\Windows\System32\SearchProtocolHost.exe
3372 | [Owner : SISTEMA |Parent : 1620] - (.Kaspersky Lab ZAO - WMI x64 Helper.) - (14.0.0.4651) = C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\wmi64.exe
2500 | [Owner : USUARIO |Parent : 724] - (.Microsoft Corporation - Processo de host do Windows (Rundll32).) - (6.1.7600.16385) = C:\Windows\System32\rundll32.exe

¤¤¤¤¤¤¤¤¤¤ # Winlogon user


¤¤¤¤¤¤¤¤¤¤ # Winlogon machine

Repaired : [HKLM | Winlogon]|[userinit] : userinit.exe, -> C:\Windows\Syswow64\userinit.exe,

¤¤¤¤¤¤¤¤¤¤ # Associations



¤


¤¤¤¤¤¤¤¤¤¤ # Registry

Repaired : HKLM\software\Microsoft\Windows\CurrentVersion\policies\Explorer]~[NoDriveTypeAutoRun] : 189 -> 145
Repaired : HKU\S-1-5-21-175776811-1190452811-461850122-1000\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]~[Hidden] : 2 -> 0
Repaired : HKU\S-1-5-21-175776811-1190452811-461850122-1000\software\Microsoft\Windows\CurrentVersion\Policies\Explorer]~[NoDriveTypeAutoRun] : 221 -> 145

¤¤¤¤¤¤¤¤¤¤ # Registry and Task manager access


¤¤¤¤¤¤¤¤¤¤ # SafeBoot

Safeboot Keys are O.K

Alternate shell is OK !

?

Safeboot Minimal Subkeys : O.K !

?

Safeboot Network Subkeys : O.K !

¤¤¤¤¤¤¤¤¤¤ # IFEO


¤¤¤¤¤¤¤¤¤¤ # Mountpoints2



¤¤¤¤¤¤¤¤¤¤ # Windows

[HKLM64\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]|[] : @SYS:Software\Swearware\dump
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]|[Shell] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon
[HKLM64\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]|[Shell] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon
[HKLM64\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini]|[winlogon] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

¤¤¤¤¤¤¤¤¤¤ # Security center

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{003e0278-eca8-4bb8-a256-3689ca1c2600}]|[Autostart] : C:\Windows\system32\shell32.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{3BF043EF-A974-49B3-8322-B853CF1E5EC5}]|[Autostart] : C:\Windows\System32\SndVolSSO.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{68ddbb56-9d1d-4fd9-89c5-c0da2a625392}]|[Autostart] : C:\Windows\system32\stobject.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{7007ACCF-3202-11D1-AAD2-00805FC1270E}]|[Autostart] : C:\Windows\System32\netshell.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{7849596a-48ea-486e-8937-a2a3009f31a9}]|[Autostart] : C:\Windows\system32\shell32.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{900c0763-5cad-4a34-bc1f-40cd513679d5}]|[No 'Autostart'] : C:\Windows\System32\hcproviders.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{900c0763-5cad-4a34-bc1f-40cd513679d5}]|[No 'Autostart'] : C:\Windows\System32\hcproviders.dll     C:\Windows\System32\hcproviders.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{A1607060-5D4C-467a-B711-2B59A6F25957}]|[Autostart] : C:\Windows\System32\AltTab.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}]|[Autostart] : C:\Windows\system32\wpdshserviceobj.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{C2796011-81BA-4148-8FCA-C6643245113F}]|[Autostart] : C:\Windows\System32\pnidui.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{DA67B8AD-E81B-4c70-9B91-B417B5E33527}]|[Autostart] : C:\Windows\System32\srchadmin.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{EF4D1E1A-1C87-4AA8-8934-E68E4367468D}]|[Autostart] : C:\Windows\SysWOW64\shdocvw.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F08C5AC2-E722-4116-ADB7-CE41B527994B}]|[Autostart] : C:\Windows\SysWOW64\bthprops.cpl     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F20487CC-FC04-4B1E-863F-D9801796130B}]|[Autostart] : C:\Windows\System32\SyncCenter.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}]|[Autostart] : C:\Windows\System32\Actioncenter.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{fbeb8a05-beee-4442-804e-409d6c4515e9}]|[Autostart] : C:\Windows\system32\shell32.dll     [ok]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{ff363bfe-4941-4179-a81c-f3f1ca72d820}]|[Autostart] : C:\Windows\System32\hgcpl.dll     [ok]


Repaired : [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]|[EnableFirewall] : 1 -> 0
Repaired : [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]|[EnableFirewall] : 1 -> 0
Repaired : [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]|[EnableFirewall] : 1 -> 0

¤¤¤¤¤¤¤¤¤¤ # Correction of the services


Repaired : [srService] :  -> 2
Repaired : [Parvdm] :  -> 2
Repaired : [NVSvc] :  -> 2
Repaired : [NIHardwareService] :  -> 2
Repaired : [IKEEXT] : 3 -> 2
Repaired : [IAStorDataMgrsvc] :  -> 2
Repaired : [agp440] : 3 -> 2
Repaired : [ERSvc] :  -> 2
Repaired : [Bits] : 3 -> 2
Repaired : [EapHost] : 3 -> 2
Repaired : [SharedAccess] : 4 -> 2
Repaired : [wudfsvc] : 3 -> 2
Repaired : [WerSvc] : 3 -> 2

¤¤¤¤¤¤¤¤¤¤ # Internet Explorer


¤¤¤¤¤¤¤¤¤¤ # reparsepoint



¤¤¤¤¤¤¤¤¤¤ # Detection of offsets


¤¤¤¤¤¤¤¤¤¤ # Files | Folders | Registry


Moved to quarantine successfully : C:\$Recycle.bin\S-1-5-21-175776811-1190452811-461850122-1000\desktop.ini
Deleted : C:\$Recycle.bin\S-1-5-21-175776811-1190452811-461850122-1000

Will be moved in quarantine at reboot : C:\ProgramData\ntuser.dat{c21d7429-fb0f-11e3-b71a-0025224fc22f}.TM.blf
Will be moved in quarantine at reboot : C:\ProgramData\ntuser.dat{c21d7429-fb0f-11e3-b71a-0025224fc22f}.TMContainer00000000000000000001.regtrans-ms
Will be moved in quarantine at reboot : C:\ProgramData\ntuser.dat{c21d7429-fb0f-11e3-b71a-0025224fc22f}.TMContainer00000000000000000002.regtrans-ms

¤¤¤¤¤¤¤¤¤¤ # ADS


Prefetch -> cleaned



?????????? | Hidden files

~ [Program Files] : Hidden : 1 | Restored : 1
~ [Searches] : Hidden : 2 | Restored : 2
~ [Windows] : Hidden : 7 | Restored : 7
~ [Libraries] : Hidden : 21 | Restored : 21


¤¤¤¤¤¤¤¤¤¤ # Control of the partitions

Disk: 0   Size=477G
Pos MBRndx Type/Name  Size Active Hide Start Sector   Sectors
--- ------ ---------- ---- ------ ---- ------------ ------------
 0    0    07-NTFS    100M   Yes   No         2,048      204,800
 1    1    07-NTFS    477G   No    No       206,848  976,564,224

¤¤¤¤¤¤¤¤¤¤

[HKLM | Winlogon] | AutoRestartShell : 0 -> 1
[HKLM64 | Winlogon] | AutoRestartShell : 0 -> 1

End : 01:25:23


¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤ - 229

Fiz a restauração do sistema e novamente deu erro!

Bom dia Danilo Marsaro, vamos tentar acionar o ponto estabelecido pela ferramenta JRT, e tentar uma  Restauração ao Registro pela ERUNT a um ponto anterior à ocorrência do problema com a Restauração do Sistema.

• Navegue até C:\WINDOWS\ERUNT\JRT\ERDNT <<
  
• Dê dois cliques em [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Será mostrada uma janela de boas vindas, de OK
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Deixe conforme imagem abaixo, pois a maneira correta de restaurá-lo é detectado automaticamente pelo ERDNT
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Ao término do proceso será mostrada uma imagem indicando que a restauração foi completada.
  
• O PC deve ser reiniciado.
  

Um grande abraço.

Executei o procedimento acima, reiniciei o pc e tentei fazer a restauração do sistema, porem sem sucesso pois deu erro novamente.

Boa tarde Danilo Marsaro, apague seus antigos Pontos que foram estabelecidos.

• Clique no botão Iniciar, clique com o botão direito em Computador e clique em Propriedades.
  
• No painel esquerdo, clique em Proteção do sistema.  É necessário ter permissão do administrador. Se você for solicitado a informar uma senha de administrador ou sua confirmação, digite a senha ou forneça a confirmação.
  
• Na imagem abaixo clique em "Configurar".
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Em Uso do Espaço em Disco, mova o controle deslizante para a direita para aumentar o espaço em disco que essa proteção do sistema pode utilizar.
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  

Veja se a Restauração do Sistema voltou a funcionar normalmente. Um grande abraço.

Não deu certo! pc continua sem fazer a restauração do sistema, sempre da erro!

Boa tarde Danilo, você excluiu os pontos antigos e criou um novo para testar a restauração do sistema ?

Sim criei um novo ponto de restauração porém sem sucesso, continua dando erro.

Boa tarde Danilo, vamos realizar uma última tentativa. Mais tarde eu retorno com o procedimento. Um grande abraço.