1 - Analise a parte abaixo e tente identificar as entradas maliciosas.


========== Files/Folders - Created Within 30 Days ==========

[2012/03/03 10:01:41 | 000,000,000 | ---D | C] -- C:\Users\GdH\AppData\Roaming\Auslogics
[2012/03/03 10:01:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
[2012/03/03 09:11:46 | 000,000,000 | ---D | C] -- C:\Users\GdH\Documents\Mamutu
[2012/03/03 08:50:42 | 000,000,000 | ---D | C] -- C:\Users\GdH\Documents\Battlefield 2 Demo
[2012/03/03 08:48:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES
[2012/03/01 18:26:03 | 000,000,000 | ---- | C] -- C:\WINDOWS\svchost.exe
[2012/03/01 12:03:35 | 000,000,000 | ---D | C] -- C:\Users\GdH\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Windows 7 USB DVD Download Tool
[2012/02/22 16:58:31 | 000,000,000 | ---D | C] -- C:\Users\GdH\Documents\DeepBlackReloaded
[2012/02/22 16:56:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deep Black Reloaded Demo
[2012/02/19 20:24:58 | 000,023,010 | ---D | C] -- C:\Program Files (x86)\Ask.com
[2012/02/15 18:37:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012/02/15 13:12:46 | 000,000,000 | ---D | C] -- C:\Users\GdH\AppData\Local\VMware
[2012/02/15 13:12:41 | 000,000,000 | ---D | C] -- C:\Users\GdH\AppData\Roaming\VMware
[2012/02/15 13:11:28 | 000,000,000 | ---D | C] -- C:\ProgramData\VMware
[2012/02/14 19:59:20 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2012/02/14 19:24:01 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012/02/14 19:24:01 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/02/14 19:24:00 | 002,308,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012/02/14 19:24:00 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012/02/14 19:24:00 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/02/14 19:23:59 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012/02/14 19:23:59 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/02/14 19:23:59 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012/02/14 19:23:59 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/02/14 19:23:58 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012/02/14 19:23:58 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/02/14 19:13:20 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2012/02/14 19:12:55 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2012/02/14 19:12:55 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2012/03/01 19:22:34 | 000,000,066 | ---- | C] -- C:\WINDOWS\system32\regscan.exe


2 - Baseado no log acima, crie um script para o OTL mesmo com a finalidade de remover as entradas maliciosas.

3. Baseado neste mesmo log do OTL, crie agora um script de correção para o Avenger.