[Resolvido] &nbspApareceu outra maquina infectada

Desculpa, nao pude mais editar, então estou postando aqui mais um log. :thumbsup:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Versão da Base de Dados: v2012.06.01.05

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

f003654 :: FUN0003 [limitado]

01/06/2012 15:17:59

mbam-log-2012-06-01 (15-17-59).txt

Tipo de Verificação: Verificação Completa

Opções de verificações ativadas: Memória | Inicialização | Registro | Sistema de arquivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM

Opções de verificação desativadas: P2P

Objetos escaneados: 512586

Tempo decorrido: 1 hora(s), 35 minuto(s), 13 segundo(s)

Processos de Memória Detectados: 0

(Não foram detectados ítens maliciosos)

Módulos de Memória Detectados: 0

(Não foram detectados ítens maliciosos)

Chaves de Registro Detectadas: 0

(Não foram detectados ítens maliciosos)

Valores de Registro Detectadas: 0

(Não foram detectados ítens maliciosos)

Itens de Dados no Registro Detectadas: 0

(Não foram detectados ítens maliciosos)

Pastas Detectadas: 0

(Não foram detectados ítens maliciosos)

Arquivos Detectados: 6

c:\documents and settings\all users\dados de aplicativos\winpro.exe (Trojan.Dropper.PGen) -> Enviado para a Quarentena e deletado com sucesso.

C:\Documents and Settings\f003269\Desktop\SoftonicDownloader_para_dvdfab.exe (PUP.BundleOffer.Downloader.S) -> Enviado para a Quarentena e deletado com sucesso.

C:\Documents and Settings\f003654\Configurações locais\Temp\ICReinstall_PDFCreatorSetup[1].exe (Adware.Agent) -> Enviado para a Quarentena e deletado com sucesso.

c:\linhadefensiva\qua\arquivos\dados de aplicativos\wina.exe.vir (Malware.Packer.Gen) -> Enviado para a Quarentena e deletado com sucesso.

c:\linhadefensiva\qua\arquivos\dados de aplicativos\wini.exe.vir (Spyware.Banker) -> Enviado para a Quarentena e deletado com sucesso.

c:\linhadefensiva\qua\arquivos\dados de aplicativos\wins.exe.vir (Spyware.Banker) -> Enviado para a Quarentena e deletado com sucesso.

(fim)

Olá Edvan

1.

Baixe o createsrp (...de Ramesh Srinivasan*) e salve-o no desktop (Área de Trabalho)

*Execute-o e clique [OK]

2.

*Desative temporariamente seu antivírus

Baixe o ComboFix (...de sUBs*) e salve-o no desktop (Área de Trabalho)

*Execute-o e aceite o contrato.

*Usuários do Windows Vista ou do Windows 7 devem clicar com o botão direito do mouse no arquivo e selecionar Executar como administrador

*Usuários do Windows XP: Se o Console de Recuperação do Microsoft Windows não estiver instalado, aceite a sua instalação. Após a instalação do Console, clique [sim] e aguarde a conclusão das etapas

/applications/core/interface/imageproxy/imageproxy.php?img=http://img375.imageshack.us/img375/6271/etapas.jpg&key=886faf50f6e4a02cfc852e77d70bb52b257bfe1b6dfadc5fb94284cceb208d2e" alt="etapas.jpg" />

1) Não use o mouse nem o teclado durante as etapas!!

2) Para interromper o scan, tecle N

*Cole o relatório apresentado

Bom dia amigo.

Ao tentar baixar o createsrp apareceu a mensagem abaixo:

WikiFortioFile sharing serviceFile with ID '696317' doesn't exist or has expired and is no longer available

Pode rodar o combofix ou tem que seguir a ordem do que você postou?

>
Bom dia amigo.

Ao tentar baixar o createsrp apareceu a mensagem abaixo:

Pode rodar o combofix ou tem que seguir a ordem do que você postou?

Bom dia...

O link foi corrigido.

Eu gosto de criar um ponto de restauração antes.... :thumbsup:

Ponto criado..

Log abaixo:

ComboFix 12-06-03.05 - f003654 04/06/2012 12:30:21.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.767.414 [GMT -3:00]

Executando de: c:\documents and settings\f003654\Desktop\ComboFix.exe

AV: avast! Antivirus Disabled/Updated {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

ADS - system32: deleted 2 bytes in 1 streams.

ADS - drivers: deleted 208 bytes in 1 streams.

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\IsUn0416.exe

c:\windows\system\chron32.dll

c:\windows\system\libeay32.dll

c:\windows\system\ssleay32.dll

c:\windows\system32\dllcache\dlimport.exe

.

.

(((((((((((((((( Arquivos/Ficheiros criados de 2012-05-04 to 2012-06-04 ))))))))))))))))))))))))))))

.

.

2012-06-01 18:15 . 2012-06-01 18:15 -------- d-----w- c:\documents and settings\f003654\Dados de aplicativos\Malwarebytes

2012-06-01 18:14 . 2012-06-01 18:14 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2012-06-01 18:14 . 2012-06-01 18:15 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2012-06-01 18:14 . 2012-04-04 18:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-01 18:08 . 2012-06-01 18:08 388608 ----a-w- C:\HiJackThis.exe

2012-06-01 18:02 . 2012-06-01 18:03 -------- d-----w- C:\LinhaDefensiva

2012-05-08 10:49 . 2012-05-08 10:50 -------- d-----w- c:\documents and settings\f002951

.

.

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-04 15:30 . 2012-03-12 19:53 28880 ----a-w- c:\windows\system32\drivers\GbpNdisrd.sys

2012-04-05 12:34 . 2012-03-12 19:52 46408 ----a-w- c:\windows\system32\drivers\gbpkm.sys

2012-03-15 11:09 . 2011-07-01 19:46 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-03-07 00:15 . 2011-05-18 13:03 41184 ----a-w- c:\windows\avastSS.scr

2012-03-07 00:15 . 2011-05-18 12:56 201352 ----a-w- c:\windows\system32\aswBoot.exe

2012-03-07 00:03 . 2011-05-18 13:03 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-03-07 00:03 . 2011-05-18 12:56 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-03-07 00:02 . 2011-05-18 12:56 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2012-03-07 00:01 . 2011-05-18 12:56 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-03-07 00:01 . 2011-05-18 12:56 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2012-03-07 00:01 . 2011-05-18 12:56 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys

2012-03-07 00:01 . 2011-05-18 12:56 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-03-06 23:58 . 2011-05-18 12:56 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys

.

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

Nota entradas vazias e legítimas por padrão não são apresentadas.

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-03-07 00:15 123536 ----a-w- c:\arquivos de programas\Alwil Software\Avast5\ashShell.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]

"SoundMAXPnP"="c:\arquivos de programas\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpqSRMon"="c:\arquivos de programas\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"DkStartup"="c:\arquivos de programas\SafeNet\BSecClient\dkstartup.exe" [2008-07-29 49152]

"AxMonitor"="c:\arquivos de programas\SafeNet\BSecClient\axmonitor.exe" [2008-07-29 450560]

"DkAutoReg"="c:\arquivos de programas\SafeNet\BSecClient\DkAutoReg.exe" [2008-07-29 253952]

"avast"="c:\arquivos de programas\Alwil Software\Avast5\avastUI.exe" [2012-03-07 4241512]

"SunJavaUpdateSched"="c:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

.

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Acrobat Assistant.lnk - c:\arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-4-7 217190]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]

2012-05-09 12:01 1313864 ----a-w- c:\arquivos de programas\GbPlugin\gbieh.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DkWLNP]

2008-07-29 10:01 61440 ----a-w- c:\windows\system32\DkWLNP.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-06-09 08:06 976832 ----a-w- c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqpse.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Arquivos de programas\\HP\\HP Software Update\\HPWUCli.exe"=

"c:\\Fortes\\RemProt\\remprots.exe"=

"c:\\Arquivos de programas\\Java\\jre6\\bin\\javaw.exe"=

.

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [12/03/2012 16:52 46408]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [18/05/2011 10:03 612184]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [18/05/2011 09:56 337880]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18/05/2011 09:56 20696]

R2 DkVcm;SafeNet Virtual Channel Monitor;c:\windows\system32\dkvcm.exe [29/07/2008 07:01 122880]

R2 FirebirdGuardianFortes_FB2_1;Firebird Guardian - Fortes_FB2_1;c:\fortes\Firebird\Firebird_2_1\bin\fbguard.exe -s Fortes_FB2_1 --> c:\fortes\Firebird\Firebird_2_1\bin\fbguard.exe -s Fortes_FB2_1 [?]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [12/03/2012 16:52 214088]

R2 RemProtNTService;RemProtNTService;c:\fortes\RemProt\remprots.exe [15/04/2011 08:17 616448]

R3 FirebirdServerFortes_FB2_1;Firebird Server - Fortes_FB2_1;c:\fortes\Firebird\Firebird_2_1\bin\fbserver.exe -s Fortes_FB2_1 --> c:\fortes\Firebird\Firebird_2_1\bin\fbserver.exe -s Fortes_FB2_1 [?]

R3 iKeyEnum;Rainbow iKey Enumerator;c:\windows\system32\drivers\IKEYENUM.SYS [18/03/2011 15:43 12240]

R3 iKeyIFD;Rainbow iKey Virtual Reader;c:\windows\system32\drivers\IKEYIFD.SYS [18/03/2011 15:43 18704]

R3 NdisrdMP;NdisrdMP;c:\windows\system32\drivers\GbpNdisrd.sys [12/03/2012 16:53 28880]

S2 gupdate;Google Update Service (gupdate);c:\arquivos de programas\Google\Update\GoogleUpdate.exe [24/08/2010 15:06 135664]

S3 gupdatem;Serviço do Google Update (gupdatem);c:\arquivos de programas\Google\Update\GoogleUpdate.exe [24/08/2010 15:06 135664]

S3 Ndisrd;GAS Tecnologia Service;c:\windows\system32\drivers\GbpNdisrd.sys [12/03/2012 16:53 28880]

S3 RnbToken;Rainbow iKey Token Service;c:\windows\system32\drivers\RNBTOKEN.SYS [18/03/2011 15:43 22096]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08

.

Conteúdo da pasta 'Tarefas Agendadas'

.

2012-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2010-08-24 18:06]

.

2012-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2010-08-24 18:06]

.

2012-06-04 c:\windows\Tasks\User_Feed_Synchronization-{512CAFD7-828F-456F-A754-CFF6F3C345F3}.job

• c:\windows\system32\msfeedssync.exe [2009-03-08 07:31]

.

2012-06-04 c:\windows\Tasks\User_Feed_Synchronization-{94810168-BB5B-4AB0-8C58-68F33B49B71B}.job

• c:\windows\system32\msfeedssync.exe [2009-03-08 07:31]

.

2012-06-04 c:\windows\Tasks\User_Feed_Synchronization-{FEFF8D19-65CD-4838-9307-AE42D11262C9}.job

• c:\windows\system32\msfeedssync.exe [2009-03-08 07:31]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: bancobrasil.com.br\www

Trusted Zone: bancobrasil.com.br\www14

Trusted Zone: bancobrasil.com.br\www2

Trusted Zone: bb.com.br\www

TCP: DhcpNameServer = 10.4.65.16

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\f003654\Dados de aplicativos\Mozilla\Firefox\Profiles\xc9hfnuw.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\arquivos de programas\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: avast! WebRep: wrc@avast.com - c:\arquivos de programas\Alwil Software\Avast5\WebRep\FF

FF - Ext: Java Quick Starter: jqs@sun.com - c:\arquivos de programas\Java\jre6\lib\deploy\jqs\ff

.

• - - - ORFÃOS REMOVIDOS - - - -

.

HKLM-Run-nwiz - nwiz.exe

MSConfigStartUp-swg - c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

AddRemove-TWAIN - c:\windows\IsUn0416.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-06-04 12:48

Windows 5.1.2600 Service Pack 3 NTFS

.

Procurando processos ocultos ...

.

Procurando entradas auto inicializáveis ocultas ...

.

Procurando ficheiros/arquivos ocultos ...

.

.

c:\windows\TEMP\_avast_\unp130431930.tmp 569344 bytes executable

.

Varredura completada com sucesso

arquivos/ficheiros ocultos: 1

.

**************************************************************************

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600

.

CreateFile("\\.\PHYSICALDRIVE0"): O arquivo já está sendo usado por outro processo.

device: opened successfully

user: error reading MBR

kernel: MBR read successfully

user != kernel MBR !!!

.

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

.

• - - - - - - > 'winlogon.exe'(964)

c:\arquivos de programas\GbPlugin\gbieh.dll

c:\windows\system32\DkWLNP.dll

.

Tempo para conclusão: 2012-06-04 12:52:23

ComboFix-quarantined-files.txt 2012-06-04 15:52

.

Pré-execução: 11 pasta(s) 25.649.131.520 bytes disponíveis

Pós execução: 15 pasta(s) 28.746.264.576 bytes disponíveis

.

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

• - End Of File - - B6380579ABA1A489D928322902FDD397

1.

*Conhece o conteúdo desta pasta?

c:\documents and settings\f002951

2.

Baixe o MBRCheck (...de ad13*) e salve-o no desktop

*Execute-o. Usuários do Windows Vista ou do Windows 7 devem clicar com o botão direito do mouse no arquivo e selecionar Executar como administrador

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/aabyvoQV.jpg&key=d691491aaec7248ad88b7e6fa2a3af10a5f7f78a610ebcd0da16d930f79ed6a8" alt="aabyvoQV.jpg" />

*Tecle N > [ENTER]

*Ao término tecle [ENTER]

*Cole o relatório MBRCheck_data_hora.txt criado no desktop

.*Conhece o conteúdo desta pasta?

c:\documents and settings\f002951

Sim, conheço, cada usuário que loga na maquina com sua senha cria uma pasta de sua matricula.

MBRCheck, version 1.2.3

© 2010, AD

Command-line:

Windows Version: Windows XP Professional

Windows Information: Service Pack 3 (build 2600)

Logical Drives Mask: 0x0084800d

Kernel Drivers (total 120):

0x804D7000 \WINDOWS\system32\ntoskrnl.exe

0x80701000 \WINDOWS\system32\hal.dll

0xF7A2F000 \WINDOWS\system32\KDCOM.DLL

0xF793F000 \WINDOWS\system32\BOOTVID.dll

0xF74E0000 ACPI.sys

0xF7A31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS

0xF74CF000 pci.sys

0xF752F000 isapnp.sys

0xF7AF7000 pciide.sys

0xF77AF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

0xF7A33000 intelide.sys

0xF753F000 MountMgr.sys

0xF74B0000 ftdisk.sys

0xF7A35000 dmload.sys

0xF748A000 dmio.sys

0xF77B7000 PartMgr.sys

0xF754F000 VolSnap.sys

0xF7472000 atapi.sys

0xF755F000 disk.sys

0xF756F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

0xF7452000 fltmgr.sys

0xF7440000 sr.sys

0xF7429000 KSecDD.sys

0xF739C000 Ntfs.sys

0xF757F000 gbpkm.sys

0xF736F000 NDIS.sys

0xF7355000 Mup.sys

0xF773F000 \SystemRoot\system32\DRIVERS\intelppm.sys

0xF694A000 \SystemRoot\system32\DRIVERS\nv4_mini.sys

0xF6936000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

0xF690E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

0xF784F000 \SystemRoot\system32\DRIVERS\usbuhci.sys

0xF68EA000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

0xF7857000 \SystemRoot\system32\DRIVERS\usbehci.sys

0xF68BF000 \SystemRoot\system32\DRIVERS\e1000325.sys

0xF785F000 \SystemRoot\system32\DRIVERS\fdc.sys

0xF68AB000 \SystemRoot\system32\DRIVERS\parport.sys

0xF774F000 \SystemRoot\system32\DRIVERS\i8042prt.sys

0xF7867000 \SystemRoot\system32\DRIVERS\kbdclass.sys

0xF786F000 \SystemRoot\system32\DRIVERS\mouclass.sys

0xF775F000 \SystemRoot\system32\DRIVERS\serial.sys

0xF79E3000 \SystemRoot\system32\DRIVERS\serenum.sys

0xF776F000 \SystemRoot\system32\DRIVERS\imapi.sys

0xF777F000 \SystemRoot\system32\DRIVERS\cdrom.sys

0xF778F000 \SystemRoot\system32\DRIVERS\redbook.sys

0xF6888000 \SystemRoot\system32\DRIVERS\ks.sys

0xF7B94000 \SystemRoot\system32\DRIVERS\audstub.sys

0xF779F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

0xF79EB000 \SystemRoot\system32\DRIVERS\ndistapi.sys

0xF6871000 \SystemRoot\system32\DRIVERS\ndiswan.sys

0xF75AF000 \SystemRoot\system32\DRIVERS\raspppoe.sys

0xF75BF000 \SystemRoot\system32\DRIVERS\raspptp.sys

0xF7877000 \SystemRoot\system32\DRIVERS\TDI.SYS

0xF6860000 \SystemRoot\system32\DRIVERS\psched.sys

0xF75CF000 \SystemRoot\system32\DRIVERS\msgpc.sys

0xF787F000 \SystemRoot\system32\DRIVERS\ptilink.sys

0xF7887000 \SystemRoot\system32\DRIVERS\raspti.sys

0xF788F000 \SystemRoot\system32\DRIVERS\gbpndisrd.sys

0xF6830000 \SystemRoot\system32\DRIVERS\rdpdr.sys

0xF75DF000 \SystemRoot\system32\DRIVERS\termdd.sys

0xF7A4F000 \SystemRoot\system32\DRIVERS\ikeyenum.sys

0xF7A51000 \SystemRoot\system32\DRIVERS\swenum.sys

 0xF67AA000 \SystemRoot\system32\DRIVERS\update.sys

 0xF7A0F000 \SystemRoot\system32\DRIVERS\mssmbios.sys

 0xF75EF000 \SystemRoot\System32\Drivers\NDProxy.SYS

 0xF7A23000 \SystemRoot\system32\DRIVERS\ikeyifd.sys

 0xF7A27000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS

 0xF418D000 \SystemRoot\system32\drivers\ADIHdAud.sys

 0xF4169000 \SystemRoot\system32\drivers\portcls.sys

 0xF75FF000 \SystemRoot\system32\drivers\drmk.sys

 0xF40A9000 \SystemRoot\system32\drivers\AEAudio.sys

 0xF4049000 \SystemRoot\system32\drivers\Senfilt.sys

 0xF760F000 \SystemRoot\system32\DRIVERS\usbhub.sys

 0xF7A57000 \SystemRoot\system32\DRIVERS\USBD.SYS

 0xF789F000 \SystemRoot\system32\DRIVERS\flpydisk.sys

 0xF7A59000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

 0xF7C6E000 \SystemRoot\System32\Drivers\Null.SYS

 0xF7A5B000 \SystemRoot\System32\Drivers\Beep.SYS

 0xF78AF000 \SystemRoot\System32\drivers\vga.sys

 0xF7A5D000 \SystemRoot\System32\Drivers\mnmdd.SYS

 0xF7A5F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

 0xF78B7000 \SystemRoot\System32\Drivers\Msfs.SYS

 0xF78BF000 \SystemRoot\System32\Drivers\Npfs.SYS

 0xF7311000 \SystemRoot\system32\DRIVERS\rasacd.sys

 0xF3FF6000 \SystemRoot\system32\DRIVERS\ipsec.sys

 0xF3F9D000 \SystemRoot\system32\DRIVERS\tcpip.sys

 0xF763F000 \SystemRoot\System32\Drivers\aswTdi.SYS

 0xF3F4F000 \SystemRoot\system32\DRIVERS\ipnat.sys

 0xF3F27000 \SystemRoot\system32\DRIVERS\netbt.sys

 0xF764F000 \SystemRoot\system32\DRIVERS\wanarp.sys

 0xF78C7000 \SystemRoot\System32\Drivers\aswRdr.SYS

 0xF79DB000 \SystemRoot\System32\drivers\ws2ifsl.sys

 0xF3F05000 \SystemRoot\System32\drivers\afd.sys

 0xF765F000 \SystemRoot\system32\DRIVERS\netbios.sys

 0xF3EDA000 \SystemRoot\system32\DRIVERS\rdbss.sys

 0xF3E6A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

 0xF766F000 \SystemRoot\System32\Drivers\Fips.SYS

 0xF3E19000 \SystemRoot\System32\Drivers\aswSP.SYS

 0xF3D57000 \SystemRoot\System32\Drivers\aswSnx.SYS

 0xF772F000 \SystemRoot\System32\Drivers\Aavmker4.SYS

 0xF4139000 \SystemRoot\System32\Drivers\Cdfs.SYS

 0xF3D3F000 \SystemRoot\System32\Drivers\dump_atapi.sys

 0xF7ADF000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

 0xBF800000 \SystemRoot\System32\win32k.sys

 0xF6763000 \SystemRoot\System32\drivers\Dxapi.sys

 0xF77FF000 \SystemRoot\System32\watchdog.sys

 0xBD000000 \SystemRoot\System32\drivers\dxg.sys

 0xF7B20000 \SystemRoot\System32\drivers\dxgthk.sys

 0xBD012000 \SystemRoot\System32\nv4_disp.dll

 0xB87F8000 \SystemRoot\System32\Drivers\aswFsBlk.SYS

 0xB8780000 \SystemRoot\system32\DRIVERS\ndisuio.sys

 0xB8542000 \SystemRoot\System32\Drivers\aswMon2.SYS

 0xB8425000 \SystemRoot\system32\DRIVERS\mrxdav.sys

 0xF7A93000 \SystemRoot\System32\Drivers\ParVdm.SYS

 0xB828D000 \SystemRoot\system32\DRIVERS\srv.sys

 0xB7F80000 \SystemRoot\system32\drivers\wdmaud.sys

 0xB835D000 \SystemRoot\system32\drivers\sysaudio.sys

 0xB785B000 \SystemRoot\System32\Drivers\HTTP.sys

 0xB682E000 \SystemRoot\system32\drivers\kmixer.sys

 0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 41):

0 System Idle Process

4 System

880 C:\WINDOWS\system32\smss.exe

940 C:\WINDOWS\system32\csrss.exe

964 C:\WINDOWS\system32\winlogon.exe

1008 C:\WINDOWS\system32\services.exe

1020 C:\WINDOWS\system32\lsass.exe

1200 C:\WINDOWS\system32\nvsvc32.exe

1236 C:\ARQUIV~1\GbPlugin\gbpsv.exe

1272 C:\WINDOWS\system32\svchost.exe

1348 C:\WINDOWS\system32\svchost.exe

1472 C:\WINDOWS\system32\svchost.exe

1580 C:\WINDOWS\system32\svchost.exe

1720 C:\WINDOWS\system32\svchost.exe

1888 C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe

1932 C:\WINDOWS\system32\spoolsv.exe

2004 C:\WINDOWS\system32\scardsvr.exe

172 C:\WINDOWS\system32\svchost.exe

336 C:\WINDOWS\system32\dklog.exe

472 C:\WINDOWS\system32\dkvcm.exe

552 C:\Fortes\Firebird\Firebird_2_1\bin\fbguard.exe

844 C:\Arquivos de programas\Java\jre6\bin\jqs.exe

896 C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\mdm.exe

1024 C:\Fortes\RemProt\remprots.exe

1568 C:\WINDOWS\system32\svchost.exe

1988 C:\WINDOWS\system32\dkcktkn.exe

2476 C:\Fortes\Firebird\Firebird_2_1\bin\fbserver.exe

2804 C:\WINDOWS\system32\wbem\wmiapsrv.exe

2816 C:\WINDOWS\explorer.exe

3128 C:\WINDOWS\system32\alg.exe

1784 C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

2056 C:\WINDOWS\system32\rundll32.exe

 2284 C:\Arquivos de programas\HP\HP Software Update\hpwuSchd2.exe

 2456 C:\Arquivos de programas\HP\Digital Imaging\bin\HpqSRmon.exe

 2892 C:\Arquivos de programas\Safenet\BSecClient\AXMonitor.exe

 3304 C:\Arquivos de programas\Safenet\BSecClient\dkAutoReg.exe

 4092 C:\Arquivos de programas\Alwil Software\Avast5\AvastUI.exe

 2920 C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

 1648 C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

 3076 C:\WINDOWS\system32\ctfmon.exe

 3664 C:\Documents and Settings\f003654\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHD081GJ, Rev: GE100-07

Size Device Name MBR Status

--------------------------------------------

74 GB \\.\PhysicalDrive0 Windows XP MBR code detected

SHA1: 2C6D77F4F50AA9DE10FCE2024558166E9012FC6F

Done!

Bom dia!

O PC está limpo....:)

1.

*Renomei o Combofix para Uninstall

*Execute-o, aguarde a mensagem ComboFix foi desinstalado e clique [OK]

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/aafTPQGe.jpg&key=69055fbde157db625f64b19216d235b91831f2af37df43d4e23b89e612fe0872" alt="aafTPQGe.jpg" />

*Delete o arquivo C:\Combofix.txt

2.

*Delete o MBRCheck

Um abraço.

Feito, valeu pela ajuda.

Um abraço.

PROBLEMA RESOLVIDO

Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.