Usamos cookies para medir audiência e melhorar sua experiência. Você pode aceitar ou recusar a qualquer momento. Veja sobre o iMasters.
Boa tarde ! DigRam
Conforme solicitado segue :
ComboFix 10-05-26.03 - edsom luis 28/05/2010 13:46:41.16.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.281 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\rrxx.dll
d:\windows\system32\KB907265.log
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-28 ))))))))))))))))))))))))))))
.
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-03 01:06 0 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
2010-04-30 00:45 . 2010-04-30 00:45 -------- d-----w- d:\windows\system32\wbem\Repository
2010-04-29 22:09 . 2007-01-18 12:00 3968 ----a-w- d:\windows\system32\drivers\AvgArCln.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-26 15:39 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-21 21:03 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-03-08 17:09 . 2010-05-18 02:33 638816 --sha-w- d:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe
2008-04-14 03:21 . 2010-05-18 02:33 73728 --sha-w- d:\windows\NiwradSoft Shell Pack\Backup\wmplayer.exe
.
------- Sigcheck -------
[-] 2008-04-14 . B0C0BF2504B830BFC1E93CA39F3C75FE . 549376 . . [5.1.2600.5512] . . d:\windows\system32\winlogon.exe
[-] 2008-04-14 . B0C0BF2504B830BFC1E93CA39F3C75FE . 549376 . . [5.1.2600.5512] . . d:\windows\system32\dllcache\winlogon.exe
[7] 2008-04-14 . 71D440F79B711627B12B567FB2EADB42 . 509952 . . [5.1.2600.5512] . . d:\windows\NiwradSoft Shell Pack\Backup\winlogon.exe
[-] 2008-04-14 . B0C0BF2504B830BFC1E93CA39F3C75FE . 549376 . . [5.1.2600.5512] . . d:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 . 302CD5BE4CA48200F9AC1C6074D71805 . 643072 . . [5.82] . . d:\windows\system32\comctl32.dll
[7] 2008-04-14 . 085C5892D9C1E19B3CEFD1B79F5BBF13 . 617472 . . [5.82] . . d:\windows\NiwradSoft Shell Pack\Backup\comctl32.dll
[-] 2008-04-14 . 302CD5BE4CA48200F9AC1C6074D71805 . 643072 . . [5.82] . . d:\windows\ServicePackFiles\i386\comctl32.dll
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\dllcache\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\ServicePackFiles\i386\mshtml.dll
[7] 2010-02-25 . 6D179FBB1B42A3C33955652D3A38BFDF . 5946880 . . [8.00.6001.22995] . . d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[7] 2009-12-21 . B5A5C997C2F926C40CCC64A3BD377D4B . 5942784 . . [8.00.6001.18876] . . d:\windows\ie8updates\KB980182-IE8\mshtml.dll
[7] 2009-12-21 . AAD700DEA94EE6E56E591C351111941A . 5945856 . . [8.00.6001.22967] . . d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[7] 2009-10-29 . 58A17D0C94F23CD59346720B0C374A90 . 5940736 . . [8.00.6001.18854] . . d:\windows\ie8updates\KB978207-IE8\mshtml.dll
[7] 2009-10-29 . 80F9322FBC4BBBC3A0DB6E9B3C953C60 . 5944320 . . [8.00.6001.22945] . . d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[7] 2009-10-22 . 61245C5B4B4F06058F4038DC2C7D9C72 . 5939712 . . [8.00.6001.18852] . . d:\windows\ie8updates\KB976325-IE8\mshtml.dll
[7] 2009-10-22 . 4E0FB322DCCB816F5DD56E9B2BE5E664 . 5943296 . . [8.00.6001.22942] . . d:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll
[7] 2009-08-29 . DB337CCC2E1111068F0FFD08982810F7 . 5940224 . . [8.00.6001.18828] . . d:\windows\ie8updates\KB976749-IE8\mshtml.dll
[7] 2009-08-29 . E719DAF5D7972B69647CF32C9FD1601D . 5942272 . . [8.00.6001.22918] . . d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
[7] 2009-07-19 . CD4DC10D4F812033C4B402C9620F10BB . 5937152 . . [8.00.6001.18812] . . d:\windows\ie8updates\KB974455-IE8\mshtml.dll
[7] 2009-07-19 . 5B7C8A16598E79AD559323C81737AC4D . 5938176 . . [8.00.6001.22902] . . d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
[7] 2009-05-13 . BE87C13E58E44084D7B81B047EB1121B . 5936128 . . [8.00.6001.22873] . . d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll
[7] 2009-05-13 . 285B63B5E7BE2B4237F6528DFE11CDB4 . 5936128 . . [8.00.6001.18783] . . d:\windows\ie8updates\KB972260-IE8\mshtml.dll
[7] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . d:\windows\ie8updates\KB969897-IE8\mshtml.dll
[7] 2009-01-17 . BC083F2B02EA9E69A636970859AF8DAF . 3594752 . . [7.00.6000.16809] . . d:\windows\ie8\mshtml.dll
[7] 2009-01-16 . 628A8E851FBA1F2183CE327B76E19E3E . 3596288 . . [7.00.6000.20996] . . d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
[7] 2008-12-13 . A294B659329C4007D75FF675A8A3A94F . 3593216 . . [7.00.6000.16788] . . d:\windows\ie7updates\KB961260-IE7\mshtml.dll
[7] 2008-12-13 . 4C2F6BAFA9236FA50620CC3E6DDF3BAD . 3594752 . . [7.00.6000.20973] . . d:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
[7] 2008-10-16 . 2B042E339C0C5E1584D49EB5579ABBD1 . 3595264 . . [7.00.6000.20935] . . d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
[7] 2008-02-16 . 9D318F222A6FF820D92EC97F4F1935EC . 3087872 . . [6.00.2900.3314] . . d:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll
[7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . d:\windows\ie7updates\KB960714-IE7\mshtml.dll
[-] 2010-02-17 . 16F9B5E8C253A9211ED01885077C7526 . 2354304 . . [5.1.2600.5938] . . d:\windows\system32\ntoskrnl.exe
[-] 2010-02-17 . 16F9B5E8C253A9211ED01885077C7526 . 2354304 . . [5.1.2600.5938] . . d:\windows\system32\dllcache\ntoskrnl.exe
[7] 2010-02-17 . 124F4EC97A7683D1A67B3AECFE258ABD . 2194176 . . [5.1.2600.5938] . . d:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2010-02-17 . 124F4EC97A7683D1A67B3AECFE258ABD . 2194176 . . [5.1.2600.5938] . . d:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
[-] 2010-02-17 . 16F9B5E8C253A9211ED01885077C7526 . 2354304 . . [5.1.2600.5938] . . d:\windows\ServicePackFiles\i386\ntoskrnl.exe
[7] 2010-02-16 . 8A47EB27E99109826F8A54BB64BE8131 . 2194304 . . [5.1.2600.5938] . . d:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[7] 2009-12-09 . C25035B93BDF12E2CB89C6F5BF8B99F1 . 2193536 . . [5.1.2600.5913] . . d:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
[7] 2009-12-09 . EB331E36934D9016B66CDF694954A8AF . 2193408 . . [5.1.2600.5913] . . d:\windows\$NtUninstallKB979683$\ntoskrnl.exe
[7] 2009-08-04 . 3B75E61D1546C05A959EDFE11F1510D1 . 2193536 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[7] 2009-02-10 . B0BF079AF000D97D8C043D1DFF08086D . 2193408 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 . A42CC3CFC02A7B2BAEC7B0D45808B257 . 2193408 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 . B72A025A758683552C4FEC7EABCB0661 . 2190208 . . [5.1.2600.3427] . . d:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[7] 2008-08-14 . 04BA43B0D2A13BD6B06D707299243CFC . 2193408 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[7] 2007-02-28 . BFB4C8761976CCE0B544D557B4C70825 . 2186368 . . [5.1.2600.3093] . . d:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[7] 2005-03-02 . 6E3AB4241E058B248CB7CDC5157449C3 . 2183808 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2008-04-14 . A9B36030497E98C29210E4544700649D . 579072 . . [5.1.2600.5512] . . d:\windows\system32\user32.dll
[-] 2008-04-14 . A9B36030497E98C29210E4544700649D . 579072 . . [5.1.2600.5512] . . d:\windows\system32\dllcache\user32.dll
[7] 2008-04-14 . 54907DB28872A7A6D3EE2B4747A23828 . 579072 . . [5.1.2600.5512] . . d:\windows\NiwradSoft Shell Pack\Backup\user32.dll
[-] 2008-04-14 . A9B36030497E98C29210E4544700649D . 579072 . . [5.1.2600.5512] . . d:\windows\ServicePackFiles\i386\user32.dll
[7] 2005-03-02 . 3ED0A4D74EFD5AAF8408095F452E2613 . 577536 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\dllcache\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\ServicePackFiles\i386\wininet.dll
[7] 2010-02-25 . D8E3E2FD8928B2BD8BEB2518C2E45ED1 . 919040 . . [8.00.6001.22995] . . d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[7] 2009-12-21 . 79805286A6D381A658A1871F6B3588B9 . 916480 . . [8.00.6001.18876] . . d:\windows\ie8updates\KB980182-IE8\wininet.dll
[7] 2009-12-21 . 11162780821A0531D39E675A662D766F . 916480 . . [8.00.6001.22967] . . d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[7] 2009-10-29 . 191FFB2798E4DB25F04C2E71C9595A85 . 916480 . . [8.00.6001.18854] . . d:\windows\ie8updates\KB978207-IE8\wininet.dll
[7] 2009-10-29 . E30B8F0D3BFAF4B403C57F05242AEF74 . 916480 . . [8.00.6001.22945] . . d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[7] 2009-08-29 . 83438BBF93CA586ED5149B1E1AA1BDBB . 916480 . . [8.00.6001.18828] . . d:\windows\ie8updates\KB976325-IE8\wininet.dll
[7] 2009-08-29 . 4F4F8F0B432A8B4B0D23829375358F34 . 916480 . . [8.00.6001.22918] . . d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 9572842DA52CF071068FAAB8AD4D74A5 . 915456 . . [8.00.6001.22896] . . d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 903350F08A1DF38714EF37F09EA11BB4 . 915456 . . [8.00.6001.18806] . . d:\windows\ie8updates\KB974455-IE8\wininet.dll
[7] 2009-05-13 . 4E74AEBA5546A61C9DC35BC531EFFA23 . 915456 . . [8.00.6001.22873] . . d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2009-05-13 . 14E350ABCCBE0279D042AF2854E6D894 . 915456 . . [8.00.6001.18783] . . d:\windows\ie8updates\KB972260-IE8\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . d:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-12-21 . E048867C310B09ED1C79E59B68DB8050 . 827904 . . [7.00.6000.20978] . . d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[7] 2008-12-20 . 94A623D9C0F2632796B4CE2753331F98 . 826368 . . [7.00.6000.16791] . . d:\windows\ie8\wininet.dll
[7] 2008-10-16 . 779479E6F38BC77831F26BD9AAE3FAD3 . 826368 . . [7.00.6000.16762] . . d:\windows\ie7updates\KB961260-IE7\wininet.dll
[7] 2008-10-16 . 4BCD45D77BD42A5E9C2DD2E847A5467E . 827904 . . [7.00.6000.20935] . . d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[7] 2008-02-16 . F3AD9DF6B30D5A3F67B5561109640958 . 668160 . . [6.00.2900.3314] . . d:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll
[7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . d:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-04-14 . 77F71BF6970EA10B4CC9AA1D45654AA0 . 1542656 . . [6.00.2900.5512] . . d:\windows\explorer.exe
[-] 2008-04-14 . 77F71BF6970EA10B4CC9AA1D45654AA0 . 1542656 . . [6.00.2900.5512] . . d:\windows\system32\dllcache\explorer.exe
[7] 2008-04-14 . 064EC7FF5F58B928C3E119402977FA6D . 1035776 . . [6.00.2900.5512] . . d:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
[-] 2008-04-14 . 77F71BF6970EA10B4CC9AA1D45654AA0 . 1542656 . . [6.00.2900.5512] . . d:\windows\ServicePackFiles\i386\explorer.exe
[7] 2007-06-13 . 45D521506825A10B80833B4E9621CCF6 . 1035264 . . [6.00.2900.3156] . . d:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2008-04-14 . 584450C5B2439571755D40444589C63D . 40448 . . [5.1.2600.5512] . . d:\windows\system32\ctfmon.exe
[-] 2008-04-14 . 584450C5B2439571755D40444589C63D . 40448 . . [5.1.2600.5512] . . d:\windows\system32\dllcache\ctfmon.exe
[7] 2008-04-14 . 4E486ADFE3A0B9ED0EB0639902E9F64F . 15360 . . [5.1.2600.5512] . . d:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe
[-] 2008-04-14 . 584450C5B2439571755D40444589C63D . 40448 . . [5.1.2600.5512] . . d:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2010-02-16 . 297C1AE40DE572E38618042B781EEE15 . 2231168 . . [5.1.2600.5938] . . d:\windows\system32\ntkrnlpa.exe
[-] 2010-02-16 . 297C1AE40DE572E38618042B781EEE15 . 2231168 . . [5.1.2600.5938] . . d:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2010-02-16 . 1F54DE75A9C8EC46E9FB53C1890C9ED3 . 2071040 . . [5.1.2600.5938] . . d:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2010-02-16 . 1F54DE75A9C8EC46E9FB53C1890C9ED3 . 2071040 . . [5.1.2600.5938] . . d:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
[-] 2010-02-16 . 297C1AE40DE572E38618042B781EEE15 . 2231168 . . [5.1.2600.5938] . . d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[7] 2010-02-16 . E94AC126E7ADFD40DC4E38D2E91236D8 . 2071168 . . [5.1.2600.5938] . . d:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[7] 2009-12-09 . 7D45AF0A376A7EEE59B2A4BCDC304C9C . 2070400 . . [5.1.2600.5913] . . d:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
[7] 2009-12-09 . FA72BE44F0715BD88A37C77559ACB3B7 . 2070272 . . [5.1.2600.5913] . . d:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
[7] 2009-08-05 . 6FEC1B436323CC29B3008D7C5BF2A10F . 2070400 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[7] 2009-02-09 . FF7FE874B6DA494303EE3DD9B97AB007 . 2070400 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 . 586A93E0C23F6A1893F6706F36B22598 . 2070272 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 . 145CD2BBA58988B7A2E9B910AC4D4CA4 . 2067200 . . [5.1.2600.3427] . . d:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[7] 2008-08-14 . A62251C7C1F0DBC3241ABF1985EDE75E . 2070272 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[7] 2007-02-28 . D027F0097B8F099C09369B8CC97D7C32 . 2063616 . . [5.1.2600.3093] . . d:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[7] 2005-03-02 . AED7B3AA86AD031CF39C6E4BBA37E818 . 2061184 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 40448 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-28 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
.------- Associação de arquivos/ficheiros -------
.
.txt=
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 13:52
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\SETUPAPI.dll
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\SETUPAPI.dll
d:\windows\system32\psbase.dll
.
Tempo para conclusão: 2010-05-28 13:51:50
ComboFix-quarantined-files.txt 2010-05-28 14:13
ComboFix2.txt 2010-05-28 14:13
ComboFix3.txt 2010-05-18 19:31
ComboFix4.txt 2010-05-17 18:37
ComboFix5.txt 2010-05-15 13:45
Pré-execução: 19 pasta(s) 40.769.454.080 bytes disponíveis
Pós execução: 21 pasta(s) 40.744.812.544 bytes disponíveis
Obrigado
Boa tarde ! DigRam
Para lhes ajudar segue logo infra logs de algumas ferramentas que vossa pessoa instruiu ao outro usuário cfe. tópico http://forum.imasters.com.br/index.php?/topic/393088-analise-de-log/ .
que à acompanhar executei as mesmas .
Este ts.zip (link) constou :
503 - temporarily unavailable
Drop.io is experiencing technical difficulties at the moment. The team is hard at work addressing the issue, and we'll be back with your drops shortly. We'll post updates on twitter with more info
Segue combofix :
ComboFix 10-05-28.02 - edsom luis 28/05/2010 16:34:01.17.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.272 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FILE ::
"d:\windows\Driver Cache\i386\ntkrnlpa.exe"
"d:\windows\ServicePackFiles\i386\comctl32.dll"
"d:\windows\ServicePackFiles\i386\ctfmon.exe"
"d:\windows\ServicePackFiles\i386\explorer.exe"
"d:\windows\ServicePackFiles\i386\mshtml.dll"
"d:\windows\ServicePackFiles\i386\ntkrnlpa.exe"
"d:\windows\ServicePackFiles\i386\ntoskrnl.exe"
"d:\windows\ServicePackFiles\i386\user32.dll"
"d:\windows\ServicePackFiles\i386\wininet.dll"
"d:\windows\ServicePackFiles\i386\winlogon.exe"
"d:\windows\system32\dllcache\ctfmon.exe"
"d:\windows\system32\dllcache\explorer.exe"
"d:\windows\system32\dllcache\mshtml.dll"
"d:\windows\system32\dllcache\ntkrnlpa.exe"
"d:\windows\system32\dllcache\ntoskrnl.exe"
"d:\windows\system32\dllcache\user32.dll"
"d:\windows\system32\dllcache\wininet.dll"
"d:\windows\system32\dllcache\winlogon.exe"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\Driver Cache\i386\ntkrnlpa.exe
d:\windows\NiwradSoft Shell Pack\Backup
d:\windows\NiwradSoft Shell Pack\Backup\acctres.dll
d:\windows\NiwradSoft Shell Pack\Backup\admparse.dll
d:\windows\NiwradSoft Shell Pack\Backup\ahui.exe
d:\windows\NiwradSoft Shell Pack\Backup\appmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\asctrls.ocx
d:\windows\NiwradSoft Shell Pack\Backup\Audiodev.dll
d:\windows\NiwradSoft Shell Pack\Backup\batmeter.dll
d:\windows\NiwradSoft Shell Pack\Backup\batt.dll
d:\windows\NiwradSoft Shell Pack\Backup\browseui.dll
d:\windows\NiwradSoft Shell Pack\Backup\bthci.dll
d:\windows\NiwradSoft Shell Pack\Backup\cabview.dll
d:\windows\NiwradSoft Shell Pack\Backup\capesnpn.dll
d:\windows\NiwradSoft Shell Pack\Backup\cards.dll
d:\windows\NiwradSoft Shell Pack\Backup\cdfview.dll
d:\windows\NiwradSoft Shell Pack\Backup\certmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\ciadmin.dll
d:\windows\NiwradSoft Shell Pack\Backup\cleanmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\cliconfg.exe
d:\windows\NiwradSoft Shell Pack\Backup\cliconfg.rll
d:\windows\NiwradSoft Shell Pack\Backup\clipsrv.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmd.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmdial32.dll
d:\windows\NiwradSoft Shell Pack\Backup\cmdl32.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmmon32.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmprops.dll
d:\windows\NiwradSoft Shell Pack\Backup\cmstp.exe
d:\windows\NiwradSoft Shell Pack\Backup\comctl32.dll
d:\windows\NiwradSoft Shell Pack\Backup\comdlg32.dll
d:\windows\NiwradSoft Shell Pack\Backup\compatUI.dll
d:\windows\NiwradSoft Shell Pack\Backup\compstui.dll
d:\windows\NiwradSoft Shell Pack\Backup\comres.dll
d:\windows\NiwradSoft Shell Pack\Backup\conime.exe
d:\windows\NiwradSoft Shell Pack\Backup\console.dll
d:\windows\NiwradSoft Shell Pack\Backup\credui.dll
d:\windows\NiwradSoft Shell Pack\Backup\cryptui.dll
d:\windows\NiwradSoft Shell Pack\Backup\cscdll.dll
d:\windows\NiwradSoft Shell Pack\Backup\cscript.exe
d:\windows\NiwradSoft Shell Pack\Backup\cscui.dll
d:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe
d:\windows\NiwradSoft Shell Pack\Backup\dataclen.dll
d:\windows\NiwradSoft Shell Pack\Backup\ddeshare.exe
d:\windows\NiwradSoft Shell Pack\Backup\desk.cpl
d:\windows\NiwradSoft Shell Pack\Backup\deskadp.dll
d:\windows\NiwradSoft Shell Pack\Backup\deskmon.dll
d:\windows\NiwradSoft Shell Pack\Backup\deskperf.dll
d:\windows\NiwradSoft Shell Pack\Backup\devmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\dfrgres.dll
d:\windows\NiwradSoft Shell Pack\Backup\dfrgui.dll
d:\windows\NiwradSoft Shell Pack\Backup\dfshim.dll
d:\windows\NiwradSoft Shell Pack\Backup\digest.dll
d:\windows\NiwradSoft Shell Pack\Backup\diskcopy.dll
d:\windows\NiwradSoft Shell Pack\Backup\dmdlgs.dll
d:\windows\NiwradSoft Shell Pack\Backup\dmdskres.dll
d:\windows\NiwradSoft Shell Pack\Backup\dpmodemx.dll
d:\windows\NiwradSoft Shell Pack\Backup\dpvoice.dll
d:\windows\NiwradSoft Shell Pack\Backup\drwtsn32.exe
d:\windows\NiwradSoft Shell Pack\Backup\dsprop.dll
d:\windows\NiwradSoft Shell Pack\Backup\dsquery.dll
d:\windows\NiwradSoft Shell Pack\Backup\dsuiext.dll
d:\windows\NiwradSoft Shell Pack\Backup\dvdplay.exe
d:\windows\NiwradSoft Shell Pack\Backup\els.dll
d:\windows\NiwradSoft Shell Pack\Backup\EqnClass.Dll
d:\windows\NiwradSoft Shell Pack\Backup\eventvwr.exe
d:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
d:\windows\NiwradSoft Shell Pack\Backup\fde.dll
d:\windows\NiwradSoft Shell Pack\Backup\filemgmt.dll
d:\windows\NiwradSoft Shell Pack\Backup\fldrclnr.dll
d:\windows\NiwradSoft Shell Pack\Backup\fontext.dll
d:\windows\NiwradSoft Shell Pack\Backup\fsusd.dll
d:\windows\NiwradSoft Shell Pack\Backup\gcdef.dll
d:\windows\NiwradSoft Shell Pack\Backup\gpedit.dll
d:\windows\NiwradSoft Shell Pack\Backup\gptext.dll
d:\windows\NiwradSoft Shell Pack\Backup\grpconv.exe
d:\windows\NiwradSoft Shell Pack\Backup\hdwwiz.cpl
d:\windows\NiwradSoft Shell Pack\Backup\HelpCtr.exe
d:\windows\NiwradSoft Shell Pack\Backup\hnetcfg.dll
d:\windows\NiwradSoft Shell Pack\Backup\hnetwiz.dll
d:\windows\NiwradSoft Shell Pack\Backup\hotplug.dll
d:\windows\NiwradSoft Shell Pack\Backup\icmui.dll
d:\windows\NiwradSoft Shell Pack\Backup\icwdial.dll
d:\windows\NiwradSoft Shell Pack\Backup\ieaksie.dll
d:\windows\NiwradSoft Shell Pack\Backup\ieakui.dll
d:\windows\NiwradSoft Shell Pack\Backup\iepeers.dll
d:\windows\NiwradSoft Shell Pack\Backup\iernonce.dll
d:\windows\NiwradSoft Shell Pack\Backup\iesetup.dll
d:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe
d:\windows\NiwradSoft Shell Pack\Backup\InetCpl.cpl
d:\windows\NiwradSoft Shell Pack\Backup\inetcplc.dll
d:\windows\NiwradSoft Shell Pack\Backup\inetppui.dll
d:\windows\NiwradSoft Shell Pack\Backup\inetres.dll
d:\windows\NiwradSoft Shell Pack\Backup\input.dll
d:\windows\NiwradSoft Shell Pack\Backup\intl.cpl
d:\windows\NiwradSoft Shell Pack\Backup\ipsecsnp.dll
d:\windows\NiwradSoft Shell Pack\Backup\ipsmsnap.dll
d:\windows\NiwradSoft Shell Pack\Backup\irclass.dll
d:\windows\NiwradSoft Shell Pack\Backup\irprops.cpl
d:\windows\NiwradSoft Shell Pack\Backup\isign32.dll
d:\windows\NiwradSoft Shell Pack\Backup\itss.dll
d:\windows\NiwradSoft Shell Pack\Backup\ivfsrc.ax
d:\windows\NiwradSoft Shell Pack\Backup\jobexec.dll
d:\windows\NiwradSoft Shell Pack\Backup\joy.cpl
d:\windows\NiwradSoft Shell Pack\Backup\keymgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\localsec.dll
d:\windows\NiwradSoft Shell Pack\Backup\logonui.exe
d:\windows\NiwradSoft Shell Pack\Backup\magnify.exe
d:\windows\NiwradSoft Shell Pack\Backup\main.cpl
d:\windows\NiwradSoft Shell Pack\Backup\mapi32.dll
d:\windows\NiwradSoft Shell Pack\Backup\mapistub.dll
d:\windows\NiwradSoft Shell Pack\Backup\mdminst.dll
d:\windows\NiwradSoft Shell Pack\Backup\mdwmdmsp.dll
d:\windows\NiwradSoft Shell Pack\Backup\midimap.dll
d:\windows\NiwradSoft Shell Pack\Backup\migpwd.exe
d:\windows\NiwradSoft Shell Pack\Backup\migwiz.exe
d:\windows\NiwradSoft Shell Pack\Backup\mmc.exe
d:\windows\NiwradSoft Shell Pack\Backup\mmcbase.dll
d:\windows\NiwradSoft Shell Pack\Backup\mmcndmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\mmcshext.dll
d:\windows\NiwradSoft Shell Pack\Backup\mmsys.cpl
d:\windows\NiwradSoft Shell Pack\Backup\mnmsrvc.exe
d:\windows\NiwradSoft Shell Pack\Backup\mobsync.dll
d:\windows\NiwradSoft Shell Pack\Backup\mobsync.exe
d:\windows\NiwradSoft Shell Pack\Backup\modemui.dll
d:\windows\NiwradSoft Shell Pack\Backup\moricons.dll
d:\windows\NiwradSoft Shell Pack\Backup\mplay32.exe
d:\windows\NiwradSoft Shell Pack\Backup\mprui.dll
d:\windows\NiwradSoft Shell Pack\Backup\mqsnap.dll
d:\windows\NiwradSoft Shell Pack\Backup\mqutil.dll
d:\windows\NiwradSoft Shell Pack\Backup\msconf.dll
d:\windows\NiwradSoft Shell Pack\Backup\msconfig.exe
d:\windows\NiwradSoft Shell Pack\Backup\mscorier.dll
d:\windows\NiwradSoft Shell Pack\Backup\msdxm.ocx
d:\windows\NiwradSoft Shell Pack\Backup\msgina.dll
d:\windows\NiwradSoft Shell Pack\Backup\mshta.exe
d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
d:\windows\NiwradSoft Shell Pack\Backup\msi.dll
d:\windows\NiwradSoft Shell Pack\Backup\msident.dll
d:\windows\NiwradSoft Shell Pack\Backup\msidntld.dll
d:\windows\NiwradSoft Shell Pack\Backup\msieftp.dll
d:\windows\NiwradSoft Shell Pack\Backup\msiexec.exe
d:\windows\NiwradSoft Shell Pack\Backup\msihnd.dll
d:\windows\NiwradSoft Shell Pack\Backup\msimn.exe
d:\windows\NiwradSoft Shell Pack\Backup\msinfo32.exe
d:\windows\NiwradSoft Shell Pack\Backup\msoeres.dll
d:\windows\NiwradSoft Shell Pack\Backup\msratelc.dll
d:\windows\NiwradSoft Shell Pack\Backup\msrating.dll
d:\windows\NiwradSoft Shell Pack\Backup\msshavmsg.dll
d:\windows\NiwradSoft Shell Pack\Backup\mstsc.exe
d:\windows\NiwradSoft Shell Pack\Backup\mstscax.dll
d:\windows\NiwradSoft Shell Pack\Backup\msutb.dll
d:\windows\NiwradSoft Shell Pack\Backup\msvfw32.dll
d:\windows\NiwradSoft Shell Pack\Backup\msxml.dll
d:\windows\NiwradSoft Shell Pack\Backup\msxml2.dll
d:\windows\NiwradSoft Shell Pack\Backup\msxml3.dll
d:\windows\NiwradSoft Shell Pack\Backup\mycomput.dll
d:\windows\NiwradSoft Shell Pack\Backup\mydocs.dll
d:\windows\NiwradSoft Shell Pack\Backup\ncpa.cpl
d:\windows\NiwradSoft Shell Pack\Backup\netid.dll
d:\windows\NiwradSoft Shell Pack\Backup\netplwiz.dll
d:\windows\NiwradSoft Shell Pack\Backup\netsetup.exe
d:\windows\NiwradSoft Shell Pack\Backup\netshell.dll
d:\windows\NiwradSoft Shell Pack\Backup\newdev.dll
d:\windows\NiwradSoft Shell Pack\Backup\notepad.exe
d:\windows\NiwradSoft Shell Pack\Backup\nslookup.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntbackup.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntlanui2.dll
d:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntsd.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntshrui.dll
d:\windows\NiwradSoft Shell Pack\Backup\nusrmgr.cpl
d:\windows\NiwradSoft Shell Pack\Backup\objsel.dll
d:\windows\NiwradSoft Shell Pack\Backup\occache.dll
d:\windows\NiwradSoft Shell Pack\Backup\odbcad32.exe
d:\windows\NiwradSoft Shell Pack\Backup\odbccp32.cpl
d:\windows\NiwradSoft Shell Pack\Backup\odbcint.dll
d:\windows\NiwradSoft Shell Pack\Backup\ole32.dll
d:\windows\NiwradSoft Shell Pack\Backup\osk.exe
d:\windows\NiwradSoft Shell Pack\Backup\osuninst.dll
d:\windows\NiwradSoft Shell Pack\Backup\osuninst.exe
d:\windows\NiwradSoft Shell Pack\Backup\packager.exe
d:\windows\NiwradSoft Shell Pack\Backup\pautoenr.dll
d:\windows\NiwradSoft Shell Pack\Backup\perfmon.exe
d:\windows\NiwradSoft Shell Pack\Backup\photowiz.dll
d:\windows\NiwradSoft Shell Pack\Backup\pifmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\powercfg.cpl
d:\windows\NiwradSoft Shell Pack\Backup\printui.dll
d:\windows\NiwradSoft Shell Pack\Backup\progman.exe
d:\windows\NiwradSoft Shell Pack\Backup\proquota.exe
d:\windows\NiwradSoft Shell Pack\Backup\psbase.dll
d:\windows\NiwradSoft Shell Pack\Backup\quartz.dll
d:\windows\NiwradSoft Shell Pack\Backup\rasdlg.dll
d:\windows\NiwradSoft Shell Pack\Backup\rasphone.exe
d:\windows\NiwradSoft Shell Pack\Backup\rcimlby.exe
d:\windows\NiwradSoft Shell Pack\Backup\regedit.exe
d:\windows\NiwradSoft Shell Pack\Backup\regwizc.dll
d:\windows\NiwradSoft Shell Pack\Backup\remotepg.dll
d:\windows\NiwradSoft Shell Pack\Backup\rstrui.exe
d:\windows\NiwradSoft Shell Pack\Backup\rtcshare.exe
d:\windows\NiwradSoft Shell Pack\Backup\rundll32.exe
d:\windows\NiwradSoft Shell Pack\Backup\sapi.cpl
d:\windows\NiwradSoft Shell Pack\Backup\scrobj.dll
d:\windows\NiwradSoft Shell Pack\Backup\sendmail.dll
d:\windows\NiwradSoft Shell Pack\Backup\servdeps.dll
d:\windows\NiwradSoft Shell Pack\Backup\setup.exe
d:\windows\NiwradSoft Shell Pack\Backup\setup_wm.exe
d:\windows\NiwradSoft Shell Pack\Backup\setupapi.dll
d:\windows\NiwradSoft Shell Pack\Backup\sfc_os.dll
d:\windows\NiwradSoft Shell Pack\Backup\shdoclc.dll
d:\windows\NiwradSoft Shell Pack\Backup\shdocvw.dll
d:\windows\NiwradSoft Shell Pack\Backup\shell32.dll
d:\windows\NiwradSoft Shell Pack\Backup\shimgvw.dll
d:\windows\NiwradSoft Shell Pack\Backup\shrpubw.exe
d:\windows\NiwradSoft Shell Pack\Backup\shscrap.dll
d:\windows\NiwradSoft Shell Pack\Backup\sigverif.exe
d:\windows\NiwradSoft Shell Pack\Backup\srchui.dll
d:\windows\NiwradSoft Shell Pack\Backup\srclient.dll
d:\windows\NiwradSoft Shell Pack\Backup\srrstr.dll
d:\windows\NiwradSoft Shell Pack\Backup\sti.dll
d:\windows\NiwradSoft Shell Pack\Backup\sti_ci.dll
d:\windows\NiwradSoft Shell Pack\Backup\stimon.exe
d:\windows\NiwradSoft Shell Pack\Backup\stobject.dll
d:\windows\NiwradSoft Shell Pack\Backup\storprop.dll
d:\windows\NiwradSoft Shell Pack\Backup\sxs.dll
d:\windows\NiwradSoft Shell Pack\Backup\syncapp.exe
d:\windows\NiwradSoft Shell Pack\Backup\syncui.dll
d:\windows\NiwradSoft Shell Pack\Backup\sysdm.cpl
d:\windows\NiwradSoft Shell Pack\Backup\syskey.exe
d:\windows\NiwradSoft Shell Pack\Backup\sysmon.ocx
d:\windows\NiwradSoft Shell Pack\Backup\sysocmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\syssetup.dll
d:\windows\NiwradSoft Shell Pack\Backup\tapiui.dll
d:\windows\NiwradSoft Shell Pack\Backup\taskmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\tcpmonui.dll
d:\windows\NiwradSoft Shell Pack\Backup\telephon.cpl
d:\windows\NiwradSoft Shell Pack\Backup\telnet.exe
d:\windows\NiwradSoft Shell Pack\Backup\themeui.dll
d:\windows\NiwradSoft Shell Pack\Backup\timedate.cpl
d:\windows\NiwradSoft Shell Pack\Backup\tourstart.exe
d:\windows\NiwradSoft Shell Pack\Backup\unimdm.tsp
d:\windows\NiwradSoft Shell Pack\Backup\upnpui.dll
d:\windows\NiwradSoft Shell Pack\Backup\url.dll
d:\windows\NiwradSoft Shell Pack\Backup\urlmon.dll
d:\windows\NiwradSoft Shell Pack\Backup\usbui.dll
d:\windows\NiwradSoft Shell Pack\Backup\user32.dll
d:\windows\NiwradSoft Shell Pack\Backup\userenv.dll
d:\windows\NiwradSoft Shell Pack\Backup\utilman.exe
d:\windows\NiwradSoft Shell Pack\Backup\verifier.exe
d:\windows\NiwradSoft Shell Pack\Backup\wab.exe
d:\windows\NiwradSoft Shell Pack\Backup\wab32.dll
d:\windows\NiwradSoft Shell Pack\Backup\wab32res.dll
d:\windows\NiwradSoft Shell Pack\Backup\wabfind.dll
d:\windows\NiwradSoft Shell Pack\Backup\wabimp.dll
d:\windows\NiwradSoft Shell Pack\Backup\webcheck.dll
d:\windows\NiwradSoft Shell Pack\Backup\wextract.exe
d:\windows\NiwradSoft Shell Pack\Backup\wiaacmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\wiadefui.dll
d:\windows\NiwradSoft Shell Pack\Backup\wiashext.dll
d:\windows\NiwradSoft Shell Pack\Backup\winbrand.dll
d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
d:\windows\NiwradSoft Shell Pack\Backup\winlogon.exe
d:\windows\NiwradSoft Shell Pack\Backup\winntbbu.dll
d:\windows\NiwradSoft Shell Pack\Backup\winsrv.dll
d:\windows\NiwradSoft Shell Pack\Backup\wintrust.dll
d:\windows\NiwradSoft Shell Pack\Backup\wmplayer.exe
d:\windows\NiwradSoft Shell Pack\Backup\wpabaln.exe
d:\windows\NiwradSoft Shell Pack\Backup\WpdShext.dll
d:\windows\NiwradSoft Shell Pack\Backup\wscui.cpl
d:\windows\NiwradSoft Shell Pack\Backup\wsecedit.dll
d:\windows\NiwradSoft Shell Pack\Backup\wuapi.dll
d:\windows\NiwradSoft Shell Pack\Backup\wuauclt.exe
d:\windows\NiwradSoft Shell Pack\Backup\wuaucpl.cpl
d:\windows\NiwradSoft Shell Pack\Backup\wuaueng1.dll
d:\windows\NiwradSoft Shell Pack\Backup\wucltui.dll
d:\windows\NiwradSoft Shell Pack\Backup\wupdmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\wuweb.dll
d:\windows\NiwradSoft Shell Pack\Backup\xpsp1res.dll
d:\windows\NiwradSoft Shell Pack\Backup\xpsp2res.dll
d:\windows\NiwradSoft Shell Pack\Backup\xpsp3res.dll
d:\windows\NiwradSoft Shell Pack\Backup\zipfldr.dll
d:\windows\rrxx.dll
d:\windows\ServicePackFiles\i386\comctl32.dll
d:\windows\ServicePackFiles\i386\ctfmon.exe
d:\windows\ServicePackFiles\i386\explorer.exe
d:\windows\ServicePackFiles\i386\mshtml.dll
d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
d:\windows\ServicePackFiles\i386\ntoskrnl.exe
d:\windows\ServicePackFiles\i386\user32.dll
d:\windows\ServicePackFiles\i386\wininet.dll
d:\windows\ServicePackFiles\i386\winlogon.exe
d:\windows\system32\KB907265.log
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-28 ))))))))))))))))))))))))))))
.
2010-05-28 18:48 . 2010-05-28 18:48 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 18:28 . 2010-05-28 18:28 -------- d-----w- d:\arquivos de programas\ERUNT
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-28 00:24 . 2010-05-28 00:24 65536 ----a-w- d:\windows\IFinst27.exe
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
2010-04-29 22:09 . 2007-01-18 12:00 3968 ----a-w- d:\windows\system32\drivers\AvgArCln.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-26 15:39 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2008-04-14 . B0C0BF2504B830BFC1E93CA39F3C75FE . 549376 . . [5.1.2600.5512] . . d:\windows\system32\winlogon.exe
[-] 2008-04-14 . 302CD5BE4CA48200F9AC1C6074D71805 . 643072 . . [5.82] . . d:\windows\system32\comctl32.dll
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 6D179FBB1B42A3C33955652D3A38BFDF . 5946880 . . [8.00.6001.22995] . . d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[7] 2009-12-21 . B5A5C997C2F926C40CCC64A3BD377D4B . 5942784 . . [8.00.6001.18876] . . d:\windows\ie8updates\KB980182-IE8\mshtml.dll
[7] 2009-12-21 . AAD700DEA94EE6E56E591C351111941A . 5945856 . . [8.00.6001.22967] . . d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[7] 2009-10-29 . 58A17D0C94F23CD59346720B0C374A90 . 5940736 . . [8.00.6001.18854] . . d:\windows\ie8updates\KB978207-IE8\mshtml.dll
[7] 2009-10-29 . 80F9322FBC4BBBC3A0DB6E9B3C953C60 . 5944320 . . [8.00.6001.22945] . . d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[7] 2009-10-22 . 61245C5B4B4F06058F4038DC2C7D9C72 . 5939712 . . [8.00.6001.18852] . . d:\windows\ie8updates\KB976325-IE8\mshtml.dll
[7] 2009-10-22 . 4E0FB322DCCB816F5DD56E9B2BE5E664 . 5943296 . . [8.00.6001.22942] . . d:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll
[7] 2009-08-29 . DB337CCC2E1111068F0FFD08982810F7 . 5940224 . . [8.00.6001.18828] . . d:\windows\ie8updates\KB976749-IE8\mshtml.dll
[7] 2009-08-29 . E719DAF5D7972B69647CF32C9FD1601D . 5942272 . . [8.00.6001.22918] . . d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
[7] 2009-07-19 . CD4DC10D4F812033C4B402C9620F10BB . 5937152 . . [8.00.6001.18812] . . d:\windows\ie8updates\KB974455-IE8\mshtml.dll
[7] 2009-07-19 . 5B7C8A16598E79AD559323C81737AC4D . 5938176 . . [8.00.6001.22902] . . d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
[7] 2009-05-13 . BE87C13E58E44084D7B81B047EB1121B . 5936128 . . [8.00.6001.22873] . . d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll
[7] 2009-05-13 . 285B63B5E7BE2B4237F6528DFE11CDB4 . 5936128 . . [8.00.6001.18783] . . d:\windows\ie8updates\KB972260-IE8\mshtml.dll
[7] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . d:\windows\ie8updates\KB969897-IE8\mshtml.dll
[7] 2009-01-17 . BC083F2B02EA9E69A636970859AF8DAF . 3594752 . . [7.00.6000.16809] . . d:\windows\ie8\mshtml.dll
[7] 2009-01-16 . 628A8E851FBA1F2183CE327B76E19E3E . 3596288 . . [7.00.6000.20996] . . d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
[7] 2008-12-13 . A294B659329C4007D75FF675A8A3A94F . 3593216 . . [7.00.6000.16788] . . d:\windows\ie7updates\KB961260-IE7\mshtml.dll
[7] 2008-12-13 . 4C2F6BAFA9236FA50620CC3E6DDF3BAD . 3594752 . . [7.00.6000.20973] . . d:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
[7] 2008-10-16 . 2B042E339C0C5E1584D49EB5579ABBD1 . 3595264 . . [7.00.6000.20935] . . d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
[7] 2008-02-16 . 9D318F222A6FF820D92EC97F4F1935EC . 3087872 . . [6.00.2900.3314] . . d:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll
[7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . d:\windows\ie7updates\KB960714-IE7\mshtml.dll
[-] 2010-02-17 . 16F9B5E8C253A9211ED01885077C7526 . 2354304 . . [5.1.2600.5938] . . d:\windows\system32\ntoskrnl.exe
[7] 2010-02-17 . 124F4EC97A7683D1A67B3AECFE258ABD . 2194176 . . [5.1.2600.5938] . . d:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2010-02-16 . 8A47EB27E99109826F8A54BB64BE8131 . 2194304 . . [5.1.2600.5938] . . d:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[7] 2009-12-09 . C25035B93BDF12E2CB89C6F5BF8B99F1 . 2193536 . . [5.1.2600.5913] . . d:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
[7] 2009-08-04 . 3B75E61D1546C05A959EDFE11F1510D1 . 2193536 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[7] 2009-02-10 . B0BF079AF000D97D8C043D1DFF08086D . 2193408 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 . A42CC3CFC02A7B2BAEC7B0D45808B257 . 2193408 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[7] 2008-08-14 . B72A025A758683552C4FEC7EABCB0661 . 2190208 . . [5.1.2600.3427] . . d:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[7] 2008-08-14 . 04BA43B0D2A13BD6B06D707299243CFC . 2193408 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[7] 2007-02-28 . BFB4C8761976CCE0B544D557B4C70825 . 2186368 . . [5.1.2600.3093] . . d:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[7] 2005-03-02 . 6E3AB4241E058B248CB7CDC5157449C3 . 2183808 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2008-04-14 . A9B36030497E98C29210E4544700649D . 579072 . . [5.1.2600.5512] . . d:\windows\system32\user32.dll
[7] 2005-03-02 . 3ED0A4D74EFD5AAF8408095F452E2613 . 577536 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . D8E3E2FD8928B2BD8BEB2518C2E45ED1 . 919040 . . [8.00.6001.22995] . . d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[7] 2009-12-21 . 79805286A6D381A658A1871F6B3588B9 . 916480 . . [8.00.6001.18876] . . d:\windows\ie8updates\KB980182-IE8\wininet.dll
[7] 2009-12-21 . 11162780821A0531D39E675A662D766F . 916480 . . [8.00.6001.22967] . . d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[7] 2009-10-29 . 191FFB2798E4DB25F04C2E71C9595A85 . 916480 . . [8.00.6001.18854] . . d:\windows\ie8updates\KB978207-IE8\wininet.dll
[7] 2009-10-29 . E30B8F0D3BFAF4B403C57F05242AEF74 . 916480 . . [8.00.6001.22945] . . d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[7] 2009-08-29 . 83438BBF93CA586ED5149B1E1AA1BDBB . 916480 . . [8.00.6001.18828] . . d:\windows\ie8updates\KB976325-IE8\wininet.dll
[7] 2009-08-29 . 4F4F8F0B432A8B4B0D23829375358F34 . 916480 . . [8.00.6001.22918] . . d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 9572842DA52CF071068FAAB8AD4D74A5 . 915456 . . [8.00.6001.22896] . . d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
[7] 2009-07-03 . 903350F08A1DF38714EF37F09EA11BB4 . 915456 . . [8.00.6001.18806] . . d:\windows\ie8updates\KB974455-IE8\wininet.dll
[7] 2009-05-13 . 4E74AEBA5546A61C9DC35BC531EFFA23 . 915456 . . [8.00.6001.22873] . . d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
[7] 2009-05-13 . 14E350ABCCBE0279D042AF2854E6D894 . 915456 . . [8.00.6001.18783] . . d:\windows\ie8updates\KB972260-IE8\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . d:\windows\ie8updates\KB969897-IE8\wininet.dll
[7] 2008-12-21 . E048867C310B09ED1C79E59B68DB8050 . 827904 . . [7.00.6000.20978] . . d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
[7] 2008-12-20 . 94A623D9C0F2632796B4CE2753331F98 . 826368 . . [7.00.6000.16791] . . d:\windows\ie8\wininet.dll
[7] 2008-10-16 . 779479E6F38BC77831F26BD9AAE3FAD3 . 826368 . . [7.00.6000.16762] . . d:\windows\ie7updates\KB961260-IE7\wininet.dll
[7] 2008-10-16 . 4BCD45D77BD42A5E9C2DD2E847A5467E . 827904 . . [7.00.6000.20935] . . d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
[7] 2008-02-16 . F3AD9DF6B30D5A3F67B5561109640958 . 668160 . . [6.00.2900.3314] . . d:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll
[7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . d:\windows\ie7updates\KB958215-IE7\wininet.dll
[-] 2008-04-14 . 77F71BF6970EA10B4CC9AA1D45654AA0 . 1542656 . . [6.00.2900.5512] . . d:\windows\explorer.exe
[7] 2007-06-13 . 45D521506825A10B80833B4E9621CCF6 . 1035264 . . [6.00.2900.3156] . . d:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2008-04-14 . 584450C5B2439571755D40444589C63D . 40448 . . [5.1.2600.5512] . . d:\windows\system32\ctfmon.exe
[-] 2010-02-16 . 297C1AE40DE572E38618042B781EEE15 . 2231168 . . [5.1.2600.5938] . . d:\windows\system32\ntkrnlpa.exe
[7] 2010-02-16 . E94AC126E7ADFD40DC4E38D2E91236D8 . 2071168 . . [5.1.2600.5938] . . d:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[7] 2009-12-09 . 7D45AF0A376A7EEE59B2A4BCDC304C9C . 2070400 . . [5.1.2600.5913] . . d:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
[7] 2009-08-05 . 6FEC1B436323CC29B3008D7C5BF2A10F . 2070400 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[7] 2009-02-09 . FF7FE874B6DA494303EE3DD9B97AB007 . 2070400 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 . 586A93E0C23F6A1893F6706F36B22598 . 2070272 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[7] 2008-08-14 . 145CD2BBA58988B7A2E9B910AC4D4CA4 . 2067200 . . [5.1.2600.3427] . . d:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[7] 2008-08-14 . A62251C7C1F0DBC3241ABF1985EDE75E . 2070272 . . [5.1.2600.5657] . . d:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[7] 2007-02-28 . D027F0097B8F099C09369B8CC97D7C32 . 2063616 . . [5.1.2600.3093] . . d:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[7] 2005-03-02 . AED7B3AA86AD031CF39C6E4BBA37E818 . 2061184 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
d:\documents and settings\edsom luis\Menu Iniciar\Programas\Inicializar\
ERUNT AutoBackup.lnk - d:\arquivos de programas\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 40448 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-28 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-28 16:41
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\SETUPAPI.dll
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\SETUPAPI.dll
d:\windows\system32\srclient.dll
d:\windows\system32\psbase.dll
.
Tempo para conclusão: 2010-05-28 16:44:32
ComboFix-quarantined-files.txt 2010-05-28 19:44
ComboFix2.txt 2010-05-28 17:24
Pré-execução: 19 pasta(s) 41.448.308.736 bytes disponíveis
Pós execução: 22 pasta(s) 41.290.235.904 bytes disponíveis
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Invalid Product Key
Validation Code: 8
Cached Validation Code: N/A
Windows Product Key: ***-***-FWXGY-2HVXJ-TTBDY
Windows Product Key Hash: yv4lEg5fXzvi6LfaAzcBV+x8AYs=
Windows Product ID: 55274-644-4902724-23740
Windows Product ID Type: 1
Windows License Type: Volume
Windows OS version: 5.1.2600.2.00010100.3.0.pro
ID: {A1DF6199-98A6-475E-AEA6-16F8E1B99066}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.9.1
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A
Version: N/A
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-543-80070002_025D1FF3-230-1
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: D:\Arquivos de programas\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: D:\WINDOWS\system32\winlogon.exe[5.1.2600.5512], Hr = 0x800b0100
File Mismatch: D:\WINDOWS\system32\ntoskrnl.exe[5.1.2600.5938], Hr = 0x800b0100
File Mismatch: D:\WINDOWS\system32\setupapi.dll[5.1.2600.5512], Hr = 0x800b0100
File Mismatch: D:\WINDOWS\system32\syssetup.dll[5.1.2600.5512], Hr = 0x800b0100
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{A1DF6199-98A6-475E-AEA6-16F8E1B99066}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>***---***-TTBDY</PKey><PID>55274-644-4902724-23740</PID><PIDType>1</PIDType><SID>S-1-5-21-839522115-1409082233-725345543</SID><SYSTEM><Manufacturer>ECS</Manufacturer><Model>M825G</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>Version 07.00T</Version><SMBIOSVersion major="2" minor="3"/><Date>20010402000000.000000+000</Date></BIOS><HWID>BCF13ED70184205B</HWID><UserLCID>0416</UserLCID><SystemLCID>0416</SystemLCID><TimeZone>Hora oficial do Brasil(GMT-03:00)</TimeZone><iJoin>0</iJoin><SBID><stat>2</stat><msppid></msppid><name>NiwradSoft</name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Licensing Data-->
N/A
Windows Activation Technologies-->
N/A
HWID Data-->
N/A
OEM Activation 1.0 Data-->
BIOS string matches: yes
Marker string from BIOS: 1AFDC:Elitegroup Computer Systems Co Ltd
Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005
OEM Activation 2.0 Data-->
N/A
RaProducts' PureRa v1.5
Log created at 14:47 on 28/05/2010 (edsom luis)
D:\Config.MSI emptied.
D:\WINDOWS\system32\FNTCACHE.DAT <- Successfully deleted.
Recycle bin emptied.
D:\WINDOWS\SoftwareDistribution\DataStore\Logs emptied.
D:\WINDOWS\SoftwareDistribution\Download emptied.
D:\WINDOWS\SoftwareDistribution\SelfUpdate\Default emptied.
D:\WINDOWS\SoftwareDistribution\WuRedir emptied.
D:\WINDOWS\SoftwareDistribution\ReportingEvents.log <- O arquivo já está sendo usado por outro processo.
D:\DOCUME~1\EDSOML~1\CONFIG~1\Temp emptied.
D:\WINDOWS\TEMP emptied.
D:\WINDOWS\$NtUninstallKB979309$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB978706$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB978601$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB977816$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB978338$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB979402_WM9$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB980232$ <- Successfully deleted.
D:\WINDOWS\$NtUninstallKB979683$ <- Successfully deleted.
D:\WINDOWS\system32\wbem\Logs\wbemcore.log <- Successfully deleted.
D:\WINDOWS\system32\wbem\Logs\wmiprov.log <- Successfully deleted.
D:\WINDOWS\system32\wbem\Logs\wbemess.log <- Successfully deleted.
D:\WINDOWS\system32\wbem\Logs\FrameWork.log <- Successfully deleted.
D:\ComboFix\Thumbs.db <- Successfully deleted.
D:\Documents and Settings\edsom luis\Configurações locais\Dados de aplicativos\IconCache.db <- Successfully deleted.
D:\Documents and Settings\edsom luis\Meus documentos\Minhas imagens\Thumbs.db <- Successfully deleted.
Total space cleaned: 48053543 bytes
-=E.O.F=-
Uploaded with ImageShack.us
This tool flushes the System File Checker DLLCACHE folder, via this command:
sfc.exe /purgecache
You should always purge the cache before scanning with the System File Checker (SFC). That way, you can be sure that system files are copied from your Windows installation media, and are not infected with malware or corrupted.
Uploaded with ImageShack.us
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/05/28 15:34
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: mbr.sys
Image Path: D:\DOCUME~1\EDSOML~1\CONFIG~1\Temp\mbr.sys
Address: 0xF8976000 Size: 20864 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: D:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF6B63000 Size: 49152 File Visible: No Signed: -
Status: -
Hidden/Locked Files
-------------------
Path: d:\documents and settings\edsom luis\meus documentos\salvação..bkf
Status: Allocation size mismatch (API: 4294967295, Raw: 0)
Path: d:\documents and settings\edsom luis\configurações locais\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\cache\_cache_001_
Status: Allocation size mismatch (API: 3112960, Raw: 2621440)
Path: d:\documents and settings\edsom luis\configurações locais\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\cache\_cache_002_
Status: Allocation size mismatch (API: 3735552, Raw: 3342336)
Path: d:\documents and settings\edsom luis\configurações locais\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\cache\_cache_003_
Status: Allocation size mismatch (API: 7110656, Raw: 6127616)
SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "<unknown>" at address 0xf8c4d68e
#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0xf8c4d684
#: 063 Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0xf8c4d693
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0xf8c4d69d
#: 098 Function Name: NtLoadKey
Status: Hooked by "<unknown>" at address 0xf8c4d6a2
#: 122 Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0xf8c4d670
#: 128 Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0xf8c4d675
#: 193 Function Name: NtReplaceKey
Status: Hooked by "<unknown>" at address 0xf8c4d6ac
#: 204 Function Name: NtRestoreKey
Status: Hooked by "<unknown>" at address 0xf8c4d6a7
#: 247 Function Name: NtSetValueKey
Status: Hooked by "<unknown>" at address 0xf8c4d698
==EOF==
Abraços e obrigado
Boa Noite! EDSSX
<!> Ps: Se teve dificuldades ao baixar TS.zip,no 1° link que dispus,tente então pelo 2° link que acrescentei lá no Post.
<!> Ao baixar,descompacte-o para a seguinte pasta: d:\windows\ServicePackFiles\i386 <--
<!> Eis,ao concluir,o caminho resultante: d:\windows\ServicePackFiles\i386\TS
00000000000000000000000
ooooooooooooooooooooooo
<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.
<@> Salve-o,no Desktop,com o nome: CFScript.txt
>
File::d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
d:\windows\ie8updates\KB980182-IE8\mshtml.dll
d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
d:\windows\ie8updates\KB978207-IE8\mshtml.dll
d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
d:\windows\ie8updates\KB976325-IE8\mshtml.dll
d:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll
d:\windows\ie8updates\KB976749-IE8\mshtml.dll
d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
d:\windows\ie8updates\KB974455-IE8\mshtml.dll
d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll
d:\windows\ie8updates\KB972260-IE8\mshtml.dll
d:\windows\ie8updates\KB969897-IE8\mshtml.dll
d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
d:\windows\ie7updates\KB961260-IE7\mshtml.dll
d:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
d:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll
d:\windows\ie7updates\KB960714-IE7\mshtml.dll
d:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
d:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
d:\windows\ie8updates\KB980182-IE8\wininet.dll
d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
d:\windows\ie8updates\KB978207-IE8\wininet.dll
d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
d:\windows\ie8updates\KB976325-IE8\wininet.dll
d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
d:\windows\ie8updates\KB974455-IE8\wininet.dll
d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
d:\windows\ie8updates\KB972260-IE8\wininet.dll
d:\windows\ie8updates\KB969897-IE8\wininet.dll
d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
d:\windows\ie7updates\KB961260-IE7\wininet.dll
d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
d:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll
d:\windows\ie7updates\KB958215-IE7\wininet.dll
d:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
d:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
d:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
RESTORE::
d:\windows\system32\comctl32.dll
d:\windows\system32\winlogon.exe
d:\windows\system32\setupapi.dll
d:\windows\system32\syssetup.dll
d:\windows\system32\user32.dll
d:\windows\system32\ctfmon.exe
d:\windows\explorer.exe
<@> Ps: É recomendável que esteja desconectado,ao rodar o script.
<@> Ps: Desabilite,temporariamente,seu antivírus.
<@> Ps: Não utilizem este script em outra máquina!
<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.
<@> Veja a demonstração!
/applications/core/interface/imageproxy/imageproxy.php?img=http://farm4.static.flickr.com/3028/2872959479_997d4500c4_o.gif&key=5df91a69abacb5902724f70d14994f3bf5ba8d87bf300cea4c6fd8c885940cf0" alt="2872959479_997d4500c4_o.gif" />
<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.
<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )
<@> Terminando,poste: D:\ComboFix.txt
Abraços!
Bom dia ! DigRam
Deu certo o TS .
Segue o log :
ComboFix 10-05-28.02 - edsom luis 29/05/2010 0:03.17.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.231 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FILE ::
"d:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll"
"d:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe"
"d:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll"
"d:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll"
"d:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll"
"d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll"
"d:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll"
"d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll"
"d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll"
"d:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll"
"d:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe"
"d:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe"
"d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll"
"d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll"
"d:\windows\ie7updates\KB958215-IE7\wininet.dll"
"d:\windows\ie7updates\KB960714-IE7\mshtml.dll"
"d:\windows\ie7updates\KB961260-IE7\mshtml.dll"
"d:\windows\ie7updates\KB961260-IE7\wininet.dll"
"d:\windows\ie8updates\KB969897-IE8\mshtml.dll"
"d:\windows\ie8updates\KB969897-IE8\wininet.dll"
"d:\windows\ie8updates\KB972260-IE8\mshtml.dll"
"d:\windows\ie8updates\KB972260-IE8\wininet.dll"
"d:\windows\ie8updates\KB974455-IE8\mshtml.dll"
"d:\windows\ie8updates\KB974455-IE8\wininet.dll"
"d:\windows\ie8updates\KB976325-IE8\mshtml.dll"
"d:\windows\ie8updates\KB976325-IE8\wininet.dll"
"d:\windows\ie8updates\KB976749-IE8\mshtml.dll"
"d:\windows\ie8updates\KB978207-IE8\mshtml.dll"
"d:\windows\ie8updates\KB978207-IE8\wininet.dll"
"d:\windows\ie8updates\KB980182-IE8\mshtml.dll"
"d:\windows\ie8updates\KB980182-IE8\wininet.dll"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
d:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
d:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll
d:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll
d:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
d:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll
d:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
d:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll
d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll
d:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll
d:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll
d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB974455-IE8\SP3QFE\wininet.dll
d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
d:\windows\$hf_mig$\KB976749-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
d:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
d:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
d:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
d:\windows\ie7updates\KB958215-IE7\wininet.dll
d:\windows\ie7updates\KB960714-IE7\mshtml.dll
d:\windows\ie7updates\KB961260-IE7\mshtml.dll
d:\windows\ie7updates\KB961260-IE7\wininet.dll
d:\windows\ie8updates\KB969897-IE8\mshtml.dll
d:\windows\ie8updates\KB969897-IE8\wininet.dll
d:\windows\ie8updates\KB972260-IE8\mshtml.dll
d:\windows\ie8updates\KB972260-IE8\wininet.dll
d:\windows\ie8updates\KB974455-IE8\mshtml.dll
d:\windows\ie8updates\KB974455-IE8\wininet.dll
d:\windows\ie8updates\KB976325-IE8\mshtml.dll
d:\windows\ie8updates\KB976325-IE8\wininet.dll
d:\windows\ie8updates\KB976749-IE8\mshtml.dll
d:\windows\ie8updates\KB978207-IE8\mshtml.dll
d:\windows\ie8updates\KB978207-IE8\wininet.dll
d:\windows\ie8updates\KB980182-IE8\mshtml.dll
d:\windows\ie8updates\KB980182-IE8\wininet.dll
d:\windows\rrxx.dll
A cópia de d:\windows\explorer.exe foi encontrada e desinfectada
Cópia restaurada de - d:\windows\ServicePackFiles\i386\TS\explorer.exe
A cópia de d:\windows\system32\comctl32.dll foi encontrada e desinfectada
Cópia restaurada de - d:\windows\ServicePackFiles\i386\TS\comctl32.dll
A cópia de d:\windows\system32\ctfmon.exe foi encontrada e desinfectada
Cópia restaurada de - d:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe
A cópia de d:\windows\system32\setupapi.dll foi encontrada e desinfectada
Cópia restaurada de - d:\windows\ServicePackFiles\i386\TS\setupapi.dll
A cópia de d:\windows\system32\syssetup.dll foi encontrada e desinfectada
Cópia restaurada de - d:\windows\ServicePackFiles\i386\TS\syssetup.dll
A cópia de d:\windows\system32\user32.dll foi encontrada e desinfectada
Cópia restaurada de - d:\windows\ServicePackFiles\i386\TS\user32.dll
A cópia de d:\windows\system32\winlogon.exe foi encontrada e desinfectada
Cópia restaurada de - d:\windows\ServicePackFiles\i386\TS\winlogon.exe
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-29 ))))))))))))))))))))))))))))
.
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-28 00:24 . 2010-05-28 00:24 65536 ----a-w- d:\windows\IFinst27.exe
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
2010-04-29 22:09 . 2007-01-18 12:00 3968 ----a-w- d:\windows\system32\drivers\AvgArCln.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-26 15:39 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2008-04-14 03:21 . 2010-05-18 02:33 73728 --sha-w- d:\windows\NiwradSoft Shell Pack\Backup\wmplayer.exe
2009-03-08 17:09 . 2010-05-18 02:33 638816 --sha-w- d:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\ServicePackFiles\i386\mshtml.dll
[7] 2009-01-17 . BC083F2B02EA9E69A636970859AF8DAF . 3594752 . . [7.00.6000.16809] . . d:\windows\ie8\mshtml.dll
[-] 2010-02-17 . 16F9B5E8C253A9211ED01885077C7526 . 2354304 . . [5.1.2600.5938] . . d:\windows\system32\ntoskrnl.exe
[7] 2010-02-17 . 124F4EC97A7683D1A67B3AECFE258ABD . 2194176 . . [5.1.2600.5938] . . d:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2010-02-17 . 124F4EC97A7683D1A67B3AECFE258ABD . 2194176 . . [5.1.2600.5938] . . d:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
[-] 2010-02-17 . 16F9B5E8C253A9211ED01885077C7526 . 2354304 . . [5.1.2600.5938] . . d:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\ServicePackFiles\i386\wininet.dll
[7] 2008-12-20 . 94A623D9C0F2632796B4CE2753331F98 . 826368 . . [7.00.6000.16791] . . d:\windows\ie8\wininet.dll
[-] 2010-02-16 . 297C1AE40DE572E38618042B781EEE15 . 2231168 . . [5.1.2600.5938] . . d:\windows\system32\ntkrnlpa.exe
[7] 2010-02-16 . 1F54DE75A9C8EC46E9FB53C1890C9ED3 . 2071040 . . [5.1.2600.5938] . . d:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2010-02-16 . 1F54DE75A9C8EC46E9FB53C1890C9ED3 . 2071040 . . [5.1.2600.5938] . . d:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
[-] 2010-02-16 . 297C1AE40DE572E38618042B781EEE15 . 2231168 . . [5.1.2600.5938] . . d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-29 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-29 00:13
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\windows\system32\msi.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-29 00:16:51 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-29 03:16
ComboFix2.txt 2010-05-28 19:44
Pré-execução: 20 pasta(s) 41.179.283.456 bytes disponíveis
Pós execução: 23 pasta(s) 40.973.172.736 bytes disponíveis
Abraços
Bom Dia! EDSSX
<@> Baixe: < TS-2 >
<@> Descompacte-o para a pasta: d:\windows\ServicePackFiles\i386
<@> Onde,passaremos a ter o seguinte caminho: d:\windows\ServicePackFiles\i386\TS-2
<@> Ps: Recomendo que delete a pasta TS,substituindo-a pela TS-2.
0000000000000000000000
oooooooooooooooooooooo
<@> Selecione e copie,todo o conteúdo que está na área do Quote,para o Bloco de Notas.
<@> Salve-o,no Desktop,com o nome: CFScript.txt
>
File::d:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
d:\windows\ServicePackFiles\i386\ntoskrnl.exe
d:\windows\ServicePackFiles\i386\wininet.dll
d:\windows\ServicePackFiles\i386\mshtml.dll
d:\windows\Driver Cache\i386\ntoskrnl.exe
d:\windows\Driver Cache\i386\ntkrnlpa.exe
RESTORE::
d:\windows\system32\ntoskrnl.exe
d:\windows\system32\ntkrnlpa.exe
d:\windows\system32\wininet.dll
d:\windows\system32\mshtml.dll
d:\windows\ie8\wininet.dll
d:\windows\ie8\mshtml.dll
Folder::
d:\windows\NiwradSoft Shell Pack\Backup
<@> Ps: É recomendável que esteja desconectado,ao rodar o script.
<@> Ps: Desabilite,temporariamente,seu antivírus.
<@> Ps: Não utilizem este script em outra máquina!
<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.
<@> Veja a demonstração!
/applications/core/interface/imageproxy/imageproxy.php?img=http://farm4.static.flickr.com/3028/2872959479_997d4500c4_o.gif&key=5df91a69abacb5902724f70d14994f3bf5ba8d87bf300cea4c6fd8c885940cf0" alt="2872959479_997d4500c4_o.gif" />
<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.
<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )
<@> Terminando,poste: D:\ComboFix.txt
0000000000000000000000
oooooooooooooooooooooo
<!> Estando seus arquivos restaurados,pode executar "The Comedian.exe".
0000000000000000000000
<@> Baixe: < The_Comedian > ( ...by Rorschach112 )
<@> Salve-o no desktop,renomeado como: komedian.exe
<@> Execute komedian.exe,com um duplo-clique.
<@> Siga as várias etapas ( Steps 1,2,3,4.. ),sempre apertando Enter.
Step 1 --> Turning off wordwrap..
Step 2 --> Fixing file associations
Step 3 --> Creating an ERUNT registry backup..
<@> Permita a instalação de ERUNT,que estabelecerá backup ao registro.
<@> Conclua a etapa 4 ( Step 4 ),que irá criar um novo Ponto de restauração do sistema.
<@> Confirme a finalização dessa etapa,que terminará automaticamente.
<@> Por default,o backup estará em: C:\WINDOWS\ERUNT\d-m-2010
Abraços!
Bom dia ! DigRam
ComboFix 10-05-28.06 - edsom luis 29/05/2010 9:26.18.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.273 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FILE ::
"d:\windows\Driver Cache\i386\ntkrnlpa.exe"
"d:\windows\Driver Cache\i386\ntoskrnl.exe"
"d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll"
"d:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe"
"d:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe"
"d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll"
"d:\windows\ServicePackFiles\i386\mshtml.dll"
"d:\windows\ServicePackFiles\i386\ntkrnlpa.exe"
"d:\windows\ServicePackFiles\i386\ntoskrnl.exe"
"d:\windows\ServicePackFiles\i386\wininet.dll"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\Driver Cache\i386\ntkrnlpa.exe
d:\windows\Driver Cache\i386\ntoskrnl.exe
d:\windows\NiwradSoft Shell Pack\Backup
d:\windows\NiwradSoft Shell Pack\Backup\acctres.dll
d:\windows\NiwradSoft Shell Pack\Backup\admparse.dll
d:\windows\NiwradSoft Shell Pack\Backup\ahui.exe
d:\windows\NiwradSoft Shell Pack\Backup\appmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\asctrls.ocx
d:\windows\NiwradSoft Shell Pack\Backup\Audiodev.dll
d:\windows\NiwradSoft Shell Pack\Backup\batmeter.dll
d:\windows\NiwradSoft Shell Pack\Backup\batt.dll
d:\windows\NiwradSoft Shell Pack\Backup\browseui.dll
d:\windows\NiwradSoft Shell Pack\Backup\bthci.dll
d:\windows\NiwradSoft Shell Pack\Backup\cabview.dll
d:\windows\NiwradSoft Shell Pack\Backup\capesnpn.dll
d:\windows\NiwradSoft Shell Pack\Backup\cards.dll
d:\windows\NiwradSoft Shell Pack\Backup\cdfview.dll
d:\windows\NiwradSoft Shell Pack\Backup\certmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\ciadmin.dll
d:\windows\NiwradSoft Shell Pack\Backup\cleanmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\cliconfg.exe
d:\windows\NiwradSoft Shell Pack\Backup\clipsrv.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmd.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmdial32.dll
d:\windows\NiwradSoft Shell Pack\Backup\cmdl32.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmmon32.exe
d:\windows\NiwradSoft Shell Pack\Backup\cmprops.dll
d:\windows\NiwradSoft Shell Pack\Backup\cmstp.exe
d:\windows\NiwradSoft Shell Pack\Backup\comctl32.dll
d:\windows\NiwradSoft Shell Pack\Backup\comdlg32.dll
d:\windows\NiwradSoft Shell Pack\Backup\compatUI.dll
d:\windows\NiwradSoft Shell Pack\Backup\compstui.dll
d:\windows\NiwradSoft Shell Pack\Backup\comres.dll
d:\windows\NiwradSoft Shell Pack\Backup\conime.exe
d:\windows\NiwradSoft Shell Pack\Backup\console.dll
d:\windows\NiwradSoft Shell Pack\Backup\credui.dll
d:\windows\NiwradSoft Shell Pack\Backup\cryptui.dll
d:\windows\NiwradSoft Shell Pack\Backup\cscdll.dll
d:\windows\NiwradSoft Shell Pack\Backup\cscript.exe
d:\windows\NiwradSoft Shell Pack\Backup\cscui.dll
d:\windows\NiwradSoft Shell Pack\Backup\ctfmon.exe
d:\windows\NiwradSoft Shell Pack\Backup\dataclen.dll
d:\windows\NiwradSoft Shell Pack\Backup\ddeshare.exe
d:\windows\NiwradSoft Shell Pack\Backup\desk.cpl
d:\windows\NiwradSoft Shell Pack\Backup\deskadp.dll
d:\windows\NiwradSoft Shell Pack\Backup\deskmon.dll
d:\windows\NiwradSoft Shell Pack\Backup\deskperf.dll
d:\windows\NiwradSoft Shell Pack\Backup\devmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\dfrgres.dll
d:\windows\NiwradSoft Shell Pack\Backup\dfrgui.dll
d:\windows\NiwradSoft Shell Pack\Backup\dfshim.dll
d:\windows\NiwradSoft Shell Pack\Backup\digest.dll
d:\windows\NiwradSoft Shell Pack\Backup\diskcopy.dll
d:\windows\NiwradSoft Shell Pack\Backup\dmdlgs.dll
d:\windows\NiwradSoft Shell Pack\Backup\dmdskres.dll
d:\windows\NiwradSoft Shell Pack\Backup\dpmodemx.dll
d:\windows\NiwradSoft Shell Pack\Backup\dpvoice.dll
d:\windows\NiwradSoft Shell Pack\Backup\drwtsn32.exe
d:\windows\NiwradSoft Shell Pack\Backup\dsprop.dll
d:\windows\NiwradSoft Shell Pack\Backup\dsquery.dll
d:\windows\NiwradSoft Shell Pack\Backup\dsuiext.dll
d:\windows\NiwradSoft Shell Pack\Backup\dvdplay.exe
d:\windows\NiwradSoft Shell Pack\Backup\els.dll
d:\windows\NiwradSoft Shell Pack\Backup\EqnClass.Dll
d:\windows\NiwradSoft Shell Pack\Backup\eventvwr.exe
d:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
d:\windows\NiwradSoft Shell Pack\Backup\fde.dll
d:\windows\NiwradSoft Shell Pack\Backup\filemgmt.dll
d:\windows\NiwradSoft Shell Pack\Backup\fldrclnr.dll
d:\windows\NiwradSoft Shell Pack\Backup\fontext.dll
d:\windows\NiwradSoft Shell Pack\Backup\fsusd.dll
d:\windows\NiwradSoft Shell Pack\Backup\gcdef.dll
d:\windows\NiwradSoft Shell Pack\Backup\gpedit.dll
d:\windows\NiwradSoft Shell Pack\Backup\gptext.dll
d:\windows\NiwradSoft Shell Pack\Backup\grpconv.exe
d:\windows\NiwradSoft Shell Pack\Backup\hdwwiz.cpl
d:\windows\NiwradSoft Shell Pack\Backup\HelpCtr.exe
d:\windows\NiwradSoft Shell Pack\Backup\hnetcfg.dll
d:\windows\NiwradSoft Shell Pack\Backup\hnetwiz.dll
d:\windows\NiwradSoft Shell Pack\Backup\hotplug.dll
d:\windows\NiwradSoft Shell Pack\Backup\icmui.dll
d:\windows\NiwradSoft Shell Pack\Backup\icwdial.dll
d:\windows\NiwradSoft Shell Pack\Backup\ieaksie.dll
d:\windows\NiwradSoft Shell Pack\Backup\ieakui.dll
d:\windows\NiwradSoft Shell Pack\Backup\iepeers.dll
d:\windows\NiwradSoft Shell Pack\Backup\iernonce.dll
d:\windows\NiwradSoft Shell Pack\Backup\iesetup.dll
d:\windows\NiwradSoft Shell Pack\Backup\iexplore.exe
d:\windows\NiwradSoft Shell Pack\Backup\InetCpl.cpl
d:\windows\NiwradSoft Shell Pack\Backup\inetcplc.dll
d:\windows\NiwradSoft Shell Pack\Backup\inetppui.dll
d:\windows\NiwradSoft Shell Pack\Backup\inetres.dll
d:\windows\NiwradSoft Shell Pack\Backup\input.dll
d:\windows\NiwradSoft Shell Pack\Backup\intl.cpl
d:\windows\NiwradSoft Shell Pack\Backup\ipsecsnp.dll
d:\windows\NiwradSoft Shell Pack\Backup\ipsmsnap.dll
d:\windows\NiwradSoft Shell Pack\Backup\irclass.dll
d:\windows\NiwradSoft Shell Pack\Backup\irprops.cpl
d:\windows\NiwradSoft Shell Pack\Backup\isign32.dll
d:\windows\NiwradSoft Shell Pack\Backup\itss.dll
d:\windows\NiwradSoft Shell Pack\Backup\ivfsrc.ax
d:\windows\NiwradSoft Shell Pack\Backup\jobexec.dll
d:\windows\NiwradSoft Shell Pack\Backup\joy.cpl
d:\windows\NiwradSoft Shell Pack\Backup\keymgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\localsec.dll
d:\windows\NiwradSoft Shell Pack\Backup\logonui.exe
d:\windows\NiwradSoft Shell Pack\Backup\magnify.exe
d:\windows\NiwradSoft Shell Pack\Backup\main.cpl
d:\windows\NiwradSoft Shell Pack\Backup\mapi32.dll
d:\windows\NiwradSoft Shell Pack\Backup\mapistub.dll
d:\windows\NiwradSoft Shell Pack\Backup\mdminst.dll
d:\windows\NiwradSoft Shell Pack\Backup\mdwmdmsp.dll
d:\windows\NiwradSoft Shell Pack\Backup\midimap.dll
d:\windows\NiwradSoft Shell Pack\Backup\migpwd.exe
d:\windows\NiwradSoft Shell Pack\Backup\migwiz.exe
d:\windows\NiwradSoft Shell Pack\Backup\mmc.exe
d:\windows\NiwradSoft Shell Pack\Backup\mmcbase.dll
d:\windows\NiwradSoft Shell Pack\Backup\mmcndmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\mmcshext.dll
d:\windows\NiwradSoft Shell Pack\Backup\mmsys.cpl
d:\windows\NiwradSoft Shell Pack\Backup\mnmsrvc.exe
d:\windows\NiwradSoft Shell Pack\Backup\mobsync.dll
d:\windows\NiwradSoft Shell Pack\Backup\mobsync.exe
d:\windows\NiwradSoft Shell Pack\Backup\modemui.dll
d:\windows\NiwradSoft Shell Pack\Backup\moricons.dll
d:\windows\NiwradSoft Shell Pack\Backup\mplay32.exe
d:\windows\NiwradSoft Shell Pack\Backup\mprui.dll
d:\windows\NiwradSoft Shell Pack\Backup\mqsnap.dll
d:\windows\NiwradSoft Shell Pack\Backup\mqutil.dll
d:\windows\NiwradSoft Shell Pack\Backup\msconf.dll
d:\windows\NiwradSoft Shell Pack\Backup\msconfig.exe
d:\windows\NiwradSoft Shell Pack\Backup\mscorier.dll
d:\windows\NiwradSoft Shell Pack\Backup\msdxm.ocx
d:\windows\NiwradSoft Shell Pack\Backup\msgina.dll
d:\windows\NiwradSoft Shell Pack\Backup\mshta.exe
d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
d:\windows\NiwradSoft Shell Pack\Backup\msi.dll
d:\windows\NiwradSoft Shell Pack\Backup\msident.dll
d:\windows\NiwradSoft Shell Pack\Backup\msidntld.dll
d:\windows\NiwradSoft Shell Pack\Backup\msieftp.dll
d:\windows\NiwradSoft Shell Pack\Backup\msiexec.exe
d:\windows\NiwradSoft Shell Pack\Backup\msihnd.dll
d:\windows\NiwradSoft Shell Pack\Backup\msimn.exe
d:\windows\NiwradSoft Shell Pack\Backup\msinfo32.exe
d:\windows\NiwradSoft Shell Pack\Backup\msoeres.dll
d:\windows\NiwradSoft Shell Pack\Backup\msratelc.dll
d:\windows\NiwradSoft Shell Pack\Backup\msrating.dll
d:\windows\NiwradSoft Shell Pack\Backup\msshavmsg.dll
d:\windows\NiwradSoft Shell Pack\Backup\mstsc.exe
d:\windows\NiwradSoft Shell Pack\Backup\mstscax.dll
d:\windows\NiwradSoft Shell Pack\Backup\msutb.dll
d:\windows\NiwradSoft Shell Pack\Backup\msvfw32.dll
d:\windows\NiwradSoft Shell Pack\Backup\msxml.dll
d:\windows\NiwradSoft Shell Pack\Backup\msxml2.dll
d:\windows\NiwradSoft Shell Pack\Backup\msxml3.dll
d:\windows\NiwradSoft Shell Pack\Backup\mycomput.dll
d:\windows\NiwradSoft Shell Pack\Backup\mydocs.dll
d:\windows\NiwradSoft Shell Pack\Backup\ncpa.cpl
d:\windows\NiwradSoft Shell Pack\Backup\netid.dll
d:\windows\NiwradSoft Shell Pack\Backup\netplwiz.dll
d:\windows\NiwradSoft Shell Pack\Backup\netsetup.exe
d:\windows\NiwradSoft Shell Pack\Backup\netshell.dll
d:\windows\NiwradSoft Shell Pack\Backup\newdev.dll
d:\windows\NiwradSoft Shell Pack\Backup\notepad.exe
d:\windows\NiwradSoft Shell Pack\Backup\nslookup.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntbackup.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntlanui2.dll
d:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntsd.exe
d:\windows\NiwradSoft Shell Pack\Backup\ntshrui.dll
d:\windows\NiwradSoft Shell Pack\Backup\nusrmgr.cpl
d:\windows\NiwradSoft Shell Pack\Backup\objsel.dll
d:\windows\NiwradSoft Shell Pack\Backup\occache.dll
d:\windows\NiwradSoft Shell Pack\Backup\odbcad32.exe
d:\windows\NiwradSoft Shell Pack\Backup\odbccp32.cpl
d:\windows\NiwradSoft Shell Pack\Backup\odbcint.dll
d:\windows\NiwradSoft Shell Pack\Backup\ole32.dll
d:\windows\NiwradSoft Shell Pack\Backup\osk.exe
d:\windows\NiwradSoft Shell Pack\Backup\osuninst.dll
d:\windows\NiwradSoft Shell Pack\Backup\osuninst.exe
d:\windows\NiwradSoft Shell Pack\Backup\packager.exe
d:\windows\NiwradSoft Shell Pack\Backup\pautoenr.dll
d:\windows\NiwradSoft Shell Pack\Backup\perfmon.exe
d:\windows\NiwradSoft Shell Pack\Backup\photowiz.dll
d:\windows\NiwradSoft Shell Pack\Backup\pifmgr.dll
d:\windows\NiwradSoft Shell Pack\Backup\powercfg.cpl
d:\windows\NiwradSoft Shell Pack\Backup\printui.dll
d:\windows\NiwradSoft Shell Pack\Backup\progman.exe
d:\windows\NiwradSoft Shell Pack\Backup\proquota.exe
d:\windows\NiwradSoft Shell Pack\Backup\psbase.dll
d:\windows\NiwradSoft Shell Pack\Backup\quartz.dll
d:\windows\NiwradSoft Shell Pack\Backup\rasdlg.dll
d:\windows\NiwradSoft Shell Pack\Backup\rasphone.exe
d:\windows\NiwradSoft Shell Pack\Backup\rcimlby.exe
d:\windows\NiwradSoft Shell Pack\Backup\regedit.exe
d:\windows\NiwradSoft Shell Pack\Backup\regwizc.dll
d:\windows\NiwradSoft Shell Pack\Backup\remotepg.dll
d:\windows\NiwradSoft Shell Pack\Backup\rstrui.exe
d:\windows\NiwradSoft Shell Pack\Backup\rtcshare.exe
d:\windows\NiwradSoft Shell Pack\Backup\rundll32.exe
d:\windows\NiwradSoft Shell Pack\Backup\sapi.cpl
d:\windows\NiwradSoft Shell Pack\Backup\scrobj.dll
d:\windows\NiwradSoft Shell Pack\Backup\sendmail.dll
d:\windows\NiwradSoft Shell Pack\Backup\servdeps.dll
d:\windows\NiwradSoft Shell Pack\Backup\setup.exe
d:\windows\NiwradSoft Shell Pack\Backup\setup_wm.exe
d:\windows\NiwradSoft Shell Pack\Backup\setupapi.dll
d:\windows\NiwradSoft Shell Pack\Backup\sfc_os.dll
d:\windows\NiwradSoft Shell Pack\Backup\shdoclc.dll
d:\windows\NiwradSoft Shell Pack\Backup\shdocvw.dll
d:\windows\NiwradSoft Shell Pack\Backup\shell32.dll
d:\windows\NiwradSoft Shell Pack\Backup\shimgvw.dll
d:\windows\NiwradSoft Shell Pack\Backup\shrpubw.exe
d:\windows\NiwradSoft Shell Pack\Backup\shscrap.dll
d:\windows\NiwradSoft Shell Pack\Backup\sigverif.exe
d:\windows\NiwradSoft Shell Pack\Backup\srchui.dll
d:\windows\NiwradSoft Shell Pack\Backup\srclient.dll
d:\windows\NiwradSoft Shell Pack\Backup\srrstr.dll
d:\windows\NiwradSoft Shell Pack\Backup\sti.dll
d:\windows\NiwradSoft Shell Pack\Backup\sti_ci.dll
d:\windows\NiwradSoft Shell Pack\Backup\stimon.exe
d:\windows\NiwradSoft Shell Pack\Backup\stobject.dll
d:\windows\NiwradSoft Shell Pack\Backup\storprop.dll
d:\windows\NiwradSoft Shell Pack\Backup\sxs.dll
d:\windows\NiwradSoft Shell Pack\Backup\syncapp.exe
d:\windows\NiwradSoft Shell Pack\Backup\syncui.dll
d:\windows\NiwradSoft Shell Pack\Backup\sysdm.cpl
d:\windows\NiwradSoft Shell Pack\Backup\syskey.exe
d:\windows\NiwradSoft Shell Pack\Backup\sysmon.ocx
d:\windows\NiwradSoft Shell Pack\Backup\sysocmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\syssetup.dll
d:\windows\NiwradSoft Shell Pack\Backup\tapiui.dll
d:\windows\NiwradSoft Shell Pack\Backup\taskmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\tcpmonui.dll
d:\windows\NiwradSoft Shell Pack\Backup\telephon.cpl
d:\windows\NiwradSoft Shell Pack\Backup\telnet.exe
d:\windows\NiwradSoft Shell Pack\Backup\themeui.dll
d:\windows\NiwradSoft Shell Pack\Backup\timedate.cpl
d:\windows\NiwradSoft Shell Pack\Backup\tourstart.exe
d:\windows\NiwradSoft Shell Pack\Backup\unimdm.tsp
d:\windows\NiwradSoft Shell Pack\Backup\upnpui.dll
d:\windows\NiwradSoft Shell Pack\Backup\url.dll
d:\windows\NiwradSoft Shell Pack\Backup\urlmon.dll
d:\windows\NiwradSoft Shell Pack\Backup\usbui.dll
d:\windows\NiwradSoft Shell Pack\Backup\user32.dll
d:\windows\NiwradSoft Shell Pack\Backup\userenv.dll
d:\windows\NiwradSoft Shell Pack\Backup\utilman.exe
d:\windows\NiwradSoft Shell Pack\Backup\verifier.exe
d:\windows\NiwradSoft Shell Pack\Backup\wab.exe
d:\windows\NiwradSoft Shell Pack\Backup\wab32.dll
d:\windows\NiwradSoft Shell Pack\Backup\wab32res.dll
d:\windows\NiwradSoft Shell Pack\Backup\wabfind.dll
d:\windows\NiwradSoft Shell Pack\Backup\wabimp.dll
d:\windows\NiwradSoft Shell Pack\Backup\webcheck.dll
d:\windows\NiwradSoft Shell Pack\Backup\wextract.exe
d:\windows\NiwradSoft Shell Pack\Backup\wiaacmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\wiadefui.dll
d:\windows\NiwradSoft Shell Pack\Backup\wiashext.dll
d:\windows\NiwradSoft Shell Pack\Backup\winbrand.dll
d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
d:\windows\NiwradSoft Shell Pack\Backup\winlogon.exe
d:\windows\NiwradSoft Shell Pack\Backup\winntbbu.dll
d:\windows\NiwradSoft Shell Pack\Backup\winsrv.dll
d:\windows\NiwradSoft Shell Pack\Backup\wintrust.dll
d:\windows\NiwradSoft Shell Pack\Backup\wmplayer.exe
d:\windows\NiwradSoft Shell Pack\Backup\wpabaln.exe
d:\windows\NiwradSoft Shell Pack\Backup\WpdShext.dll
d:\windows\NiwradSoft Shell Pack\Backup\wscui.cpl
d:\windows\NiwradSoft Shell Pack\Backup\wsecedit.dll
d:\windows\NiwradSoft Shell Pack\Backup\wuapi.dll
d:\windows\NiwradSoft Shell Pack\Backup\wuauclt.exe
d:\windows\NiwradSoft Shell Pack\Backup\wuaucpl.cpl
d:\windows\NiwradSoft Shell Pack\Backup\wuaueng1.dll
d:\windows\NiwradSoft Shell Pack\Backup\wucltui.dll
d:\windows\NiwradSoft Shell Pack\Backup\wupdmgr.exe
d:\windows\NiwradSoft Shell Pack\Backup\wuweb.dll
d:\windows\NiwradSoft Shell Pack\Backup\xpsp1res.dll
d:\windows\NiwradSoft Shell Pack\Backup\xpsp2res.dll
d:\windows\NiwradSoft Shell Pack\Backup\xpsp3res.dll
d:\windows\NiwradSoft Shell Pack\Backup\zipfldr.dll
d:\windows\ServicePackFiles\i386\mshtml.dll
d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
d:\windows\ServicePackFiles\i386\ntoskrnl.exe
d:\windows\ServicePackFiles\i386\wininet.dll
A cópia de d:\windows\ie8\mshtml.dll foi encontrada e desinfectada
Cópia restaurada de - d:\windows\NiwradSoft Shell Pack\Backup\mshtml.dll
A cópia de d:\windows\ie8\wininet.dll foi encontrada e desinfectada
Cópia restaurada de - d:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
A cópia de d:\windows\system32\ntkrnlpa.exe foi encontrada e desinfectada
Cópia restaurada de - d:\windows\Driver Cache\i386\ntkrnlpa.exe
A cópia de d:\windows\system32\ntoskrnl.exe foi encontrada e desinfectada
Cópia restaurada de - d:\windows\Driver Cache\i386\ntoskrnl.exe
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-29 ))))))))))))))))))))))))))))
.
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-28 00:24 . 2010-05-28 00:24 65536 ----a-w- d:\windows\IFinst27.exe
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
2010-04-29 22:09 . 2007-01-18 12:00 3968 ----a-w- d:\windows\system32\drivers\AvgArCln.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-26 15:39 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2009-12-22 . 9CEF5BDCA08EF0E1EDBE554DD42EA78A . 3092480 . . [6.00.2900.5921] . . d:\windows\ServicePackFiles\i386\TS\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
[-] 2009-12-22 . 48447E9A4417F21933C1A2C2CCC37E4E . 669184 . . [6.00.2900.5921] . . d:\windows\ServicePackFiles\i386\TS\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-29 12:35 . 2010-05-29 12:35 16384 d:\windows\temp\Perflib_Perfdata_7a4.dat
+ 2010-05-29 12:18 . 2008-04-14 12:00 509952 d:\windows\ServicePackFiles\i386\TS\winlogon.exe
+ 2010-05-29 12:18 . 2008-04-14 12:00 579072 d:\windows\ServicePackFiles\i386\TS\user32.dll
+ 2010-05-29 12:18 . 2008-04-14 12:00 995328 d:\windows\ServicePackFiles\i386\TS\setupapi.dll
+ 2010-05-29 12:18 . 2008-04-14 12:00 617472 d:\windows\ServicePackFiles\i386\TS\comctl32.dll
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-05-29 12:18 . 2008-04-14 12:00 1003008 d:\windows\ServicePackFiles\i386\TS\syssetup.dll
+ 2010-05-29 12:18 . 2010-02-17 17:07 2194176 d:\windows\ServicePackFiles\i386\TS\ntoskrnl.exe
+ 2010-05-29 12:18 . 2010-02-16 19:07 2071040 d:\windows\ServicePackFiles\i386\TS\ntkrnlpa.exe
+ 2010-05-29 12:18 . 2008-04-14 12:00 1035776 d:\windows\ServicePackFiles\i386\TS\explorer.exe
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-29 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-29 09:37
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\arquivos de programas\CursorXP\CurXP0.dll
d:\windows\system32\msi.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-29 09:40:11 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-29 12:40
ComboFix2.txt 2010-05-29 03:16
ComboFix3.txt 2010-05-28 19:44
Pré-execução: 22 pasta(s) 40.953.053.184 bytes disponíveis
Pós execução: 23 pasta(s) 40.893.317.120 bytes disponíveis
Obrigado e abraços
Bom Dia! EDSSX
<!> Após finalizar o script do ComboFix,copie/descompacte TS-1.zip,para o diretório: d:\windows\ServicePackFiles\i386 <--
000000000000000000000000
oooooooooooooooooooooooo
<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.
<@> Salve-o,no Desktop,com o nome: CFScript.txt
>
File::d:\windows\ServicePackFiles\i386\TS\mshtml.dll
d:\windows\ServicePackFiles\i386\TS\wininet.dll
Folder::
d:\windows\NiwradSoft Shell Pack\Backup
d:\windows\ServicePackFiles\i386\TS
<@> Ps: É recomendável que esteja desconectado,ao rodar o script.
<@> Ps: Desabilite,temporariamente,seu antivírus.
<@> Ps: Não utilizem este script em outra máquina!
<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.
<@> Veja a demonstração!
/applications/core/interface/imageproxy/imageproxy.php?img=http://farm4.static.flickr.com/3028/2872959479_997d4500c4_o.gif&key=5df91a69abacb5902724f70d14994f3bf5ba8d87bf300cea4c6fd8c885940cf0" alt="2872959479_997d4500c4_o.gif" />
<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.
<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )
<@> Terminando,poste: C:\ComboFix.txt
Abraços!
Boa tarde ! DigRam
Segue o log :
ComboFix 10-05-28.08 - edsom luis 29/05/2010 12:50:32.19.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.196 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FILE ::
"d:\windows\ServicePackFiles\i386\TS\mshtml.dll"
"d:\windows\ServicePackFiles\i386\TS\wininet.dll"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\ServicePackFiles\i386\TS
d:\windows\ServicePackFiles\i386\TS\comctl32.dll
d:\windows\ServicePackFiles\i386\TS\explorer.exe
d:\windows\ServicePackFiles\i386\TS\mshtml.dll
d:\windows\ServicePackFiles\i386\TS\ntkrnlpa.exe
d:\windows\ServicePackFiles\i386\TS\ntoskrnl.exe
d:\windows\ServicePackFiles\i386\TS\setupapi.dll
d:\windows\ServicePackFiles\i386\TS\syssetup.dll
d:\windows\ServicePackFiles\i386\TS\user32.dll
d:\windows\ServicePackFiles\i386\TS\wininet.dll
d:\windows\ServicePackFiles\i386\TS\winlogon.exe
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-29 ))))))))))))))))))))))))))))
.
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-28 00:24 . 2010-05-28 00:24 65536 ----a-w- d:\windows\IFinst27.exe
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
2010-04-29 22:09 . 2007-01-18 12:00 3968 ----a-w- d:\windows\system32\drivers\AvgArCln.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-26 15:39 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-29 12:35 . 2010-05-29 12:35 16384 d:\windows\temp\Perflib_Perfdata_7a4.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000004\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000002\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 462848 d:\windows\ERDNT\29-5-2010\Users\00000006\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 233472 d:\windows\ERDNT\29-5-2010\Users\00000003\NTUSER.DAT
+ 2010-05-29 12:53 . 2010-05-29 12:53 229376 d:\windows\ERDNT\29-5-2010\Users\00000001\NTUSER.DAT
+ 2010-05-29 12:53 . 2005-10-20 15:02 163328 d:\windows\ERDNT\29-5-2010\ERDNT.EXE
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-05-29 12:53 . 2010-05-29 12:53 12955648 d:\windows\ERDNT\29-5-2010\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-29 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-29 12:56
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
.
Tempo para conclusão: 2010-05-29 12:58:19
ComboFix-quarantined-files.txt 2010-05-29 15:58
ComboFix2.txt 2010-05-29 12:40
ComboFix3.txt 2010-05-29 03:16
ComboFix4.txt 2010-05-28 19:44
Pré-execução: 22 pasta(s) 40.612.265.984 bytes disponíveis
Pós execução: 23 pasta(s) 40.565.866.496 bytes disponíveis
Abraços
Boa Tarde! EDSSX
<!> Recomendo,ao concluirmos essas correções,a desinstalação de todos os seus softwares de proteção. Baixe o Panda Cloud Antivirus,que possui um forte banco de dados,que dispensa a aquisição de Antispywares ou Antimalwares,para complementar a segurança.
<!> Ps: Desinstale,também: ferramentas anti-rootkits,NaviFix,SDFix,etc...
00000000000000000000000
<@> Desinstale o Avira e baixe o primeiro antivírus,gratuito,com tecnologias de cloud-computing.
<!> < Panda Cloud Antivirus >
<@> Instale-o,portanto,no lugar do Avira.
<@> Maiores informações: < Link >
000000000000000000000000
oooooooooooooooooooooooo
<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.
<@> Salve-o,no Desktop,com o nome: CFScript.txt
>
RESTORE::d:\windows\system32\mshtml.dll
d:\windows\system32\wininet.dll
d:\windows\ie8\wininet.dll
d:\windows\ie8\mshtml.dll
Folder::
d:\windows\ServicePackFiles\i386\TS
d:\windows\NiwradSoft Shell Pack\Backup
<@> Ps: É recomendável que esteja desconectado,ao rodar o script.
<@> Ps: Desabilite,temporariamente,seu antivírus.
<@> Ps: Não utilizem este script em outra máquina!
<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.
<@> Veja a demonstração!
/applications/core/interface/imageproxy/imageproxy.php?img=http://farm4.static.flickr.com/3028/2872959479_997d4500c4_o.gif&key=5df91a69abacb5902724f70d14994f3bf5ba8d87bf300cea4c6fd8c885940cf0" alt="2872959479_997d4500c4_o.gif" />
<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.
<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )
<@> Terminando,poste: D:\ComboFix.txt
Abraços!
Boa noite ! DigRam
Segue o log:
ComboFix 10-05-29.03 - edsom luis 29/05/2010 20:36:48.20.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.217 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\ie8\mshtml.dll . . . está infectado!!
d:\windows\ie8\wininet.dll . . . está infectado!!
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-29 ))))))))))))))))))))))))))))
.
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-28 00:24 . 2010-05-28 00:24 65536 ----a-w- d:\windows\IFinst27.exe
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:38 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-29 23:49 . 2010-05-29 23:49 16384 d:\windows\temp\Perflib_Perfdata_f8.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000004\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000002\UsrClass.dat
+ 2010-05-29 16:12 . 2008-04-14 12:00 509952 d:\windows\ServicePackFiles\i386\TS\winlogon.exe
+ 2010-05-29 16:12 . 2008-04-14 12:00 579072 d:\windows\ServicePackFiles\i386\TS\user32.dll
+ 2010-05-29 16:12 . 2008-04-14 12:00 995328 d:\windows\ServicePackFiles\i386\TS\setupapi.dll
+ 2010-05-29 16:12 . 2008-04-14 12:00 617472 d:\windows\ServicePackFiles\i386\TS\comctl32.dll
+ 2010-05-29 12:53 . 2010-05-29 12:53 462848 d:\windows\ERDNT\29-5-2010\Users\00000006\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 233472 d:\windows\ERDNT\29-5-2010\Users\00000003\NTUSER.DAT
+ 2010-05-29 12:53 . 2010-05-29 12:53 229376 d:\windows\ERDNT\29-5-2010\Users\00000001\NTUSER.DAT
+ 2010-05-29 12:53 . 2005-10-20 15:02 163328 d:\windows\ERDNT\29-5-2010\ERDNT.EXE
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-05-29 16:12 . 2008-04-14 12:00 1003008 d:\windows\ServicePackFiles\i386\TS\syssetup.dll
+ 2010-05-29 16:12 . 2008-04-14 12:00 1035776 d:\windows\ServicePackFiles\i386\TS\explorer.exe
+ 2010-05-29 12:53 . 2010-05-29 12:53 12955648 d:\windows\ERDNT\29-5-2010\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-29 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-29 20:51
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\msi.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-29 20:54:14 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-29 23:54
ComboFix2.txt 2010-05-29 15:58
ComboFix3.txt 2010-05-29 12:40
ComboFix4.txt 2010-05-29 03:16
ComboFix5.txt 2010-05-29 23:34
Pré-execução: 22 pasta(s) 40.557.805.568 bytes disponíveis
Pós execução: 23 pasta(s) 40.515.731.456 bytes disponíveis
Abraços
Boa Noite! EDSSX
<!> Pelo relatório do ComboFix,TS-1.zip não foi descompactado para o diretório: d:\windows\ServicePackFiles\i386 <- Este diretório!
<!> Ps: Verifique e,à seguir,repita o procedimento com o script do ComboFix.
<!> Ps: É fundamental que TS-1 esteja na pasta i386,para que ocorra cópias restauradoras.
<!> Esteja atento! A pasta é TS-1,descompactada para i386 antes de rodar o script,e não TS,que deve/foi deletada em procedimento anterior.
<!> Vou,portanto,incluir novamente essa pasta para ser removida.
Abraços!
Boa noite !
Certo, entendi; porém este hiperlink TS-1.zip , não abre nada desde o teu penúltimo post; ai que me confundi zipando o TS .
Abraços
>
Boa noite !
Certo, entendi; porém este hiperlink TS-1.zip , não abre nada desde o teu penúltimo post; ai que me confundi zipando o TS .
Abraços
///////////\\\\\\\\\\
Opa! EDSSX
<!> Retificando! A pasta é TS-2 e não TS-1.
<!> Quanto ao link,testei-o agora mesmo e está funcional.
<!> Ps: Devido ao fato de não utilizar a pasta correta,em outro procedimento,ocorreram backups infectados alongando procedimentos repetitivos.
Abraços!
Bom dia ! DigRam
Após TS-2, repeti o último proçedimento script; e segue :
ComboFix 10-05-29.05 - edsom luis 30/05/2010 10:39:22.21.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.274 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\ServicePackFiles\i386\TS
d:\windows\ServicePackFiles\i386\TS\comctl32.dll
d:\windows\ServicePackFiles\i386\TS\explorer.exe
d:\windows\ServicePackFiles\i386\TS\mshtml.dll
d:\windows\ServicePackFiles\i386\TS\ntkrnlpa.exe
d:\windows\ServicePackFiles\i386\TS\ntoskrnl.exe
d:\windows\ServicePackFiles\i386\TS\setupapi.dll
d:\windows\ServicePackFiles\i386\TS\syssetup.dll
d:\windows\ServicePackFiles\i386\TS\user32.dll
d:\windows\ServicePackFiles\i386\TS\wininet.dll
d:\windows\ServicePackFiles\i386\TS\winlogon.exe
d:\windows\ie8\mshtml.dll . . . está infectado!!
d:\windows\ie8\wininet.dll . . . está infectado!!
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-30 ))))))))))))))))))))))))))))
.
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-28 00:24 . 2010-05-28 00:24 65536 ----a-w- d:\windows\IFinst27.exe
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:38 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-30 13:48 . 2010-05-30 13:48 16384 d:\windows\temp\Perflib_Perfdata_17c.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000004\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000002\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 462848 d:\windows\ERDNT\29-5-2010\Users\00000006\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 233472 d:\windows\ERDNT\29-5-2010\Users\00000003\NTUSER.DAT
+ 2010-05-29 12:53 . 2010-05-29 12:53 229376 d:\windows\ERDNT\29-5-2010\Users\00000001\NTUSER.DAT
+ 2010-05-29 12:53 . 2005-10-20 15:02 163328 d:\windows\ERDNT\29-5-2010\ERDNT.EXE
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-05-29 12:53 . 2010-05-29 12:53 12955648 d:\windows\ERDNT\29-5-2010\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-30 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-30 10:50
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\windows\system32\msi.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-30 10:52:49 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-30 13:52
ComboFix2.txt 2010-05-29 23:54
ComboFix3.txt 2010-05-29 15:58
ComboFix4.txt 2010-05-29 12:40
ComboFix5.txt 2010-05-30 13:37
Pré-execução: 22 pasta(s) 40.517.533.696 bytes disponíveis
Pós execução: 23 pasta(s) 40.493.121.536 bytes disponíveis
Aproveitando a oportunidade; veja só este ficheiro :
d:\windows\IFinst27.exe; no virus total segue :
Virus Total
VirusTotal é um serviço que analisa arquivos suspeitos e proporciona uma rápida detecção de vírus, worms, cavalos de tróia, e todos os tipos de arquivos maliciosos detectados por vários mecanismos de antivírus. Mais informações...
Arquivo IFinst27.exe recebido em 2010.05.30 14:09:55 (UTC)
Andamento: Carregando ... na fila aguardando analisando terminado NÃO ENCONTRADO PARADO
Resultado: 2/41 (4.88%)
Carregando informação do servidor...
O seu arquivo está na posição: ___.
Tempo estimado de início é entre ___ e ___ .
Não feche a janela até que a análise esteja completa.
O mecanismo que estava processando o arquivo parou, nós esperaremos alguns segundos para tentar recuperar o resultado.
Se estiver esperando por mais de cinco minutos, você terá que reenviar o arquivo.
O seu arquivo está sendo analisado por VirusTotal no momento,
os resultados serão exibidos assim que forem gerados.
Modo compacto Modo compacto
Imprimir resultados Imprimir resultados
O seu arquivo expirou ou não existe.
O serviço está parado no momento, o seu arquivo está esperando para ser analisado (posição: ) por tempo indeterminado.
Você pode aguardar por resposta na página (atualização automática) ou digite o seu email no campo abaixo e clique em "enviar" para que o sistema envie uma notificação quando a análise terminar.
Email:
Antivírus Versão Última Atualização Resultado
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.30.00 2010.05.29 -
AntiVir 8.2.1.242 2010.05.28 -
Antiy-AVL 2.0.3.7 2010.05.26 -
Authentium 5.2.0.5 2010.05.29 -
Avast 4.8.1351.0 2010.05.30 -
Avast5 5.0.332.0 2010.05.30 -
AVG 9.0.0.787 2010.05.30 -
BitDefender 7.2 2010.05.30 -
CAT-QuickHeal 10.00 2010.05.29 -
ClamAV 0.96.0.3-git 2010.05.30 -
Comodo 4954 2010.05.30 -
DrWeb 5.0.2.03300 2010.05.30 -
eSafe 7.0.17.0 2010.05.27 -
eTrust-Vet 35.2.7519 2010.05.29 -
F-Prot 4.6.0.103 2010.05.29 -
F-Secure 9.0.15370.0 2010.05.30 Suspicious:W32/Malware!Gemini
Fortinet 4.1.133.0 2010.05.30 -
GData 21 2010.05.30 -
Ikarus T3.1.1.84.0 2010.05.30 -
Jiangmin 13.0.900 2010.05.29 TrojanClicker.Agent.csf
Kaspersky 7.0.0.125 2010.05.30 -
McAfee 5.400.0.1158 2010.05.30 -
McAfee-GW-Edition 2010.1 2010.05.30 -
Microsoft 1.5802 2010.05.30 -
NOD32 5155 2010.05.30 -
Norman 6.04.12 2010.05.30 -
nProtect 2010-05-30.01 2010.05.30 -
Panda 10.0.2.7 2010.05.29 -
PCTools 7.0.3.5 2010.05.30 -
Prevx 3.0 2010.05.30 -
Rising 22.49.06.04 2010.05.30 -
Sophos 4.53.0 2010.05.30 -
Sunbelt 6376 2010.05.30 -
Symantec 20101.1.0.89 2010.05.30 -
TheHacker 6.5.2.0.290 2010.05.30 -
TrendMicro 9.120.0.1004 2010.05.30 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.30 -
VBA32 3.12.12.5 2010.05.29 -
ViRobot 2010.5.20.2326 2010.05.28 -
VirusBuster 5.0.27.0 2010.05.29 -
Informações adicionais
File size: 65536 bytes
MD5...: 9c17bca3ef837bacded7e4299508e71d
Abraços
Boa Tarde! EDSSX
<!> Quanto ao ficheiro,analisado,temos apenas 2 incidentes,para caracterizá-lo como malware.
<!> < ifinst27.exe >
<!> Envie-o para a lixeira,mas não o delete permanentemente! Observe os efeitos,dessa ação.
00000000000000000000
oooooooooooooooooooo
<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.
<@> Salve-o,no Desktop,com o nome: CFScript.txt
>
RESTORE::d:\windows\system32\mshtml.dll
d:\windows\system32\wininet.dll
d:\windows\ie8\wininet.dll
d:\windows\ie8\mshtml.dll
<@> Ps: É recomendável que esteja desconectado,ao rodar o script.
<@> Ps: Desabilite,temporariamente,seu antivírus.
<@> Ps: Não utilizem este script em outra máquina!
<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.
<@> Veja a demonstração!
/applications/core/interface/imageproxy/imageproxy.php?img=http://farm4.static.flickr.com/3028/2872959479_997d4500c4_o.gif&key=5df91a69abacb5902724f70d14994f3bf5ba8d87bf300cea4c6fd8c885940cf0" alt="2872959479_997d4500c4_o.gif" />
<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.
<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )
<@> Terminando,poste: D:\ComboFix.txt
Abraços!
Boa tarde ! DigRam
Desta vez ao começar/abrir o combofix ( independente de script ), constou arquivo corrompido ; pedindo a execução do scandisk para corrigi - lo e feito por mim . Já é a segunda vez que isto aconteçe; a principio pensei que fosse devido a utilizar o spyware doctor pois o mesmo removeu componente/arquivo do combofix na primeira vez ( já faz alguns dias ) ; porém desta vez não executei software nenhum .
Com o script supra, segue log :
ComboFix 10-05-29.05 - edsom luis 30/05/2010 12:55:21.22.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.164 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\ie8\mshtml.dll . . . está infectado!!
d:\windows\ie8\wininet.dll . . . está infectado!!
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-30 ))))))))))))))))))))))))))))
.
2010-05-30 15:34 . 2010-05-30 15:34 -------- d-----w- D:\FOUND.000
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:38 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-30 16:04 . 2010-05-30 16:04 16384 d:\windows\temp\Perflib_Perfdata_11c.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000004\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000002\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 462848 d:\windows\ERDNT\29-5-2010\Users\00000006\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 233472 d:\windows\ERDNT\29-5-2010\Users\00000003\NTUSER.DAT
+ 2010-05-29 12:53 . 2010-05-29 12:53 229376 d:\windows\ERDNT\29-5-2010\Users\00000001\NTUSER.DAT
+ 2010-05-29 12:53 . 2005-10-20 15:02 163328 d:\windows\ERDNT\29-5-2010\ERDNT.EXE
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-05-29 12:53 . 2010-05-29 12:53 12955648 d:\windows\ERDNT\29-5-2010\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-30 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-30 13:05
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\msi.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-30 13:08:35 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-30 16:08
ComboFix2.txt 2010-05-30 13:52
ComboFix3.txt 2010-05-29 23:54
ComboFix4.txt 2010-05-29 15:58
ComboFix5.txt 2010-05-30 15:08
Pré-execução: 22 pasta(s) 40.381.743.104 bytes disponíveis
Pós execução: 24 pasta(s) 40.343.699.456 bytes disponíveis
Abraços
Boa Tarde! EDSSX
<!> Por esse relatório do ComboFix,não tivemos desinfecções. Provavelmente,devido ao fato de não existir,ainda,TS-2 na pasta i386.
<!> O que houve? Ainda tens dificuldade em baixá-lo?
000000000000000000000
ooooooooooooooooooooo
<@> Baixe: < SystemLook > ( ...by jpshortstuff )
<@> Salve-o no desktop.
<@> Execute SystemLook.exe e,no campo,cole estas informações:
:filefindmshtml.dllwininet.dll
<@> Clique,à seguir,em Look --> Aguarde!
<@> Terminando,clique em Exit.
<@> Poste o relatório: SystemLook.txt <--
Abraços!
Boa tarde ! DigRam
Agora entendi, toda vez que for executar um script com o combofix ; tem que existir o TS-2; pensei que fosse apenas em um certo script anterior . Segue o mesmo com o TS-2 :
ComboFix 10-05-29.05 - edsom luis 30/05/2010 14:00:09.23.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.196 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\ie8\mshtml.dll . . . está infectado!!
d:\windows\ie8\wininet.dll . . . está infectado!!
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-30 ))))))))))))))))))))))))))))
.
2010-05-30 15:34 . 2010-05-30 15:34 -------- d-----w- D:\FOUND.000
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:38 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2009-12-22 . 9CEF5BDCA08EF0E1EDBE554DD42EA78A . 3092480 . . [6.00.2900.5921] . . d:\windows\ServicePackFiles\i386\TS\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
[-] 2009-12-22 . 48447E9A4417F21933C1A2C2CCC37E4E . 669184 . . [6.00.2900.5921] . . d:\windows\ServicePackFiles\i386\TS\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-30 17:07 . 2010-05-30 17:08 16384 d:\windows\temp\Perflib_Perfdata_178.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000004\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000002\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 462848 d:\windows\ERDNT\29-5-2010\Users\00000006\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 233472 d:\windows\ERDNT\29-5-2010\Users\00000003\NTUSER.DAT
+ 2010-05-29 12:53 . 2010-05-29 12:53 229376 d:\windows\ERDNT\29-5-2010\Users\00000001\NTUSER.DAT
+ 2010-05-29 12:53 . 2005-10-20 15:02 163328 d:\windows\ERDNT\29-5-2010\ERDNT.EXE
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-02-17 17:07 . 2010-02-17 17:07 2194176 d:\windows\ServicePackFiles\i386\TS\ntoskrnl.exe
+ 2010-02-16 19:07 . 2010-02-16 19:07 2071040 d:\windows\ServicePackFiles\i386\TS\ntkrnlpa.exe
+ 2010-05-29 12:53 . 2010-05-29 12:53 12955648 d:\windows\ERDNT\29-5-2010\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-30 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-30 14:09
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\msi.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-30 14:12:23 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-30 17:12
ComboFix2.txt 2010-05-30 16:08
ComboFix3.txt 2010-05-30 13:52
ComboFix4.txt 2010-05-29 23:54
ComboFix5.txt 2010-05-30 16:58
Pré-execução: 23 pasta(s) 40.322.760.704 bytes disponíveis
Pós execução: 24 pasta(s) 40.280.326.144 bytes disponíveis
Segue logs do SystemLook :
SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 14:21 on 30/05/2010 by edsom luis (Administrator - Elevation successful)
========== filefind ==========
Searching for "mshtml.dll"
D:\WINDOWS\ie8\mshtml.dll --a--- 5944832 bytes [13:24 23/03/2009] [06:17 25/02/2010] 23099BB44DA6A7D80B15FF4F7C51877D
D:\WINDOWS\ServicePackFiles\i386\TS\mshtml.dll --a--- 3092480 bytes [05:09 22/12/2009] [05:09 22/12/2009] 9CEF5BDCA08EF0E1EDBE554DD42EA78A
D:\WINDOWS\system32\mshtml.dll --a--- 6106112 bytes [10:45 04/08/2004] [06:17 25/02/2010] A709662B2C291B04B765FAC8583AC8E0
Searching for "wininet.dll"
D:\WINDOWS\ie8\wininet.dll --a--- 916480 bytes [13:24 23/03/2009] [06:17 25/02/2010] E5CC74D62E06066451D59248CBFBAED0
D:\WINDOWS\ServicePackFiles\i386\TS\wininet.dll --a--- 669184 bytes [05:09 22/12/2009] [05:09 22/12/2009] 48447E9A4417F21933C1A2C2CCC37E4E
D:\WINDOWS\system32\wininet.dll --a--- 983040 bytes [10:45 04/08/2004] [06:17 25/02/2010] 9B25F4F2E1C0622CB951FCAED549F0A9
-=End Of File=-
SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 14:23 on 30/05/2010 by edsom luis (Administrator - Elevation successful)
No Context:
-=End Of File=-
Embora rodou o combofix cfe. log acima, desta vez constou o seguinte erro :
Uploaded with ImageShack.us
Lembrei ;foi constando este erro, que até então tive problemas com o teclado cfe. os tópicos infra :
Abraços
Boa tarde ! DigRam
Desculpe o flood mas :
Todos os últimos itens ( Windows File Protection ) do dia 21/05/2010 do log infra do DDS; seria erros no sistema no qual façamos estas correções ?
DDS (Ver_09-12-01.01) - FAT32x86
Run by edsom luis at 20:01:31,21 on ter 25/05/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.203 [GMT -3:00]
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
D:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
D:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
D:\WINDOWS\Explorer.EXE
D:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
D:\Arquivos de programas\CursorXP\CursorXP.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
D:\Arquivos de programas\Java\jre6\bin\jqs.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\Arquivos de programas\Gadwin Systems\PrintScreen\PrintScreen.exe
D:\Arquivos de programas\Mozilla Firefox\firefox.exe
D:\Documents and Settings\edsom luis\Meus documentos\Downloads\dds.scr
============== Pseudo HJT Report ===============
mWindow Title =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\arquivos de programas\arquivos comuns\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - d:\arquivos de programas\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\arquivos de programas\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\arquivos de programas\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CursorXP] d:\arquivos de programas\cursorxp\CursorXP.exe
mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "d:\arquivos de programas\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "d:\arquivos de programas\arquivos comuns\adobe\arm\1.0\AdobeARM.exe"
mRun: [sunJavaUpdateSched] "d:\arquivos de programas\arquivos comuns\java\java update\jusched.exe"
mRun: [avgnt] "d:\arquivos de programas\avira\antivir desktop\avgnt.exe" /min
uPolicies-explorer: NoRealMode = 0 (0x0)
uPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
uPolicies-explorer: NoFileUrl = 0 (0x0)
uPolicies-explorer: NoUpdateCheck = 0 (0x0)
mPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
mPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: E&xportar para o Microsoft Excel
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - d:\docume~1\edsoml~1\dadosd~1\mozilla\firefox\profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "[http://www.firefox.com"](http://www.firefox.com));
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");============= SERVICES / DRIVERS ===============
R1 avgio;avgio;d:\arquivos de programas\avira\antivir desktop\avgio.sys [2010-5-3 11608]
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [2009-9-18 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [2009-9-18 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [2005-3-15 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\avira\antivir desktop\sched.exe [2010-5-3 135336]
R2 AntiVirService;Avira AntiVir Guard;d:\arquivos de programas\avira\antivir desktop\avguard.exe [2010-5-3 267432]
R2 avgntflt;avgntflt;d:\windows\system32\drivers\avgntflt.sys [2010-5-3 60936]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [2009-9-18 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [2010-5-18 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [2007-3-23 30032]
=============== Created Last 30 ================
2010-05-23 19:44:57 0 d-----w- D:\SDFix
2010-05-23 12:43:20 0 d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39:33 0 d-----w- d:\arquivos de programas\Oracle
2010-05-22 20:19:55 344064 ----a-w- d:\windows\system32\rmsality.nt
2010-05-22 19:15:39 0 d-----w- d:\docume~1\alluse~1\dadosd~1\CA
2010-05-22 04:29:52 0 d-sha-r- D:\autorun.inf
2010-05-21 13:53:27 3 ----a-w- d:\windows\rrxx.dll
2010-05-21 13:51:37 0 d-sh--w- D:\Recycled
2010-05-21 00:43:45 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\K-Meleon
2010-05-21 00:42:19 0 d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28:26 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28:26 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-17 02:37:45 98816 ----a-w- d:\windows\sed.exe
2010-05-17 02:37:45 77312 ----a-w- d:\windows\MBR.exe
2010-05-17 02:37:45 256512 ----a-w- d:\windows\PEV.exe
2010-05-17 02:37:45 161792 ----a-w- d:\windows\SWREG.exe
2010-05-15 21:20:47 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\QuickScan
2010-05-05 13:14:37 0 d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53:32 0 d-----w- D:\Lop SD
2010-05-05 12:53:10 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53:02 0 d---a-w- D:\Navilog1
2010-05-04 18:34:37 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41:08 0 d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07:33 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\Avira
2010-05-03 18:00:18 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00:17 0 d-----w- d:\docume~1\alluse~1\dadosd~1\Avira
2010-05-03 18:00:17 0 d-----w- d:\arquivos de programas\Avira
2010-05-03 01:06:39 0 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04:24 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04:21 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-02 15:15:19 52 ----a-w- d:\windows\system32\ashttpstats.csv
2010-04-30 00:45:56 0 d-----w- d:\windows\system32\wbem\Repository
2010-04-29 23:16:08 2335270 ----a-w- d:\windows\system32\0fc6.mht
2010-04-29 22:42:56 2335270 ----a-w- d:\windows\system32\0e81A.mht
2010-04-29 22:09:41 3968 ----a-w- d:\windows\system32\drivers\AvgArCln.sys
==================== Find3M ====================
2010-05-18 23:28:28 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28:26 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:28:26 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:02:06 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02:06 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30:12 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52:00 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-18 00:33:28 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02:00 327168 ----a-w- d:\windows\IsUn0416.exe
2010-03-19 21:05:50 4874240 ----a-w- d:\windows\system32\dllcache\wmp.dll
2010-03-10 06:16:48 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-10 06:16:48 420352 ----a-w- d:\windows\system32\dllcache\vbscript.dll
2010-02-25 14:47:48 11070976 ----a-w- d:\windows\system32\dllcache\ieframe.dll
2009-12-01 18:16:32 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47:52 218 ------w- d:\arquivos de programas\arquivos comuns\operaprefs_default.ini
2009-11-20 22:11:28 15828 ------w- d:\arquivos de programas\arquivos comuns\license.rtf
2009-11-20 22:01:18 832296 ------w- d:\arquivos de programas\arquivos comuns\opera.exe
2009-11-20 22:01:16 4450088 ------w- d:\arquivos de programas\arquivos comuns\opera.dll
2009-11-20 22:00:42 20480 ------w- d:\arquivos de programas\arquivos comuns\OUniAnsi.dll
2009-11-20 22:00:24 653419 ------w- d:\arquivos de programas\arquivos comuns\encoding.bin
2009-11-13 21:19:06 2320 ------w- d:\arquivos de programas\arquivos comuns\operadef6.ini
2009-08-19 08:39:36 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20:00 621546 ----a-w- d:\arquivos de programas\arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20:00 3219 ----a-w- d:\arquivos de programas\arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41:58 3870 ----a-w- d:\arquivos de programas\arquivos comuns\lngcode.txt.vir
2008-06-09 13:17:20 301 ----a-w- d:\arquivos de programas\arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35:04 7904 ------w- d:\arquivos de programas\arquivos comuns\html40_entities.dtd
2002-03-11 09:06:30 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45:04 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-01-21 15:39:44 32768 --sha-w- d:\windows\system32\config\systemprofile\configurações locais\histórico\history.ie5\mshist012009012120090122\index.dat
2009-09-11 17:30:12 245760 --sha-w- d:\windows\system32\config\systemprofile\ietldcache\index.dat
2009-11-24 09:18:56 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-03-08 17:09:26 638816 --sha-w- d:\windows\niwradsoft shell pack\backup\iexplore.exe
2008-04-14 03:21:24 73728 --sha-w- d:\windows\niwradsoft shell pack\backup\wmplayer.exe
============= FINISH: 20:02:06,76 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 19/9/2007 10:51:37
System Uptime: 25/5/2010 19:33:26 (1 hours ago)
Motherboard: ECS | | M825G
Processor: AMD Sempron™ 2400+ | Socket-A | 1669/166mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (FAT32) - 17 GiB total, 9,639 GiB free.
D: is FIXED (FAT32) - 59 GiB total, 38,369 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: RADEON 9200 PRO Family (Microsoft Corporation)
Device ID: PCI\VEN_1002&DEV_5960&SUBSYS_061018BC&REV_01\4&1FEB96E4&0&0008
Manufacturer: ATI Technologies Inc.
Name: RADEON 9200 PRO Family (Microsoft Corporation)
PNP Device ID: PCI\VEN_1002&DEV_5960&SUBSYS_061018BC&REV_01\4&1FEB96E4&0&0008
Service: ati2mtag
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: RADEON 9200 PRO SEC Family (Microsoft Corporation)
Device ID: PCI\VEN_1002&DEV_5940&SUBSYS_061118BC&REV_01\4&1FEB96E4&0&0108
Manufacturer: ATI Technologies Inc.
Name: RADEON 9200 PRO SEC Family (Microsoft Corporation)
PNP Device ID: PCI\VEN_1002&DEV_5940&SUBSYS_061118BC&REV_01\4&1FEB96E4&0&0108
Service: ati2mtag
Class GUID:
Description:
Device ID: STREAM\7131TVTUNER\4&2164E342&0&0
Manufacturer:
Name:
PNP Device ID: STREAM\7131TVTUNER\4&2164E342&0&0
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Controlador de comunicação PCI simples
Device ID: PCI\VEN_1106&DEV_3068&SUBSYS_4C211543&REV_80\3&61AAA01&0&8E
Manufacturer:
Name: Controlador de comunicação PCI simples
PNP Device ID: PCI\VEN_1106&DEV_3068&SUBSYS_4C211543&REV_80\3&61AAA01&0&8E
Service:
==== System Restore Points ===================
RP41: 24/5/2010 23:52:26 - LCCD ESA
==== Installed Programs ======================
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2 - Português
Apple Application Support
Apple Software Update
Atualização de Segurança para o Windows Media Player (KB979402)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127-v2)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127)
Atualização de Segurança para Windows Internet Explorer 7 (KB958215)
Atualização de Segurança para Windows Internet Explorer 7 (KB960714)
Atualização de Segurança para Windows Internet Explorer 7 (KB961260)
Atualização de Segurança para Windows Internet Explorer 8 (KB969897)
Atualização de Segurança para Windows Internet Explorer 8 (KB971961)
Atualização de Segurança para Windows Internet Explorer 8 (KB972260)
Atualização de Segurança para Windows Internet Explorer 8 (KB974455)
Atualização de Segurança para Windows Internet Explorer 8 (KB976325)
Atualização de Segurança para Windows Internet Explorer 8 (KB978207)
Atualização de Segurança para Windows Internet Explorer 8 (KB981332)
Atualização de Segurança para Windows XP (KB977816)
Atualização de Segurança para Windows XP (KB978338)
Atualização de Segurança para Windows XP (KB978542)
Atualização de Segurança para Windows XP (KB978601)
Atualização de Segurança para Windows XP (KB978706)
Atualização de Segurança para Windows XP (KB979309)
Atualização de Segurança para Windows XP (KB979683)
Atualização de Segurança para Windows XP (KB980232)
Atualização para Windows Internet Explorer 8 (KB973874)
Atualização para Windows Internet Explorer 8 (KB976662)
Atualização para Windows Internet Explorer 8 (KB976749)
Atualização para Windows Internet Explorer 8 (KB980182)
Avira AntiVir Personal - Free Antivirus
BrOffice.org 3.1
C-Media WDM Audio Driver
CCleaner
CursorXP
EVEREST Home Edition v2.20
Gadwin PrintScreen
Google Chrome
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java Auto Updater
Java™ 6 Update 20
Junk Mail filter updateK-Meleon 1.5.4 en-US (remove only)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Speech Recognition Engine 4.0 (English)
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6)
MSXML 4.0 SP2 (KB973688)
Opera 10.53
Oracle VM VirtualBox 3.2.0
Revo Uninstaller 1.88
Safari
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
você 9.0 Runtime
VIA Rhine-Family Fast-Ethernet Adapter
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Internet Explorer 7
Windows Media Format 11 runtime
XML Paper Specification Shared Components Pack 1.0
==== Event Viewer Messages From Past Week ========
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido wupdmgr.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.4.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido wmplayer.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 9.0.0.4503.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido verifier.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido syskey.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido syncapp.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido setup_wm.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 9.0.0.4503.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido osuninst.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido ntsd.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido msinfo32.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido eventvwr.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:56, Informações: Windows File Protection [64005] - O sistema de arquivos protegido drwtsn32.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wpabaln.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wpabaln.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos winlogon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wiaacmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wextract.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wab.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos utilman.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos telnet.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5829 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos taskmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos sysocmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos stimon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos sigverif.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos shrpubw.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos setup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rundll32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rtcshare.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rstrui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos regedit.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos regedit.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rcimlby.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rasphone.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos proquota.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos progman.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos perfmon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos packager.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos osk.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos odbcad32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 3.525.1132.0 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntoskrnl.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5938 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntoskrnl.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5938 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntkrnlpa.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5938 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntbackup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos nslookup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos netsetup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2600.0 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos msimn.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos msiexec.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 3.1.4001.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mshta.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 8.0.6001.18702 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos msconfig.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mplay32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mobsync.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mnmsrvc.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mmc.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.2.3790.4136 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos migwiz.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos magnify.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos logonui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos iexplore.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 8.0.6001.18702 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos helpctr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos grpconv.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos explorer.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos explorer.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos dvdplay.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 1.0.0.2 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ddeshare.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ctfmon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cscript.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.7.0.18066 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos conime.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmstp.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 7.2.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmmon32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 7.2.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmdl32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 7.2.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmd.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos clipsrv.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cleanmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:23:49, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ahui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:20:39, Informações: Windows File Protection [64005] - O sistema de arquivos protegido wmplayer.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 9.0.0.4503.
21/5/2010 15:20:39, Informações: Windows File Protection [64005] - O sistema de arquivos protegido setup_wm.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 9.0.0.4503.
21/5/2010 15:20:39, Informações: Windows File Protection [64005] - O sistema de arquivos protegido msinfo32.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:33, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wab.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:20:33, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos msimn.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:20:33, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos iexplore.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 8.0.6001.18702 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido wupdmgr.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.4.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido verifier.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido syskey.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido syncapp.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido osuninst.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido ntsd.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido eventvwr.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:20:06, Informações: Windows File Protection [64005] - O sistema de arquivos protegido drwtsn32.exe não pôde ser restaurado para sua versão válida original porque o processo de restauração 'Proteção de arquivos do Windows' foi cancelado pela interação do usuário; o nome de usuário é edsom luis. A versão do arquivo incorreto é 5.1.2600.0.
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wpabaln.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos winlogon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wiaacmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos wextract.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos utilman.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos telnet.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5829 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos taskmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos sysocmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos stimon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos sigverif.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos shrpubw.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos setup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rundll32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rtcshare.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rstrui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos regedit.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rcimlby.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rasphone.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos proquota.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos progman.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos perfmon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos packager.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos osk.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos odbcad32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 3.525.1132.0 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntoskrnl.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5938 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntkrnlpa.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5938 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ntbackup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos nslookup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos netsetup.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2600.0 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos msiexec.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 3.1.4001.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mshta.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 8.0.6001.18702 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos msconfig.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mplay32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mobsync.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mnmsrvc.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos mmc.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.2.3790.4136 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos migwiz.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos magnify.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos logonui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos helpctr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos grpconv.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos explorer.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos dvdplay.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 1.0.0.2 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ddeshare.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ctfmon.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cscript.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.7.0.18066 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos conime.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmstp.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 7.2.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmmon32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 7.2.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmdl32.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 7.2.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cmd.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos clipsrv.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos cleanmgr.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 6.0.2900.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:39, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos ahui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
21/5/2010 15:19:16, Informações: Windows File Protection [64001] - Tentativa de substituição do arquivo no arquivo do sistema protegido d:\windows\system32\mstsc.exe. Esse arquivo foi restaurado para a versão original para manter a estabilidade do sistema. A versão do arquivo inválido é 6.0.6001.18000, a versão do arquivo do sistema é 6.0.6001.18000.
21/5/2010 15:19:03, Informações: Windows File Protection [64001] - Tentativa de substituição do arquivo no arquivo do sistema protegido d:\windows\system32\notepad.exe. Esse arquivo foi restaurado para a versão original para manter a estabilidade do sistema. A versão do arquivo inválido é 5.1.2600.5512, a versão do arquivo do sistema é 5.1.2600.5512.
21/5/2010 15:18:56, Informações: Windows File Protection [64001] - Tentativa de substituição do arquivo no arquivo do sistema protegido d:\windows\system32\tourstart.exe. Esse arquivo foi restaurado para a versão original para manter a estabilidade do sistema. A versão do arquivo inválido é 6.0.2900.5512, a versão do arquivo do sistema é 6.0.2900.5512.
==== End Of File ===========================
Segue DDS atualizado :
DDS (Ver_09-12-01.01) - FAT32x86
Run by edsom luis at 15:21:44,62 on dom 30/05/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.127 [GMT -3:00]
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
D:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
D:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
D:\Arquivos de programas\Java\jre6\bin\jqs.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
D:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
D:\Arquivos de programas\CursorXP\CursorXP.exe
D:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\WINDOWS\explorer.exe
D:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe
D:\Arquivos de programas\Mozilla Firefox\firefox.exe
D:\Documents and Settings\edsom luis\Meus documentos\Downloads\dds.scr
============== Pseudo HJT Report ===============
mWindow Title =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\arquivos de programas\arquivos comuns\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - d:\arquivos de programas\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\arquivos de programas\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\arquivos de programas\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CursorXP] d:\arquivos de programas\cursorxp\CursorXP.exe
mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "d:\arquivos de programas\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "d:\arquivos de programas\arquivos comuns\adobe\arm\1.0\AdobeARM.exe"
mRun: [sunJavaUpdateSched] "d:\arquivos de programas\arquivos comuns\java\java update\jusched.exe"
mRun: [avgnt] "d:\arquivos de programas\avira\antivir desktop\avgnt.exe" /min
uPolicies-explorer: NoRealMode = 0 (0x0)
uPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
uPolicies-explorer: NoFileUrl = 0 (0x0)
uPolicies-explorer: NoUpdateCheck = 0 (0x0)
uPolicies-explorer: NoSMBalloonTip = 0 (0x0)
mPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
mPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: E&xportar para o Microsoft Excel
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - d:\docume~1\edsoml~1\dadosd~1\mozilla\firefox\profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "[http://www.firefox.com"](http://www.firefox.com));
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");============= SERVICES / DRIVERS ===============
R1 avgio;avgio;d:\arquivos de programas\avira\antivir desktop\avgio.sys [2010-5-3 11608]
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [2009-9-18 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [2009-9-18 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [2005-3-15 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\avira\antivir desktop\sched.exe [2010-5-3 135336]
R2 AntiVirService;Avira AntiVir Guard;d:\arquivos de programas\avira\antivir desktop\avguard.exe [2010-5-3 267432]
R2 avgntflt;avgntflt;d:\windows\system32\drivers\avgntflt.sys [2010-5-3 60936]
R3 MBAMSwissArmy;MBAMSwissArmy;d:\windows\system32\drivers\mbamswissarmy.sys [2010-5-2 38224]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [2009-9-18 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [2010-5-18 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [2007-3-23 30032]
UnknownUnknown vkquwexg;vkquwexg; [x]
=============== Created Last 30 ================
2010-05-30 17:52:06 0 d-sh--w- D:\Recycled
2010-05-28 23:59:08 0 d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04:52 0 d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56:15 0 d-----w- D:\Recycled(2)
2010-05-28 04:16:32 0 d---a-r- D:\autorun.inf
2010-05-28 00:30:31 5878 ----a-w- d:\documents and settings\edsom luis\Items.xml
2010-05-27 23:10:41 0 d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10:37 0 d-----w- d:\arquivos de programas\arquivos comuns\Wise Installation Wizard
2010-05-27 14:50:56 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31:26 8704 ----a-w- D:\fixccs.exe
2010-05-23 19:44:57 0 d-----w- D:\SDFix
2010-05-23 12:43:20 0 d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39:33 0 d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15:39 0 d-----w- d:\docume~1\alluse~1\dadosd~1\CA
2010-05-21 00:43:45 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\K-Meleon
2010-05-21 00:42:19 0 d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28:26 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28:26 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-17 02:37:45 98816 ----a-w- d:\windows\sed.exe
2010-05-17 02:37:45 77312 ----a-w- d:\windows\MBR.exe
2010-05-17 02:37:45 256512 ----a-w- d:\windows\PEV.exe
2010-05-17 02:37:45 161792 ----a-w- d:\windows\SWREG.exe
2010-05-15 21:20:47 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\QuickScan
2010-05-05 13:14:37 0 d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53:32 0 d-----w- D:\Lop SD
2010-05-05 12:53:10 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53:02 0 d---a-w- D:\Navilog1
2010-05-04 18:34:37 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41:08 0 d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07:33 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\Avira
2010-05-03 18:00:18 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00:17 0 d-----w- d:\docume~1\alluse~1\dadosd~1\Avira
2010-05-03 18:00:17 0 d-----w- d:\arquivos de programas\Avira
2010-05-03 01:06:39 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04:24 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04:21 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-02 15:15:19 52 ----a-w- d:\windows\system32\ashttpstats.csv
==================== Find3M ====================
2010-05-18 23:28:28 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28:26 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:28:26 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:02:06 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02:06 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30:12 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52:00 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-18 00:33:28 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02:00 327168 ----a-w- d:\windows\IsUn0416.exe
2010-03-10 06:16:48 420352 ----a-w- d:\windows\system32\vbscript.dll
2009-12-01 18:16:32 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47:52 218 ------w- d:\arquivos de programas\arquivos comuns\operaprefs_default.ini
2009-11-20 22:11:28 15828 ------w- d:\arquivos de programas\arquivos comuns\license.rtf
2009-11-20 22:01:18 832296 ------w- d:\arquivos de programas\arquivos comuns\opera.exe
2009-11-20 22:01:16 4450088 ------w- d:\arquivos de programas\arquivos comuns\opera.dll
2009-11-20 22:00:42 20480 ------w- d:\arquivos de programas\arquivos comuns\OUniAnsi.dll
2009-11-20 22:00:24 653419 ------w- d:\arquivos de programas\arquivos comuns\encoding.bin
2009-11-13 21:19:06 2320 ------w- d:\arquivos de programas\arquivos comuns\operadef6.ini
2009-08-19 08:39:36 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20:00 621546 ----a-w- d:\arquivos de programas\arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20:00 3219 ----a-w- d:\arquivos de programas\arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41:58 3870 ----a-w- d:\arquivos de programas\arquivos comuns\lngcode.txt.vir
2008-06-09 13:17:20 301 ----a-w- d:\arquivos de programas\arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35:04 7904 ------w- d:\arquivos de programas\arquivos comuns\html40_entities.dtd
2002-03-11 09:06:30 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45:04 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-01-21 15:39:44 32768 --sha-w- d:\windows\system32\config\systemprofile\configurações locais\histórico\history.ie5\mshist012009012120090122\index.dat
2009-09-11 17:30:12 245760 --sha-w- d:\windows\system32\config\systemprofile\ietldcache\index.dat
2009-11-24 09:18:56 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
============= FINISH: 15:23:21,31 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 19/9/2007 10:51:37
System Uptime: 30/5/2010 14:07:09 (1 hours ago)
Motherboard: ECS | | M825G
Processor: AMD Sempron 2400+ | Socket-A | 1669/166mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (FAT32) - 17 GiB total, 9,641 GiB free.
D: is FIXED (FAT32) - 59 GiB total, 37,565 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: RADEON 9200 PRO Family (Microsoft Corporation)
Device ID: PCI\VEN_1002&DEV_5960&SUBSYS_061018BC&REV_01\4&1FEB96E4&0&0008
Manufacturer: ATI Technologies Inc.
Name: RADEON 9200 PRO Family (Microsoft Corporation)
PNP Device ID: PCI\VEN_1002&DEV_5960&SUBSYS_061018BC&REV_01\4&1FEB96E4&0&0008
Service: ati2mtag
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: RADEON 9200 PRO SEC Family (Microsoft Corporation)
Device ID: PCI\VEN_1002&DEV_5940&SUBSYS_061118BC&REV_01\4&1FEB96E4&0&0108
Manufacturer: ATI Technologies Inc.
Name: RADEON 9200 PRO SEC Family (Microsoft Corporation)
PNP Device ID: PCI\VEN_1002&DEV_5940&SUBSYS_061118BC&REV_01\4&1FEB96E4&0&0108
Service: ati2mtag
Class GUID:
Description:
Device ID: STREAM\7131TVTUNER\4&2164E342&0&0
Manufacturer:
Name:
PNP Device ID: STREAM\7131TVTUNER\4&2164E342&0&0
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Controlador de comunicação PCI simples
Device ID: PCI\VEN_1106&DEV_3068&SUBSYS_4C211543&REV_80\3&61AAA01&0&8E
Manufacturer:
Name: Controlador de comunicação PCI simples
PNP Device ID: PCI\VEN_1106&DEV_3068&SUBSYS_4C211543&REV_80\3&61AAA01&0&8E
Service:
==== System Restore Points ===================
RP64: 28/5/2010 23:19:54 - LCCD E ESA
RP65: 28/5/2010 23:35:58 - Revo Uninstaller's restore point - Wise Registry Cleaner Free 5.33
RP66: 29/5/2010 09:53:43 - Malware Removal System Restore Point
RP67: 29/5/2010 09:56:36 - Revo Uninstaller's restore point - ERUNT 1.1j
RP68: 30/5/2010 11:46:40 - Ponto de verificação do sistema
==== Installed Programs ======================
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2 - Português
Apple Application Support
Apple Software Update
Atualização de Segurança para Windows Internet Explorer 7 (KB938127-v2)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127)
Atualização de Segurança para Windows Internet Explorer 7 (KB958215)
Atualização de Segurança para Windows Internet Explorer 7 (KB960714)
Atualização de Segurança para Windows Internet Explorer 7 (KB961260)
Atualização de Segurança para Windows Internet Explorer 8 (KB969897)
Atualização de Segurança para Windows Internet Explorer 8 (KB971961)
Atualização de Segurança para Windows Internet Explorer 8 (KB972260)
Atualização de Segurança para Windows Internet Explorer 8 (KB974455)
Atualização de Segurança para Windows Internet Explorer 8 (KB976325)
Atualização de Segurança para Windows Internet Explorer 8 (KB978207)
Atualização de Segurança para Windows Internet Explorer 8 (KB981332)
Atualização de Segurança para Windows XP (KB978542)
Atualização para Windows Internet Explorer 8 (KB973874)
Atualização para Windows Internet Explorer 8 (KB976662)
Atualização para Windows Internet Explorer 8 (KB976749)
Atualização para Windows Internet Explorer 8 (KB980182)
Avira AntiVir Personal - Free Antivirus
BrOffice.org 3.1
C-Media WDM Audio Driver
CCleaner
CursorXP
EVEREST Home Edition v2.20
Gadwin PrintScreen
Google Chrome
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix para Windows XP (KB981793)
Java Auto Updater
Java 6 Update 20
Junk Mail filter updateK-Meleon 1.5.4 en-US (remove only)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Speech Recognition Engine 4.0 (English)
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6)
MSXML 4.0 SP2 (KB973688)
Opera 10.53
Oracle VM VirtualBox 3.2.0
Revo Uninstaller 1.88
Safari
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
você 9.0 Runtime
VIA Rhine-Family Fast-Ethernet Adapter
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Internet Explorer 7
Windows Media Format 11 runtime
XML Paper Specification Shared Components Pack 1.0
==== Event Viewer Messages From Past Week ========
28/5/2010 15:07:02, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos srrstr.dll não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
28/5/2010 15:07:02, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos srclient.dll não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
28/5/2010 15:07:02, Informações: Windows File Protection [64004] - O sistema de arquivos protegidos rstrui.exe não pôde ser restaurado para sua versão válida original. A versão do arquivo corrompido é 5.1.2600.5512 O código de erro específico é 0x800b0100 [Nenhuma assinatura estava presente na entidade. ].
==== End Of File ===========================
Obrigado e abraços
Boa Tarde! EDSSX
Todos os últimos itens ( Windows File Protection ) do dia 21/05/2010 do log infra do DDS; seria erros no sistema no qual façamos estas correções ?
<!> Provavelmente! E...devido às versões contraditórias dos arquivos,as correções apresentaram problemas ou bugs no sistema. Se você possui o CD de instalação do Windows XP,execute o comando "SFC scan",presente no Dial-a-fix.
<!> Caso não funcione,pode formatar o computador! Mas...procure adquirir mídia original,e livre desses problemas de certificações,que não são corrigidas por patches de atualizações.
Abraços!
Boa tade ! DigRam
Ok, pode encerrar este tópico . Vou verificar o que irei de fazer; pois aqui existem arquivos/trabalhos/pesquisas de 10 anos ; portanto formatação pelo menos por enquanto não posso . Estou usando também o ubuntu para navegar na www, porém dá alguns erros também rsrsrs .
Para finalizar rodei novamente o combofix com o TS-2 e com o último script; rodou e gerou log cfe. infra sem erros de tela algum . Obrigado pela tua dedicação e abraços .
ComboFix 10-05-29.05 - edsom luis 30/05/2010 16:46:08.24.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.274 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
Comandos utilizados :: d:\documents and settings\edsom luis\Desktop\CFScript.txt
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\ie8\mshtml.dll . . . está infectado!!
d:\windows\ie8\wininet.dll . . . está infectado!!
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-04-28 to 2010-05-30 ))))))))))))))))))))))))))))
.
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 19:56 . 2010-05-28 19:56 -------- d-----w- D:\Recycled(2)
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
2010-05-23 19:44 . 2008-11-06 05:03 -------- d-----w- D:\SDFix
2010-05-23 12:43 . 2010-05-23 12:43 -------- d-----w- d:\documents and settings\edsom luis\.VirtualBox
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:09 . 2010-05-17 19:48 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-18 23:09 . 2010-05-17 19:48 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-05 13:14 . 2010-05-05 13:14 -------- d-----w- d:\arquivos de programas\navilog1
2010-05-05 12:53 . 2010-05-05 12:53 -------- d-----w- D:\Lop SD
2010-05-05 12:53 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-05 12:53 . 2010-05-05 12:53 -------- d---a-w- D:\Navilog1
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-03-01 13:05 124784 ----a-w- d:\windows\system32\drivers\avipbb.sys
2010-05-03 18:00 . 2010-02-16 17:24 60936 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2010-05-03 18:00 . 2009-05-11 15:49 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-03 18:00 . 2009-05-11 15:49 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2010-05-03 01:06 . 2010-05-28 18:33 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-02 21:04 . 2010-04-29 18:39 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-05-02 21:04 . 2010-04-29 18:39 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-05-01 14:11 . 2010-05-01 14:11 -------- d-----w- d:\arquivos de programas\Opera
2010-04-30 21:42 . 2008-04-13 17:44 2560 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Microsoft\USMT\iconlib.dll
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 21:38 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-05-27 19:05 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:02 . 2001-10-28 21:07 81050 ----a-w- d:\windows\system32\perfc016.dat
2010-05-18 23:02 . 2001-10-28 21:07 472248 ----a-w- d:\windows\system32\perfh016.dat
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-04-22 23:54 . 2010-04-22 23:54 -------- d-----w- d:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-18 20:27 . 2010-04-18 20:27 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Stardock
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 01:42 . 2010-04-06 01:42 -------- d-----w- d:\arquivos de programas\Safari
2010-04-06 01:41 . 2010-04-06 01:41 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Apple
2010-04-04 19:14 . 2010-04-04 19:14 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Apple
2010-04-01 20:31 . 2010-04-01 20:31 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\WinZip
2010-03-10 06:16 . 2004-08-04 10:45 420352 ----a-w- d:\windows\system32\vbscript.dll
2010-03-04 07:00 . 2010-03-04 07:00 79144 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
------- Sigcheck -------
[-] 2010-02-25 . A709662B2C291B04B765FAC8583AC8E0 . 6106112 . . [8.00.6001.18904] . . d:\windows\system32\mshtml.dll
[7] 2010-02-25 . 23099BB44DA6A7D80B15FF4F7C51877D . 5944832 . . [8.00.6001.18904] . . d:\windows\ie8\mshtml.dll
[-] 2009-12-22 . 9CEF5BDCA08EF0E1EDBE554DD42EA78A . 3092480 . . [6.00.2900.5921] . . d:\windows\ServicePackFiles\i386\TS\mshtml.dll
[-] 2010-02-25 . 9B25F4F2E1C0622CB951FCAED549F0A9 . 983040 . . [8.00.6001.18904] . . d:\windows\system32\wininet.dll
[7] 2010-02-25 . E5CC74D62E06066451D59248CBFBAED0 . 916480 . . [8.00.6001.18904] . . d:\windows\ie8\wininet.dll
[-] 2009-12-22 . 48447E9A4417F21933C1A2C2CCC37E4E . 669184 . . [6.00.2900.5921] . . d:\windows\ServicePackFiles\i386\TS\wininet.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-29_03.12.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-30 19:53 . 2010-05-30 19:53 16384 d:\windows\temp\Perflib_Perfdata_198.dat
+ 2010-05-30 17:07 . 2010-05-30 17:08 16384 d:\windows\temp\Perflib_Perfdata_178.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000004\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 8192 d:\windows\ERDNT\29-5-2010\Users\00000002\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 462848 d:\windows\ERDNT\29-5-2010\Users\00000006\UsrClass.dat
+ 2010-05-29 12:53 . 2010-05-29 12:53 233472 d:\windows\ERDNT\29-5-2010\Users\00000003\NTUSER.DAT
+ 2010-05-29 12:53 . 2010-05-29 12:53 229376 d:\windows\ERDNT\29-5-2010\Users\00000001\NTUSER.DAT
+ 2010-05-29 12:53 . 2005-10-20 15:02 163328 d:\windows\ERDNT\29-5-2010\ERDNT.EXE
+ 2004-08-04 10:40 . 2010-02-17 17:07 2194176 d:\windows\system32\ntoskrnl.exe
+ 2004-08-04 03:40 . 2010-02-16 19:07 2071040 d:\windows\system32\ntkrnlpa.exe
+ 2010-02-17 17:07 . 2010-02-17 17:07 2194176 d:\windows\ServicePackFiles\i386\TS\ntoskrnl.exe
+ 2010-02-16 19:07 . 2010-02-16 19:07 2071040 d:\windows\ServicePackFiles\i386\TS\ntkrnlpa.exe
+ 2010-05-29 12:53 . 2010-05-29 12:53 12955648 d:\windows\ERDNT\29-5-2010\Users\00000005\NTUSER.DAT
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Opera\\opera.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-05-30 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-30 16:55
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
d:\windows\system32\WININET.dll
d:\windows\system32\COMRes.dll
d:\windows\System32\cscui.dll
d:\windows\system32\ntshrui.dll
d:\windows\system32\msi.dll
d:\windows\system32\LINKINFO.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Outros Processos em Execução ------------------------
.
d:\arquivos de programas\Avira\AntiVir Desktop\avguard.exe
d:\arquivos de programas\Java\jre6\bin\jqs.exe
d:\arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
d:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-05-30 16:58:33 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-05-30 19:58
ComboFix2.txt 2010-05-30 17:12
ComboFix3.txt 2010-05-30 16:08
ComboFix4.txt 2010-05-30 13:52
ComboFix5.txt 2010-05-30 19:45
Pré-execução: 22 pasta(s) 41.264.381.952 bytes disponíveis
Pós execução: 23 pasta(s) 41.224.372.224 bytes disponíveis
Obrigado pela tua dedicação e abraços
Boa Noite! EDSSX
Ok, pode encerrar este tópico . Vou verificar o que irei de fazer; pois aqui existem arquivos/trabalhos/pesquisas de 10 anos ; portanto formatação pelo menos por enquanto não posso . Estou usando também o ubuntu para navegar na www, porém dá alguns erros também rsrsrs .
<!> Faça backups e formate! Essa é a melhor opção.
Para finalizar rodei novamente o combofix com o TS-2 e com o último script; rodou e gerou log cfe. infra sem erros de tela algum . Obrigado pela tua dedicação e abraços .
<!> Se TS-2 estava na pasta i386,os relatórios não indicaram sua presença.
<!> É...foi uma boa luta! Valeu a experiência. :lol:
Abraços!
Boa tarde !
Conforme nossa mp, segue os logs :
ComboFix 10-06-22.02 - edsom luis 22/06/2010 17:49:41.27.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.293 [GMT -3:00]
Executando de: d:\documents and settings\edsom luis\Desktop\ComboFix.exe
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\windows\rrxx.dll
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-05-22 to 2010-06-22 ))))))))))))))))))))))))))))
.
2010-06-22 19:10 . 2010-06-22 19:10 -------- d-----w- d:\arquivos de programas\Opera 10.60 Beta
2010-06-22 17:52 . 2010-06-22 17:52 -------- d-----w- D:\FOUND.000
2010-06-21 22:35 . 2010-06-21 22:35 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\MySQL
2010-06-09 14:40 . 2010-06-09 14:40 -------- d-----w- d:\arquivos de programas\Safari
2010-06-09 14:38 . 2010-06-09 14:38 -------- d-----w- d:\arquivos de programas\Apple Software Update
2010-06-07 13:12 . 2010-06-07 13:12 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\IObit
2010-06-04 15:29 . 2010-06-04 15:29 71992 ----a-w- d:\documents and settings\All Users\Dados de aplicativos\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-03 20:40 . 2010-06-03 20:40 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Alwil Software
2010-05-31 23:57 . 2010-04-04 16:04 537842 ----a-w- D:\HaxFix.exe
2010-05-31 18:54 . 2010-05-31 19:34 702120 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-31 18:54 . 2010-05-31 19:34 868456 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-30 21:29 . 2010-05-05 13:14 -------- d---a-w- D:\Navilog1
2010-05-30 20:32 . 2010-05-30 20:32 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Panda Security
2010-05-28 23:59 . 2010-05-28 23:59 -------- d-----w- d:\windows\system32\wbem\Repository
2010-05-28 22:04 . 2010-05-28 22:04 -------- d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 17:34 . 2010-05-28 17:34 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Office Genuine Advantage
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10 . 2010-05-27 23:10 -------- d-----w- d:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2010-05-27 14:50 . 2008-06-03 11:31 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31 . 2008-06-03 11:31 8704 ----a-w- D:\fixccs.exe
2010-05-24 13:58 . 2010-05-24 13:58 503808 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcp71.dll
2010-05-24 13:58 . 2010-05-24 13:58 499712 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\jmc.dll
2010-05-24 13:58 . 2010-05-24 13:58 348160 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-78abc9e4-n\msvcr71.dll
2010-05-24 13:58 . 2010-05-24 13:58 61440 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-sse.dll
2010-05-24 13:58 . 2010-05-24 13:58 12800 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1d19f863-n\decora-d3d.dll
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-22 20:41 . 2009-08-27 01:37 664 ----a-w- d:\windows\system32\d3d9caps.dat
2010-06-21 16:43 . 2009-09-22 20:52 1 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\BrOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-10 14:34 . 2001-10-28 21:07 6291456 ----a-w- d:\windows\system32\perfh016.dat
2010-06-10 14:34 . 2001-10-28 21:07 6029312 ----a-w- d:\windows\system32\perfc016.dat
2010-05-28 18:33 . 2010-05-03 01:06 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-23 12:39 . 2010-05-23 12:39 -------- d-----w- d:\arquivos de programas\Oracle
2010-05-22 19:15 . 2010-05-22 19:15 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\CA
2010-05-21 00:43 . 2010-05-21 00:43 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\K-Meleon
2010-05-21 00:42 . 2010-05-21 00:42 -------- d-----w- d:\arquivos de programas\K-Meleon
2010-05-18 23:28 . 2009-09-18 16:11 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28 . 2010-05-18 23:28 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28 . 2010-05-18 23:28 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 23:28 . 2009-09-18 16:11 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28 . 2009-09-18 16:10 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 22:11 . 2010-05-18 22:11 -------- d-----w- d:\arquivos de programas\MSBuild
2010-05-18 02:30 . 2004-08-04 10:45 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52 . 2010-02-06 22:21 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-05-15 21:20 . 2010-05-15 21:20 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\QuickScan
2010-05-06 10:34 . 2004-08-04 10:45 916480 ----a-w- d:\windows\system32\wininet.dll
2010-05-04 18:34 . 2010-05-04 18:34 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-04 03:41 . 2010-05-04 03:41 -------- d-----w- d:\arquivos de programas\CCleaner
2010-05-03 18:07 . 2010-05-03 18:07 -------- d-----w- d:\documents and settings\edsom luis\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\documents and settings\All Users\Dados de aplicativos\Avira
2010-05-03 18:00 . 2010-05-03 18:00 -------- d-----w- d:\arquivos de programas\Avira
2010-05-02 08:08 . 2004-08-04 10:38 1851392 ----a-w- d:\windows\system32\win32k.sys
2010-04-29 18:39 . 2010-05-02 21:04 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 18:39 . 2010-05-02 21:04 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-04-21 18:22 . 2010-04-18 01:03 79488 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\gtapi.dll
2010-04-21 18:22 . 2010-04-18 01:03 152576 ----a-w- d:\documents and settings\edsom luis\Dados de aplicativos\Sun\Java\jre1.6.0_20\lzma.dll
2010-04-20 05:31 . 2004-08-04 10:44 285696 ----a-w- d:\windows\system32\atmfd.dll
2010-04-18 00:33 . 2010-04-18 00:33 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02 . 2007-09-19 14:24 327168 ----a-w- d:\windows\IsUn0416.exe
2009-12-01 18:16 . 2009-12-01 18:16 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47 . 2009-11-13 21:19 218 ------w- d:\arquivos de programas\Arquivos comuns\operaprefs_default.ini
2009-11-20 22:11 . 2009-11-20 22:11 15828 ------w- d:\arquivos de programas\Arquivos comuns\license.rtf
2009-11-20 22:01 . 2009-11-20 22:01 832296 ------w- d:\arquivos de programas\Arquivos comuns\opera.exe
2009-11-20 22:01 . 2009-11-20 22:01 4450088 ------w- d:\arquivos de programas\Arquivos comuns\opera.dll
2009-11-20 22:00 . 2009-11-20 22:00 20480 ------w- d:\arquivos de programas\Arquivos comuns\OUniAnsi.dll
2009-11-20 22:00 . 2009-11-20 22:00 653419 ------w- d:\arquivos de programas\Arquivos comuns\encoding.bin
2009-11-13 21:19 . 2009-03-27 23:27 2320 ------w- d:\arquivos de programas\Arquivos comuns\operadef6.ini
2009-08-19 08:39 . 2009-08-19 08:39 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20 . 2009-12-01 18:16 621546 ----a-w- d:\arquivos de programas\Arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20 . 2009-12-01 18:16 3219 ----a-w- d:\arquivos de programas\Arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41 . 2009-06-17 17:41 3870 ----a-w- d:\arquivos de programas\Arquivos comuns\lngcode.txt.vir
2008-06-09 13:17 . 2008-06-09 13:17 301 ----a-w- d:\arquivos de programas\Arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35 . 2004-02-26 16:35 7904 ------w- d:\arquivos de programas\Arquivos comuns\html40_entities.dtd
2002-03-11 09:06 . 2002-03-11 09:06 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45 . 2002-03-11 08:45 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-11-24 09:18 . 2009-04-29 23:59 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
Nota entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\arquivos de programas\CursorXP\CursorXP.exe" [2005-01-19 128000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="d:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="d:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRealMode"= 0 (0x0)
"HonorAutoRunSetting"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoUpdateCheck"= 0 (0x0)
"NoSMBalloonTip"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^BrOffice.org 3.1.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_15.01.2010_15-37.lnk]
[HKLM\~\startupfolder\D:^Documents and Settings^edsom luis^Menu Iniciar^Programas^Inicializar^setup_9.0.0.722_18.02.2010_16-03.lnk]
[HKLM\~\startupfolder\^.mjsync_pt_BR]
path=\.mjsync_pt_BR
[HKLM\~\startupfolder\^catchme.exe]
path=\catchme.exe
[HKLM\~\startupfolder\^Desktop.rar]
path=\Desktop.rar
[HKLM\~\startupfolder\^dumphive.exe]
path=\dumphive.exe
[HKLM\~\startupfolder\^Favoritos.rar]
path=\Favoritos.rar
[HKLM\~\startupfolder\^haxoth2.txt]
path=\haxoth2.txt
[HKLM\~\startupfolder\^md5file.exe]
path=\md5file.exe
[HKLM\~\startupfolder\^moveex.exe]
path=\moveex.exe
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\ntuser.dat
[HKLM\~\startupfolder\^NTUSER.DAT.bak_jv16pt]
path=\NTUSER.DAT.bak_jv16pt
[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
[HKLM\~\startupfolder\^NTUSER.DAT.tmp.LOG]
path=\NTUSER.DAT.tmp.LOG
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
[HKLM\~\startupfolder\^ntuser.pol]
path=\ntuser.pol
[HKLM\~\startupfolder\^PrivacIE.rar]
path=\PrivacIE.rar
[HKLM\~\startupfolder\^process.exe]
path=\process.exe
[HKLM\~\startupfolder\^rebuilt.Menu Iniciar.rar]
path=\rebuilt.Menu Iniciar.rar
[HKLM\~\startupfolder\^rebuilt.UserData.rar]
path=\rebuilt.UserData.rar
[HKLM\~\startupfolder\^run2.hax]
path=\run2.hax
[HKLM\~\startupfolder\^swreg.exe]
path=\swreg.exe
[HKLM\~\startupfolder\^swsc.exe]
path=\swsc.exe
[HKLM\~\startupfolder\^tool_en.log]
path=\tool_en.log
[HKLM\~\startupfolder\^UserData.rar]
path=\UserData.rar
[HKLM\~\startupfolder\^vfind.exe]
path=\vfind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 ----a-w- d:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42 36272 ----a-w- d:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 03:20 15360 ----a-w- d:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]
2005-01-19 19:34 128000 ----a-w- d:\arquivos de programas\CursorXP\CursorXP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2008-11-04 04:44 435096 ------w- d:\arquiv~1\ARQUIV~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 14:43 248040 ----a-w- d:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"GoogleDesktopManager-060409-093314"=3 (0x3)
"ZeppelinService"=2 (0x2)
"idsvc"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Arquivos comuns\\opera.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"d:\\Arquivos de programas\\Oracle\\VirtualBox\\VirtualBox.exe"=
"d:\\Arquivos de programas\\Opera 10.60 Beta\\opera.exe"=
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [18/9/2009 13:11 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [18/9/2009 13:10 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [15/3/2005 12:00 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [3/5/2010 15:00 135336]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [18/9/2009 13:11 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [18/5/2010 20:28 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [23/3/2007 02:00 30032]
.
Conteúdo da pasta 'Tarefas Agendadas'
2010-06-22 d:\windows\Tasks\User_Feed_Synchronization-{85870EB0-73F3-41E1-92DD-7C153C1F486E}.job
.
.
------- Scan Suplementar -------
.
mWindow Title =
IE: E&xportar para o Microsoft Excel
FF - ProfilePath - d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\arquivos de programas\Opera 10.60 Beta\program\plugins\npdsplay.dll
FF - plugin: d:\arquivos de programas\Opera 10.60 Beta\program\plugins\npwmsdrm.dll
FF - plugin: d:\documents and settings\edsom luis\Dados de aplicativos\Mozilla\Firefox\Profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-22 17:55
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_USERS\.Default\Software\Stardock\WindowBlinds\WB5.ini\Installed]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="D?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
d:\windows\system32\sfc_os.dll
d:\windows\system32\cscui.dll
d:\windows\system32\psbase.dll
.
Tempo para conclusão: 2010-06-22 17:57:01
ComboFix-quarantined-files.txt 2010-06-22 20:57
Pré-execução: 18 pasta(s) 40.622.555.136 bytes disponíveis
Pós execução: 21 pasta(s) 40.611.053.568 bytes disponíveis
DDS (Ver_09-12-01.01) - FAT32x86
Run by edsom luis at 18:18:37,70 on ter 22/06/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.236 [GMT -3:00]
AV: AntiVir Desktop On-access scanning enabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
D:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
D:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
D:\Arquivos de programas\Java\jre6\bin\jqs.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe
D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe
D:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
D:\Arquivos de programas\CursorXP\CursorXP.exe
D:\Documents and Settings\edsom luis\Meus documentos\Downloads\dds.scr
D:\WINDOWS\system32\wuauclt.exe
============== Pseudo HJT Report ===============
mWindow Title =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\arquivos de programas\arquivos comuns\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - d:\arquivos de programas\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\arquivos de programas\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\arquivos de programas\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CursorXP] d:\arquivos de programas\cursorxp\CursorXP.exe
mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "d:\arquivos de programas\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "d:\arquivos de programas\arquivos comuns\adobe\arm\1.0\AdobeARM.exe"
mRun: [sunJavaUpdateSched] "d:\arquivos de programas\arquivos comuns\java\java update\jusched.exe"
mRun: [avgnt] "d:\arquivos de programas\avira\antivir desktop\avgnt.exe" /min
uPolicies-explorer: NoRealMode = 0 (0x0)
uPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
uPolicies-explorer: NoFileUrl = 0 (0x0)
uPolicies-explorer: NoUpdateCheck = 0 (0x0)
uPolicies-explorer: NoSMBalloonTip = 0 (0x0)
mPolicies-explorer: HonorAutoRunSetting = 0 (0x0)
mPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: E&xportar para o Microsoft Excel
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cabSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - d:\docume~1\edsoml~1\dadosd~1\mozilla\firefox\profiles\izozpjim.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/webhp?hl=pt-BR
FF - component: d:\documents and settings\edsom luis\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: d:\arquivos de programas\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\arquivos de programas\opera 10.60 beta\program\plugins\npdsplay.dll
FF - plugin: d:\arquivos de programas\opera 10.60 beta\program\plugins\npwmsdrm.dll
FF - plugin: d:\documents and settings\edsom luis\dados de aplicativos\mozilla\firefox\profiles\izozpjim.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
---- FIREFOX POLICIES ----
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
d:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
d:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "[http://www.firefox.com"](http://www.firefox.com));
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
d:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");============= SERVICES / DRIVERS ===============
R1 avgio;avgio;d:\arquivos de programas\avira\antivir desktop\avgio.sys [2010-5-3 11608]
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [2009-9-18 142864]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [2009-9-18 41744]
R2 713xTVCard;SAA7131 TV Card;d:\windows\system32\drivers\SAA713x.sys [2005-3-15 277504]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\arquivos de programas\avira\antivir desktop\sched.exe [2010-5-3 135336]
R2 AntiVirService;Avira AntiVir Guard;d:\arquivos de programas\avira\antivir desktop\avguard.exe [2010-5-3 267432]
R2 avgntflt;avgntflt;d:\windows\system32\drivers\avgntflt.sys [2010-5-3 60936]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [2009-9-18 100368]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [2010-5-18 111248]
R3 xpvcom;XPVCOM Port;d:\windows\system32\drivers\XPVCOM.sys [2007-3-23 30032]
=============== Created Last 30 ================
2010-06-22 21:11:09 0 d-----w- d:\windows\system32\wbem\Repository
2010-06-22 21:10:58 0 d-----w- D:\ComboFix
2010-06-22 21:10:46 0 d-sh--w- D:\Recycled
2010-06-22 21:08:16 0 d-sh--w- D:\Recycled(2)
2010-06-22 19:10:23 0 d-----w- d:\arquivos de programas\Opera 10.60 Beta
2010-06-22 17:52:20 0 d-sh--w- D:\FOUND.000
2010-06-22 15:27:03 0 d-sha-r- D:\autorun.inf
2010-06-22 13:37:11 3 ----a-w- d:\windows\rrxx.dll
2010-06-22 13:16:10 161792 ----a-w- d:\windows\SWREG.exe
2010-06-21 22:35:15 0 d-----w- d:\docume~1\alluse~1\dadosd~1\MySQL
2010-06-07 13:12:41 0 d-----w- d:\docume~1\alluse~1\dadosd~1\IObit
2010-06-03 20:40:57 0 d-----w- d:\docume~1\alluse~1\dadosd~1\Alwil Software
2010-05-31 23:57:45 537842 ----a-w- D:\HaxFix.exe
2010-05-30 21:29:18 0 d---a-w- D:\Navilog1
2010-05-30 20:32:08 0 d-----w- d:\docume~1\edsoml~1\dadosd~1\Panda Security
2010-05-28 22:04:52 0 d-----w- d:\windows\system32\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185
2010-05-28 00:30:31 5878 ----a-w- d:\documents and settings\edsom luis\Items.xml
2010-05-27 23:10:41 0 d-----w- d:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2010-05-27 23:10:37 0 d-----w- d:\arquivos de programas\arquivos comuns\Wise Installation Wizard
2010-05-27 14:50:56 8704 ----a-w- d:\windows\system32\fixccs.exe
2010-05-26 20:31:26 8704 ----a-w- D:\fixccs.exe
==================== Find3M ====================
2010-06-10 14:34:20 6291456 ----a-w- d:\windows\system32\perfh016.dat
2010-06-10 14:34:20 6029312 ----a-w- d:\windows\system32\perfc016.dat
2010-05-28 18:33:34 15 ----a-w- d:\documents and settings\edsom luis\settings.dat
2010-05-18 23:28:28 100368 ----a-w- d:\windows\system32\drivers\VBoxNetAdp.sys
2010-05-18 23:28:26 41744 ----a-w- d:\windows\system32\drivers\VBoxUSBMon.sys
2010-05-18 23:28:26 142864 ----a-w- d:\windows\system32\drivers\VBoxDrv.sys
2010-05-18 23:28:26 133648 ----a-w- d:\windows\system32\VBoxNetFltNotify.dll
2010-05-18 23:28:26 111248 ----a-w- d:\windows\system32\drivers\VBoxNetFlt.sys
2010-05-18 02:30:12 219648 ----a-w- d:\windows\system32\uxtheme.dll
2010-05-17 18:52:00 12 ----a-w- d:\windows\system32\drivers\IncompleteBoot.cnt
2010-05-05 13:30:58 173056 ------w- d:\windows\system32\dllcache\ie4uinit.exe
2010-05-04 18:34:38 12552 ----a-w- d:\windows\system32\drivers\hddirect.sys
2010-05-02 08:08:34 1851392 ----a-w- d:\windows\system32\win32k.sys
2010-05-02 08:08:34 1851392 ------w- d:\windows\system32\dllcache\win32k.sys
2010-04-29 18:39:38 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 18:39:26 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2010-04-26 18:58:14 256512 ----a-w- d:\windows\PEV.exe
2010-04-20 05:31:10 285696 ----a-w- d:\windows\system32\atmfd.dll
2010-04-20 05:31:10 285696 ------w- d:\windows\system32\dllcache\atmfd.dll
2010-04-18 00:33:28 411368 ----a-w- d:\windows\system32\deployJava1.dll
2010-04-14 07:02:00 327168 ----a-w- d:\windows\IsUn0416.exe
2010-04-06 07:52:46 2462720 ------w- d:\windows\system32\dllcache\WMVCore.dll
2009-12-01 18:16:32 38338 ------w- d:\arquivos de programas\Uninst.isu
2009-11-27 21:47:52 218 ------w- d:\arquivos de programas\arquivos comuns\operaprefs_default.ini
2009-11-20 22:11:28 15828 ------w- d:\arquivos de programas\arquivos comuns\license.rtf
2009-11-20 22:01:18 832296 ------w- d:\arquivos de programas\arquivos comuns\opera.exe
2009-11-20 22:01:16 4450088 ------w- d:\arquivos de programas\arquivos comuns\opera.dll
2009-11-20 22:00:42 20480 ------w- d:\arquivos de programas\arquivos comuns\OUniAnsi.dll
2009-11-20 22:00:24 653419 ------w- d:\arquivos de programas\arquivos comuns\encoding.bin
2009-11-13 21:19:06 2320 ------w- d:\arquivos de programas\arquivos comuns\operadef6.ini
2009-08-19 08:39:36 330 ------w- d:\arquivos de programas\setup.ini
2009-07-10 06:20:00 621546 ----a-w- d:\arquivos de programas\arquivos comuns\ACIHELP.HLP.vir
2009-07-10 06:20:00 3219 ----a-w- d:\arquivos de programas\arquivos comuns\Acihelp.cnt.vir
2009-06-17 17:41:58 3870 ----a-w- d:\arquivos de programas\arquivos comuns\lngcode.txt.vir
2008-06-09 13:17:20 301 ----a-w- d:\arquivos de programas\arquivos comuns\c3nform.vxml.vir
2004-02-26 16:35:04 7904 ------w- d:\arquivos de programas\arquivos comuns\html40_entities.dtd
2002-03-11 09:06:30 1822520 ------w- d:\arquivos de programas\instmsiw.exe
2002-03-11 08:45:04 1708856 ------w- d:\arquivos de programas\instmsia.exe
2009-01-21 15:39:44 32768 --sha-w- d:\windows\system32\config\systemprofile\configurações locais\histórico\history.ie5\mshist012009012120090122\index.dat
2009-09-11 17:30:12 245760 --sha-w- d:\windows\system32\config\systemprofile\ietldcache\index.dat
2009-11-24 09:18:56 32 --sha-w- d:\windows\system32\drivers\fidbox.dat
============= FINISH: 18:19:27,71 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 19/9/2007 10:51:37
System Uptime: 22/6/2010 18:16:14 (0 hours ago)
Motherboard: ECS | | M825G
Processor: AMD Sempron 2400+ | Socket-A | 1668/166mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (FAT32) - 17 GiB total, 9,794 GiB free.
D: is FIXED (FAT32) - 59 GiB total, 37,736 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: RADEON 9200 PRO Family (Microsoft Corporation)
Device ID: PCI\VEN_1002&DEV_5960&SUBSYS_061018BC&REV_01\4&1FEB96E4&0&0008
Manufacturer: ATI Technologies Inc.
Name: RADEON 9200 PRO Family (Microsoft Corporation)
PNP Device ID: PCI\VEN_1002&DEV_5960&SUBSYS_061018BC&REV_01\4&1FEB96E4&0&0008
Service: ati2mtag
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: RADEON 9200 PRO SEC Family (Microsoft Corporation)
Device ID: PCI\VEN_1002&DEV_5940&SUBSYS_061118BC&REV_01\4&1FEB96E4&0&0108
Manufacturer: ATI Technologies Inc.
Name: RADEON 9200 PRO SEC Family (Microsoft Corporation)
PNP Device ID: PCI\VEN_1002&DEV_5940&SUBSYS_061118BC&REV_01\4&1FEB96E4&0&0108
Service: ati2mtag
Class GUID:
Description:
Device ID: STREAM\7131TVTUNER\4&2164E342&0&0
Manufacturer:
Name:
PNP Device ID: STREAM\7131TVTUNER\4&2164E342&0&0
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Controlador de comunicação PCI simples
Device ID: PCI\VEN_1106&DEV_3068&SUBSYS_4C211543&REV_80\3&61AAA01&0&8E
Manufacturer:
Name: Controlador de comunicação PCI simples
PNP Device ID: PCI\VEN_1106&DEV_3068&SUBSYS_4C211543&REV_80\3&61AAA01&0&8E
Service:
==== System Restore Points ===================
RP134: 22/6/2010 10:42:58 - LCCD E SAQ 80
RP135: 22/6/2010 13:00:27 - Revo Uninstaller's restore point - ATI Catalyst Install Manager
RP136: 22/6/2010 13:00:54 - Removido ATI Catalyst Install Manager
RP137: 22/6/2010 16:00:52 - Revo Uninstaller's restore point - Opera 10.60
RP138: 22/6/2010 16:01:14 - Removed Opera 10.60.
RP139: 22/6/2010 16:10:21 - Installed Opera 10.60.
RP140: 22/6/2010 18:10:11 - Operação de restauração
==== Installed Programs ======================
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2 - Português
Apple Application Support
Apple Software Update
ATI Catalyst Registration
Atualização de Segurança para o Windows Media Player (KB978695)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127-v2)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127)
Atualização de Segurança para Windows Internet Explorer 7 (KB958215)
Atualização de Segurança para Windows Internet Explorer 7 (KB960714)
Atualização de Segurança para Windows Internet Explorer 7 (KB961260)
Atualização de Segurança para Windows Internet Explorer 8 (KB969897)
Atualização de Segurança para Windows Internet Explorer 8 (KB971961)
Atualização de Segurança para Windows Internet Explorer 8 (KB972260)
Atualização de Segurança para Windows Internet Explorer 8 (KB974455)
Atualização de Segurança para Windows Internet Explorer 8 (KB976325)
Atualização de Segurança para Windows Internet Explorer 8 (KB978207)
Atualização de Segurança para Windows Internet Explorer 8 (KB981332)
Atualização de Segurança para Windows Internet Explorer 8 (KB982381)
Atualização de Segurança para Windows XP (KB975562)
Atualização de Segurança para Windows XP (KB978542)
Atualização de Segurança para Windows XP (KB979482)
Atualização de Segurança para Windows XP (KB979559)
Atualização de Segurança para Windows XP (KB980195)
Atualização de Segurança para Windows XP (KB980218)
Atualização para Windows Internet Explorer 8 (KB973874)
Atualização para Windows Internet Explorer 8 (KB976662)
Atualização para Windows Internet Explorer 8 (KB976749)
Atualização para Windows Internet Explorer 8 (KB980182)
Avira AntiVir Personal - Free Antivirus
BrOffice.org 3.1
C-Media WDM Audio Driver
CCleaner
CursorXP
EVEREST Home Edition v2.20
Gadwin PrintScreen
Google Chrome
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix para Windows XP (KB981793)
Java Auto Updater
Java 6 Update 20
Junk Mail filter updateK-Meleon 1.5.4 en-US (remove only)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Speech Recognition Engine 4.0 (English)
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6)
MSXML 4.0 SP2 (KB973688)
Oracle VM VirtualBox 3.2.0
Revo Uninstaller 1.88
Safari
The Lord of the Rings FREE Trial
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
você 9.0 Runtime
VIA Rhine-Family Fast-Ethernet Adapter
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Internet Explorer 7
Windows Media Format 11 runtime
XML Paper Specification Shared Components Pack 1.0
==== End Of File ===========================
Obrigado e abraços
Boa Noite! EDSSX
<!> Pelo visto,seus problemas de validação foram resolvidos.
<!> O que ocorre?
Abraços!
Boa noite ! DigRam
Bom , após os proçedimentos que vossa pessoa me passou neste tópico; vieram algumas atualizações automáticas e quando ao executar alguns programas; pedia - se para fazer o scandisk ; assim feito recuperou - se alguns arquivos conrrompidos . Removendo alguns trojans e rootkits também .
Abraços
Boa Tarde! EDSSX
<!> A sua máquina está mais afetada,mas..tentaremos a correção.
0000000000000000000
ooooooooooooooooooo
<@> Baixe: < Dial-a-fix >
<@> Tire-o do zip!
<@> Clique em Policies...
<@> Ps: Encontrando políticas restritivas,pode removê-las deixando o campo vazio.
<@> À seguir,clique em "Tools". ( Ícone do martelo )
<@> Clique simples,em SFC purge --> Clique em "GO" --> Aguarde!
<@> Concluindo,feche a ferramenta!
0000000000000000000
ooooooooooooooooooo
<@> Baixe: < TS.zip >
<!> Link - 2 < http://www.mediafire.com/?ldgm51eztgh >
<@> Salve-o em D:\ --> d:\ts.zip <-- Eis o caminho!
<@> Ps: Deixe-o reservado,para posterior utilização.
0000000000000000000
ooooooooooooooooooo
<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.
<@> Salve-o,no Desktop,com o nome: CFScript.txt
>
File::d:\windows\system32\dllcache\winlogon.exe
d:\windows\ServicePackFiles\i386\winlogon.exe
d:\windows\ServicePackFiles\i386\comctl32.dll
d:\windows\system32\dllcache\mshtml.dll
d:\windows\ServicePackFiles\i386\mshtml.dll
d:\windows\system32\dllcache\ntoskrnl.exe
d:\windows\ServicePackFiles\i386\ntoskrnl.exe
d:\windows\system32\dllcache\user32.dll
d:\windows\ServicePackFiles\i386\user32.dll
d:\windows\system32\dllcache\wininet.dll
d:\windows\ServicePackFiles\i386\wininet.dll
d:\windows\system32\dllcache\explorer.exe
d:\windows\ServicePackFiles\i386\explorer.exe
d:\windows\system32\dllcache\ctfmon.exe
d:\windows\ServicePackFiles\i386\ctfmon.exe
d:\windows\system32\dllcache\ntkrnlpa.exe
d:\windows\Driver Cache\i386\ntkrnlpa.exe
d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
Folder::
d:\windows\NiwradSoft Shell Pack\Backup
<@> Ps: É recomendável que esteja desconectado,ao rodar o script.
<@> Ps: Desabilite,temporariamente,seu antivírus.
<@> Ps: Não utilizem este script em outra máquina!
<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.
<@> Veja a demonstração!
/applications/core/interface/imageproxy/imageproxy.php?img=http://farm4.static.flickr.com/3028/2872959479_997d4500c4_o.gif&key=5df91a69abacb5902724f70d14994f3bf5ba8d87bf300cea4c6fd8c885940cf0" alt="2872959479_997d4500c4_o.gif" />
<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.
<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )
<@> Terminando,poste: D:\ComboFix.txt
Abraços!