Rackson 0 Denunciar post Postado Março 6, 2008 Olá a todos.... Ando com alguns problemas após colocar um pendrive infectado no meu pc, em um período que eu estava sem anti-virus.... Como disse no título do tópico os Arquivos Ocultos não são exibidos (Mesmo indo em opções de pastas) e ando vendo uns arquivos q não sei oque são e uns processos também.... Acho que o somente o log é suficiente, mas caso alguem necessite de alguma outra informação é só falar!... De já agradeço pelos q estão lendo o post!.. Segue o log: Logfile of HijackThis v1.99.1Scan saved at 22:46:10, on 5/3/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exeC:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Arquivos de programas\Windows Live\Messenger\usnsvc.exeC:\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.aspR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO1 - Hosts: 85.17.237.8 www.filewarez.nlO2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Arquivos de programas\Internet Download Manager\IDMIECC.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - Startup: Untitled-1.pngO8 - Extra context menu item: Add to Anti-Banner - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htmO8 - Extra context menu item: Download All Links with IDM - C:\Arquivos de programas\Internet Download Manager\IEGetAll.htmO8 - Extra context menu item: Download with IDM - C:\Arquivos de programas\Internet Download Manager\IEExt.htmO8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dllO9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Salvar Flash - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Arquivos de programas\Syncsoft\PegaFlash\pegaflash (file missing)O9 - Extra 'Tools' menuitem: PegaFlash - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Arquivos de programas\Syncsoft\PegaFlash\pegaflash (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dllO14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.aspO16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cabO16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{9F63592D-05D8-4FDB-9DB5-723BBDEE379E}: NameServer = 201.10.120.3,201.10.128.3O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLLO20 - AppInit_DLLs: C:\ARQUIV~1\KASPER~1\KASPER~2.0\adialhk.dllO20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exeO23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe A propósito, o arquivo .png na inicialização é proposital ^^" (Lembrete, hehehe) Abraço a todos Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Março 9, 2008 Opa Rackson, Baixe o ComboFix em: ComboFix 1) Desabilite o seu anti-vírus temporariamente; 2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos; 3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção); 4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt; 5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco); 6) Para parar ou sair do ComboFix, tecle "N"; 7) Reabilite o seu anti-vírus; 8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta, juntamente com um novo log do HijackThis. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
Rackson 0 Denunciar post Postado Março 15, 2008 Opa jgarcia Fiz como pediu, só que o PC não reiniciou no fim do processo. Não sei se tem algum problema... Mas os arquivos ocultos, que antes não estavam sendo exibidos, agora estão!! \o/ De qualquer forma eis o log do ComboFix e hijackthis respectivamente: ComboFix 08-03-10.1 - Ze Rackson 2008-03-14 21:40:56.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.260 [GMT -3:00]Executando de: C:\Documents and Settings\Ze Rackson\Desktop\ComboFix.exe * Criado um novo ponto de restauro[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color].((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))).C:\windows\svchost.iniC:\windows\system32\xbox.dll.((((((((((((((((((((((( Ficheiros criados de 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))).2008-03-05 22:41 . 2008-03-05 22:46 <DIR> d-------- C:\hijackthis2008-03-04 19:26 . 2008-03-04 19:26 <DIR> d-------- C:\Documents and Settings\Ze Rackson\Dados de aplicativos\MakeUpPilot2008-02-28 00:32 . 2008-02-28 00:32 <DIR> d-------- C:\Arquivos de programas\Apoio2008-02-27 22:15 . 2008-02-27 22:15 <DIR> d-------- C:\Arquivos de programas\MSN BackUp2008-02-27 13:32 . 2008-03-09 15:08 <DIR> d-------- C:\Documents and Settings\Ze Rackson\amsn2008-02-27 13:32 . 2008-02-27 13:32 <DIR> d-------- C:\Arquivos de programas\aMSN2008-02-25 22:02 . 2008-02-25 22:02 <DIR> d-------- C:\Documents and Settings\Ze Rackson\Dados de aplicativos\Notepad++2008-02-25 22:02 . 2008-02-25 22:02 <DIR> d-------- C:\Arquivos de programas\Notepad++2008-02-23 13:26 . 2008-02-23 13:26 <DIR> dr-h----- C:\Documents and Settings\Ze Rackson\Dados de aplicativos\SecuROM2008-02-23 13:26 . 2008-02-23 13:26 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll2008-02-16 13:09 . 2008-02-16 13:09 <DIR> d-------- C:\Arquivos de programas\Winamp.((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-03-15 00:42 798,240 --sha-w C:\windows\system32\drivers\fidbox2.dat2008-03-15 00:42 24,939,296 --sha-w C:\windows\system32\drivers\fidbox.dat2008-03-15 00:21 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Kaspersky Lab2008-03-14 23:49 --------- d-----w C:\Arquivos de programas\CyberScript312008-03-14 21:01 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\DMCache2008-03-14 17:38 88,172 --sha-w C:\windows\system32\drivers\fidbox2.idx2008-03-14 17:38 356,372 --sha-w C:\windows\system32\drivers\fidbox.idx2008-02-13 00:30 --------- d-----w C:\Arquivos de programas\CoolSMS2008-02-11 14:01 --------- d-----w C:\Arquivos de programas\Instant Lock2008-02-08 14:38 51,361 ----a-w C:\windows\system32\calc.zip2008-02-08 14:31 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center2008-02-08 02:12 --------- d-----w C:\Arquivos de programas\PowerQuest2008-02-07 01:28 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\Radmin2008-02-06 17:05 --------- d-----w C:\Arquivos de programas\Combined Community Codec Pack2008-02-04 14:47 --------- d-----w C:\Arquivos de programas\AC3Filter2008-02-04 14:42 21,764 ----a-w C:\windows\system32\CoreAAC-uninstall.exe2008-02-01 00:59 91,700 ----a-w C:\windows\system32\drivers\klin.dat2008-01-29 01:55 --------- d-----w C:\Arquivos de programas\Marcos Velasco Security2008-01-25 16:59 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\Talkback2008-01-21 19:03 74,703 ----a-w C:\windows\system32\mfc45.dll2008-01-21 18:45 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\iolo2008-01-21 18:45 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\iolo2008-01-21 13:14 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Autodesk2008-01-21 13:13 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Autodesk Shared2008-01-16 19:42 223,128 ----a-w C:\windows\system32\drivers\dtscsi.sys2008-01-16 19:42 --------- d-----w C:\Arquivos de programas\DAEMON Tools2008-01-16 19:39 96,256 ----a-w C:\windows\system32\drivers\sptd7757.sys2008-01-16 19:39 642,560 ----a-w C:\windows\system32\drivers\sptd.sys2008-01-15 04:20 --------- d-----w C:\Arquivos de programas\BitLord.(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))..REGEDIT4*Nota* entradas vazias & legítimas por defeito não são mostradas.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"AVP"="C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2007-03-09 18:50 200768]"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2001-12-16 14:55 2899968]C:\Documents and Settings\Ze Rackson\Menu Iniciar\Programas\Inicializar\Untitled-1.png [2008-01-31 10:30:52 156012][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=C:\ARQUIV~1\KASPER~1\KASPER~2.0\adialhk.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^AutoCAD Startup Accelerator.lnk]backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Ze Rackson^Menu Iniciar^Programas^Inicializar^BananaScreen.lnk]backup=C:\WINDOWS\pss\BananaScreen.lnkStartup[HKLM\~\startupfolder\C:^Documents and Settings^Ze Rackson^Menu Iniciar^Programas^Inicializar^BitLord.lnk]backup=C:\WINDOWS\pss\BitLord.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CmiRemoveDir]--a------ 2003-07-22 10:15 225280 C:\WINDOWS\CMIRMR~1.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSMS][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]--a------ 2005-12-10 11:57 133016 C:\Arquivos de programas\DAEMON Tools\daemon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]--a------ 2007-01-01 19:54 3735552 C:\Arquivos de programas\Google\Google Talk\googletalk.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]--a------ 2007-10-28 01:39 880896 C:\Arquivos de programas\Internet Download Manager\IDMan.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]--a------ 2008-01-07 21:18 5724184 C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]-ra------ 2001-12-16 14:55 2899968 C:\WINDOWS\system32\NvCpl.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]-ra------ 2001-12-16 14:55 46080 C:\WINDOWS\system32\NvMcTray.dll[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]-ra------ 2001-12-16 14:55 782336 C:\WINDOWS\system32\nwiz.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]--a------ 2007-11-13 23:24 77824 C:\Arquivos de programas\QuickTime\qttask.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]--a------ 2007-09-25 00:11 132496 C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Userinit]C:\WINDOWS\system32\cologsver.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent][HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusDisableNotify"=dword:00000001"UpdatesDisableNotify"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="C:\\Arquivos de programas\\Google\\Google Talk\\googletalk.exe"="C:\\Arquivos de programas\\eMule\\emule.exe"="C:\\Arquivos de programas\\CyberScript31\\CyberScript.exe"="C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=R3 CCCP106;D-Link CIF Webcam;C:\windows\system32\DRIVERS\cccp106.sys [2003-05-05 23:35]S3 mirrorv3;mirrorv3;C:\windows\system32\DRIVERS\rminiv3.sys [2006-11-01 04:01][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1340f5ba-c2a6-11dc-b413-806d6172696f}]\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1340f5bb-c2a6-11dc-b413-806d6172696f}]\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL .\MSOCache\90000804-6000-11D3-8CFE-0150048383C9\KB915865.exe.**************************************************************************catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-03-14 21:42:53Windows 5.1.2600 Service Pack 2 NTFSProcurando processos ocultos ...Procurando entradas auto inicializáveis ocultas ...Procurando ficheiros ocultos ...Varredura completada com sucesso Ficheiros ocultos: 0 **************************************************************************.Tempo para conclusão: 2008-03-14 21:43:39ComboFix-quarantined-files.txt 2008-03-15 00:43:28.2007-10-23 01:04:56 --- E O F --- Logfile of HijackThis v1.99.1Scan saved at 21:53:34, on 14/3/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\windows\System32\smss.exeC:\windows\system32\winlogon.exeC:\windows\system32\services.exeC:\windows\system32\lsass.exeC:\windows\system32\svchost.exeC:\windows\System32\svchost.exeC:\windows\system32\spoolsv.exeC:\windows\system32\nvsvc32.exeC:\windows\system32\svchost.exeC:\windows\System32\svchost.exeC:\Arquivos de programas\Winamp\winamp.exeC:\Arquivos de programas\Windows Live\Messenger\usnsvc.exeC:\windows\explorer.exeC:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exeC:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exeC:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exeC:\windows\system32\wuauclt.exeC:\Arquivos de programas\Mozilla Firefox\firefox.exeC:\hijackthis\HijackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO1 - Hosts: 85.17.237.8 www.filewarez.nlO2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Arquivos de programas\Internet Download Manager\IDMIECC.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dllO4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - Startup: Untitled-1.pngO8 - Extra context menu item: Add to Anti-Banner - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htmO8 - Extra context menu item: Download All Links with IDM - C:\Arquivos de programas\Internet Download Manager\IEGetAll.htmO8 - Extra context menu item: Download with IDM - C:\Arquivos de programas\Internet Download Manager\IEExt.htmO8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dllO9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Salvar Flash - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Arquivos de programas\Syncsoft\PegaFlash\pegaflash (file missing)O9 - Extra 'Tools' menuitem: PegaFlash - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Arquivos de programas\Syncsoft\PegaFlash\pegaflash (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\arquivos de programas\bonjour\mdnsnsp.dllO14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.aspO16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cabO16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{9F63592D-05D8-4FDB-9DB5-723BBDEE379E}: NameServer = 201.10.120.3,201.10.128.3O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLLO20 - AppInit_DLLs: C:\ARQUIV~1\KASPER~1\KASPER~2.0\adialhk.dllO20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exeO23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe Abraço e muito obrigado já! xD Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Março 16, 2008 Opa Rackson, Siga as instruções: 1. Vá em Iniciar -> Executar -> digite regedit -> dê Ok. 2. Navegue até a seguinte subchave: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2 3. Localize e delete as seguintes pastas: {1340f5ba-c2a6-11dc-b413-806d6172696f} {1340f5bb-c2a6-11dc-b413-806d6172696f} 4. Saia do Editor do Registro. 5. Abra o Bloco de Notas -> Copie (Control + C) e Cole (Control + V) todo o texto incluído no "Quote": File:: C:\WINDOWS\system32\cologsver.exe ATENÇÃO: O script acima foi elaborado especificamente para a infecção contida neste computador. Utilizá-lo em outra máquina poderá originar graves problemas ao usuário. 2. Salve o arquivo como CFScript.txt; 6. Tal como exemplificado na foto abaixo, arraste o arquivo CFScript.txt para o ComboFix.exe. 7. Ao término do processo a ferramenta irá gerar um log. Poste-o (C:\ComboFix.txt) em sua próxima resposta. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
Rackson 0 Denunciar post Postado Março 18, 2008 Opa x) Aqui o log do Combofix ComboFix 08-03-10.1 - Ze Rackson 2008-03-18 1:29:51.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.273 [GMT -3:00] Executando de: C:\Documents and Settings\Ze Rackson\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Ze Rackson\Desktop\CFScript.txt * Criado um novo ponto de restauro WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\WINDOWS\system32\cologsver.exe . ((((((((((((((((((((((( Ficheiros criados de 2008-02-18 to 2008-03-18 )))))))))))))))))))))))))))))))) . 2008-03-15 21:38 . 2003-07-17 15:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd 2008-03-15 21:38 . 2005-01-01 06:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2008-03-15 21:25 . 2001-10-28 15:06 195,618 --a--c--- C:\WINDOWS\system32\dllcache\c_10002.nls 2008-03-15 21:25 . 2001-10-28 15:06 195,618 --a------ C:\WINDOWS\system32\c_10002.nls 2008-03-15 21:25 . 2001-10-28 15:06 82,172 --a--c--- C:\WINDOWS\system32\dllcache\bopomofo.nls 2008-03-15 21:25 . 2001-10-28 15:06 82,172 --a------ C:\WINDOWS\system32\bopomofo.nls 2008-03-15 21:25 . 2001-10-28 15:06 66,728 --a--c--- C:\WINDOWS\system32\dllcache\big5.nls 2008-03-15 21:25 . 2001-10-28 15:06 66,728 --a------ C:\WINDOWS\system32\big5.nls 2008-03-15 21:25 . 2001-10-28 15:06 19,456 --a--c--- C:\WINDOWS\system32\dllcache\agt0804.dll 2008-03-15 21:25 . 2001-10-28 15:06 16,254 --a------ C:\WINDOWS\system32\PINTLPAE.HLP 2008-03-15 21:25 . 2001-10-28 15:06 14,821 --a------ C:\WINDOWS\system32\PINTLPAD.HLP 2008-03-15 21:25 . 2001-10-28 15:06 1,460 --a------ C:\WINDOWS\system32\a15.tbl 2008-03-15 21:24 . 2001-10-28 15:06 1,564,868 --a------ C:\WINDOWS\system32\WINSP.MB 2008-03-15 21:24 . 2001-10-28 15:06 1,223,500 --a------ C:\WINDOWS\system32\WINZM.MB 2008-03-15 21:20 . 2001-10-28 15:06 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-03-15 21:19 . 2004-08-03 22:31 811,064 --a------ C:\WINDOWS\system32\imjp81k.dll 2008-03-15 21:18 . 2001-08-18 06:36 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll 2008-03-15 21:16 . 2008-03-15 21:16 <DIR> d-------- C:\Arquivos de programas\softnyx 2008-03-05 22:41 . 2008-03-14 21:53 <DIR> d-------- C:\hijackthis 2008-03-04 19:26 . 2008-03-04 19:26 <DIR> d-------- C:\Documents and Settings\Ze Rackson\Dados de aplicativos\MakeUpPilot 2008-02-28 00:32 . 2008-02-28 00:32 <DIR> d-------- C:\Arquivos de programas\Apoio 2008-02-27 22:15 . 2008-02-27 22:15 <DIR> d-------- C:\Arquivos de programas\MSN BackUp 2008-02-27 13:32 . 2008-03-09 15:08 <DIR> d-------- C:\Documents and Settings\Ze Rackson\amsn 2008-02-27 13:32 . 2008-02-27 13:32 <DIR> d-------- C:\Arquivos de programas\aMSN 2008-02-25 22:02 . 2008-02-25 22:02 <DIR> d-------- C:\Documents and Settings\Ze Rackson\Dados de aplicativos\Notepad++ 2008-02-25 22:02 . 2008-02-25 22:02 <DIR> d-------- C:\Arquivos de programas\Notepad++ 2008-02-23 13:26 . 2008-02-23 13:26 <DIR> dr-h----- C:\Documents and Settings\Ze Rackson\Dados de aplicativos\SecuROM 2008-02-23 13:26 . 2008-02-23 13:26 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-18 07:29 25,410,592 --sha-w C:\windows\system32\drivers\fidbox.dat 2008-03-18 07:22 820,512 --sha-w C:\windows\system32\drivers\fidbox2.dat 2008-03-17 21:07 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Kaspersky Lab 2008-03-17 17:25 90,068 --sha-w C:\windows\system32\drivers\fidbox2.idx 2008-03-17 17:25 362,348 --sha-w C:\windows\system32\drivers\fidbox.idx 2008-03-15 22:25 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\DMCache 2008-03-14 23:49 --------- d-----w C:\Arquivos de programas\CyberScript31 2008-02-16 16:09 --------- d-----w C:\Arquivos de programas\Winamp 2008-02-13 00:30 --------- d-----w C:\Arquivos de programas\CoolSMS 2008-02-11 14:01 --------- d-----w C:\Arquivos de programas\Instant Lock 2008-02-08 14:38 51,361 ----a-w C:\windows\system32\calc.zip 2008-02-08 14:31 --------- d-----w C:\Arquivos de programas\Windows Live Safety Center 2008-02-08 02:12 --------- d-----w C:\Arquivos de programas\PowerQuest 2008-02-07 01:28 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\Radmin 2008-02-06 17:05 --------- d-----w C:\Arquivos de programas\Combined Community Codec Pack 2008-02-04 14:47 --------- d-----w C:\Arquivos de programas\AC3Filter 2008-02-04 14:42 21,764 ----a-w C:\windows\system32\CoreAAC-uninstall.exe 2008-02-01 00:59 91,700 ----a-w C:\windows\system32\drivers\klin.dat 2008-01-29 01:55 --------- d-----w C:\Arquivos de programas\Marcos Velasco Security 2008-01-25 16:59 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\Talkback 2008-01-21 19:03 74,703 ----a-w C:\windows\system32\mfc45.dll 2008-01-21 18:45 --------- d-----w C:\Documents and Settings\Ze Rackson\Dados de aplicativos\iolo 2008-01-21 18:45 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\iolo 2008-01-21 13:14 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Autodesk 2008-01-21 13:13 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Autodesk Shared . ((((((((((((((((((((((((((((( snapshot@2008-03-14_21.43.08,98 ))))))))))))))))))))))))))))))))))))))))) . + 2004-08-04 01:31:50 175,104 ----a-w C:\windows\ime\chsime\applets\PINTLCSA.DLL + 2004-08-04 01:31:50 53,760 ----a-w C:\windows\ime\chsime\applets\PINTLCSD.DLL + 2004-08-04 01:31:52 97,792 ----a-w C:\windows\ime\CHTIME\Applets\CHTMBX.DLL + 2004-08-04 01:31:54 56,320 ----a-w C:\windows\ime\CHTIME\Applets\CHTSKDIC.DLL + 2004-08-04 01:31:54 173,568 ----a-w C:\windows\ime\CHTIME\Applets\CHTSKF.DLL + 2001-10-28 18:06:44 13,463,552 ----a-w C:\windows\ime\imjp8_1\applets\hwxjpn.dll + 2001-10-28 18:06:50 471,102 ----a-w C:\windows\ime\imjp8_1\applets\imskdic.dll + 2001-10-28 18:06:50 315,452 ----a-w C:\windows\ime\imjp8_1\applets\imskf.dll + 2001-10-28 18:06:52 229,439 ----a-w C:\windows\ime\imjp8_1\applets\multibox.dll + 2001-10-28 18:06:54 143,422 ----a-w C:\windows\ime\imjp8_1\applets\softkey.dll + 2004-08-04 01:32:36 426,041 ----a-w C:\windows\ime\imjp8_1\applets\voicepad.dll + 2004-08-04 01:32:36 86,073 ----a-w C:\windows\ime\imjp8_1\applets\voicesub.dll + 2004-08-04 01:31:40 57,399 ----a-w C:\windows\ime\imjp8_1\cplexe.exe + 2004-08-04 01:31:52 368,696 ----a-w C:\windows\ime\imjp8_1\imjpcic.dll + 2004-08-04 01:31:52 716,856 ----a-w C:\windows\ime\imjp8_1\imjpcus.dll + 2001-10-28 18:06:46 57,398 ----a-w C:\windows\ime\imjp8_1\imjpdadm.exe + 2004-08-04 01:31:54 81,976 ----a-w C:\windows\ime\imjp8_1\imjpdct.dll + 2004-08-04 01:31:54 307,257 ----a-w C:\windows\ime\imjp8_1\imjpdct.exe + 2004-08-04 01:31:56 155,705 ----a-w C:\windows\ime\imjp8_1\imjpdsvr.exe + 2004-08-04 01:31:58 196,665 ----a-w C:\windows\ime\imjp8_1\imjpinst.exe + 2004-08-04 01:32:00 208,952 ----a-w C:\windows\ime\imjp8_1\imjpmig.exe + 2004-08-04 01:32:12 233,527 ----a-w C:\windows\ime\imjp8_1\imjprw.exe + 2001-10-28 18:06:50 45,109 ----a-w C:\windows\ime\imjp8_1\imjpuex.exe + 2004-08-04 01:32:16 262,200 ----a-w C:\windows\ime\imjp8_1\imjputy.exe + 2004-08-04 01:32:16 274,489 ----a-w C:\windows\ime\imjp8_1\imjputyc.dll + 2001-10-28 18:06:46 10,129,408 ----a-w C:\windows\ime\imkr6_1\applets\hwxkor.dll + 2004-08-04 02:04:34 86,016 ----a-w C:\windows\ime\imkr6_1\applets\imekrmbx.dll + 2001-10-28 18:06:42 36,864 ----a-w C:\windows\ime\imkr6_1\dicts\hanjadic.dll + 2004-08-04 02:04:38 106,496 ----a-w C:\windows\ime\imkr6_1\imekrcic.dll + 2001-10-28 18:06:46 44,032 ----a-w C:\windows\ime\imkr6_1\imekrmig.exe + 2001-10-28 18:06:50 59,904 ----a-w C:\windows\ime\imkr6_1\imkrinst.exe + 2001-10-28 18:06:46 102,463 ----a-w C:\windows\ime\shared\imepadsm.dll + 2001-10-28 18:06:46 311,359 ----a-w C:\windows\ime\shared\imepadsv.exe + 2004-08-04 01:32:28 102,456 ----a-w C:\windows\ime\shared\imlang.dll + 2004-08-04 01:32:12 15,872 ----a-w C:\windows\ime\shared\res\PADRS404.DLL + 2001-10-28 18:06:52 36,927 ----a-w C:\windows\ime\shared\res\padrs411.dll + 2001-10-28 18:06:52 14,336 ----a-w C:\windows\ime\shared\res\padrs412.dll + 2004-08-04 01:31:50 15,360 ----a-w C:\windows\ime\shared\res\padrs804.dll + 2001-10-28 18:06:06 19,456 ----a-w C:\windows\msagent\intl\agt0411.dll + 2001-10-28 18:06:06 19,456 ----a-w C:\windows\msagent\intl\agt0412.dll + 2001-10-28 18:06:06 19,456 ----a-w C:\windows\msagent\intl\agt0804.dll + 2001-10-28 18:06:18 218,112 ----a-w C:\windows\system32\c_g18030.dll + 2001-10-28 18:06:18 6,656 ----a-w C:\windows\system32\c_is2022.dll - 2008-03-14 03:05:04 32,768 ----a-w C:\windows\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\index.dat + 2008-03-17 16:19:02 32,768 ----a-w C:\windows\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\index.dat - 2008-03-14 03:05:04 32,768 ----a-w C:\windows\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5\index.dat + 2008-03-17 16:19:02 32,768 ----a-w C:\windows\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5\index.dat - 2008-03-14 03:05:04 16,384 ----a-w C:\windows\system32\config\systemprofile\Cookies\index.dat + 2008-03-17 16:19:02 16,384 ----a-w C:\windows\system32\config\systemprofile\Cookies\index.dat + 2001-08-18 01:55:56 6,144 -c--a-w C:\windows\system32\dllcache\kbd101b.dll + 2001-08-18 01:55:56 6,144 -c--a-w C:\windows\system32\dllcache\kbd101c.dll + 2001-08-18 01:55:56 5,632 -c--a-w C:\windows\system32\dllcache\kbd103.dll + 2001-08-18 01:55:56 6,144 -c--a-w C:\windows\system32\dllcache\kbd106.dll + 2001-08-18 09:36:18 8,704 -c--a-w C:\windows\system32\dllcache\kbdjpn.dll + 2001-08-18 09:36:18 8,192 -c--a-w C:\windows\system32\dllcache\kbdkor.dll + 2001-10-28 18:06:32 7,168 ----a-w C:\windows\system32\f3ahvoas.dll + 2004-08-04 01:31:54 198,656 ----a-w C:\windows\system32\IME\CINTLGNT\CINTIME.DLL + 2004-08-04 01:31:56 480,256 ----a-w C:\windows\system32\IME\CINTLGNT\CINTSETP.EXE + 2004-08-04 01:31:50 59,392 ----a-w C:\windows\system32\IME\PINTLGNT\IMSCINST.EXE + 2004-08-04 01:31:50 70,144 ----a-w C:\windows\system32\IME\PINTLGNT\PINTLPHR.EXE + 2004-08-04 01:31:50 67,584 ----a-w C:\windows\system32\IME\PINTLGNT\PMIGRATE.DLL + 2004-08-04 01:32:16 44,032 ----a-w C:\windows\system32\IME\TINTLGNT\TINTLPHR.EXE + 2004-08-04 01:32:16 455,168 ----a-w C:\windows\system32\IME\TINTLGNT\TINTSETP.EXE + 2004-08-04 01:32:14 10,240 ----a-w C:\windows\system32\IME\TINTLGNT\TMIGRATE.DLL + 2001-10-28 18:06:40 6,144 ----a-w C:\windows\system32\kbd101.dll + 2001-10-28 18:06:40 6,144 ----a-w C:\windows\system32\kbd101a.dll + 2001-08-18 01:55:56 6,144 ----a-w C:\windows\system32\kbd101b.dll + 2001-08-18 01:55:56 6,144 ----a-w C:\windows\system32\kbd101c.dll + 2001-08-18 01:55:56 5,632 ----a-w C:\windows\system32\kbd103.dll + 2001-08-18 01:55:56 6,144 ----a-w C:\windows\system32\kbd106.dll + 2001-10-28 18:06:40 6,144 ----a-w C:\windows\system32\kbd106n.dll + 2001-10-28 18:06:40 6,144 ----a-w C:\windows\system32\kbdax2.dll + 2001-10-28 18:06:40 7,168 ----a-w C:\windows\system32\kbdibm02.dll + 2001-08-18 09:36:18 8,192 ----a-w C:\windows\system32\kbdkor.dll + 2001-10-28 18:06:40 6,656 ----a-w C:\windows\system32\kbdlk41a.dll + 2001-10-28 18:06:40 6,144 ----a-w C:\windows\system32\kbdlk41j.dll + 2001-10-28 18:06:40 7,168 ----a-w C:\windows\system32\kbdnec95.dll + 2001-10-28 18:06:40 9,216 ----a-w C:\windows\system32\kbdnecAT.dll + 2001-10-28 18:06:40 7,680 ----a-w C:\windows\system32\kbdnecNT.dll + 2004-08-04 02:04:12 76,288 ----a-w C:\windows\system32\uniime.dll . -- Snapshot reset to current date -- . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Nota* entradas vazias & legítimas por defeito não são mostradas. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVP"="C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2007-03-09 18:50 200768] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2001-12-16 14:55 2899968] C:\Documents and Settings\Ze Rackson\Menu Iniciar\Programas\Inicializar\ Untitled-1.png [2008-01-31 10:30:52 156012] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "disableregistrytools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\ARQUIV~1\KASPER~1\KASPER~2.0\adialhk.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^AutoCAD Startup Accelerator.lnk] backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ze Rackson^Menu Iniciar^Programas^Inicializar^BananaScreen.lnk] backup=C:\WINDOWS\pss\BananaScreen.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Ze Rackson^Menu Iniciar^Programas^Inicializar^BitLord.lnk] backup=C:\WINDOWS\pss\BitLord.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CmiRemoveDir] --a------ 2003-07-22 10:15 225280 C:\WINDOWS\CMIRMR~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSMS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2005-12-10 11:57 133016 C:\Arquivos de programas\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] --a------ 2007-01-01 19:54 3735552 C:\Arquivos de programas\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan] --a------ 2007-10-28 01:39 880896 C:\Arquivos de programas\Internet Download Manager\IDMan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2008-01-07 21:18 5724184 C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2001-12-16 14:55 2899968 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2001-12-16 14:55 46080 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2001-12-16 14:55 782336 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-11-13 23:24 77824 C:\Arquivos de programas\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 00:11 132496 C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Userinit] C:\WINDOWS\system32\cologsver.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Arquivos de programas\\Google\\Google Talk\\googletalk.exe"= "C:\\Arquivos de programas\\eMule\\emule.exe"= "C:\\Arquivos de programas\\CyberScript31\\CyberScript.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"= R3 CCCP106;D-Link CIF Webcam;C:\windows\system32\DRIVERS\cccp106.sys [2003-05-05 23:35] S3 mirrorv3;mirrorv3;C:\windows\system32\DRIVERS\rminiv3.sys [2006-11-01 04:01] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-18 04:26:09 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros ocultos ... Varredura completada com sucesso Ficheiros ocultos: 0 ************************************************************************** . Tempo para conclusão: 2008-03-18 4:55:56 ComboFix-quarantined-files.txt 2008-03-18 07:53:45 ComboFix2.txt 2008-03-15 00:43:40 . 2007-10-23 01:04:56 --- E O F --- Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Março 20, 2008 Opa Rackson, Vá em Iniciar -> Executar -> digite regedit -> dê Ok. Navegue até a seguinte subchave: HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg Localize e delete a seguinte pasta: Userinit Saia do Editor do Registro. Poste um novo log do ComboFix. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
Mário Monteiro 179 Denunciar post Postado Junho 13, 2008 Tópico Arquivado Como o autor não respondeu por mais de 20 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
