[Arquivado] virus protejaseudrive

rfsm · Julho 5, 2008

Prezados,

estou com o virus protejaseudrive e já tentei várias ferramentas sem sucesso, inclusive meu antivirus: mcafee. Se alguém puder me ajudar, eu agradeço. Tenho sistema Vista. coloco abaixo o log que recebi do aplicativo hijackthis.

Muito obrigado,

Ricardo

Logfile of HijackThis v1.99.1

Scan saved at 17:18:23, on 05/07/2008

Platform: Unknown Windows (WinNT 6.00.1905 SP1)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Windows\system32\taskeng.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\SiteAdvisor\6261\SiteAdv.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\sprscore.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\System32\wpcumi.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\BitComet\BitComet.exe

C:\Windows\System32\rundll32.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\rundys32.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\Macromed\Flash\FlashUtil9c.exe

C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

C:\Windows\system32\rundll32.exe

C:\Windows\System32\mobsync.exe

C:\Windows\explorer.exe

c:\PROGRA~1\mcafee\msc\mcuimgr.exe

C:\Windows\system32\rundll32.exe

C:\Downloads\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [siteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [stezinit] C:\Windows\sprscore.exe

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [bitComet] "C:\Program Files\BitComet\BitComet.exe" /tray

O4 - HKCU\..\Run: [bM5d8c7c2a] Rundll32.exe "C:\Users\ADMINI~1\AppData\Local\Temp\lqykkvrs.dll",s

O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ADMINI~1\AppData\Local\Temp\xxyxWMeF.dll,c

O4 - HKCU\..\Run: [5ebf4fb6] rundll32.exe "C:\Users\ADMINI~1\AppData\Local\Temp\vemcbmjt.dll",b

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O23 - Service: McAfee Application Installer Cleanup (0284201214096102) (0284201214096102mcinstcleanup) - - (no file)

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Serviço SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Silas Martins · Julho 6, 2008

Baixe o ComboFix e salve na área de trabalho.

Feche todos os programas.

Clique duas vezes sobre combofix.exe e tecle (1) logo após aperte Enter para continuar.

O ComboFix irá reiniciar seu computador automaticamente, isto faz parte do processo de remoção.

Ao se encerrar, será gerado um log, que vai estar em C:\ComboFix.txt.

Atenção:

Não clique em nada enquanto o Combofix estiver rodando, Do contrário seu desktop ficará em branco.

Para parar o processo ou sair do ComboFix, tecle "2" e Enter.

Aguardo um novo log do HijackThis juntamente com o ComboFix.txt

rfsm · Julho 6, 2008

Prezado Sr. Silas,

Executei o procedimento conforme sua orientação. Segue abaixo a listagem de hijackthis.txt e combofix.txt.

Aguardo instruções.

atenciosamente,

Ricardo

ComboFix 08-07-05.1 - administrador 2008-07-05 23:35:01.1 - NTFSx86

Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.1932 [GMT -3:00]

Running from: C:\Users\administrador\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Users\administrador\AppData\Roaming\inst.exe

C:\Windows\system32\x64

.

((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 )))))))))))))))))))))))))))))))

.

2008-07-02 12:59 . 2008-07-02 12:59 <DIR> d-------- C:\Users\Ana Cecilia\AppData\Roaming\Talkback

2008-06-28 06:45 . 2008-06-28 09:24 <DIR> d-------- C:\SDAT

2008-06-27 17:49 . 2006-12-12 10:04 163,840 --a------ C:\Windows\System32\igfxres.dll

2008-06-23 15:07 . 2008-07-02 10:48 <DIR> dr------- C:\Users\Ana Cecilia\Documents

2008-06-22 22:05 . 2008-06-22 22:23 <DIR> d-------- C:\VundoFix Backups

2008-06-22 21:24 . 2008-06-22 21:24 524,288 --ahs---- C:\ntuser.dat{9cd7b3c0-4086-11dd-ba02-00188bdef1c0}.TMContainer00000000000000000002.regtrans-ms

2008-06-22 21:24 . 2008-06-22 22:51 524,288 --ahs---- C:\ntuser.dat{9cd7b3c0-4086-11dd-ba02-00188bdef1c0}.TMContainer00000000000000000001.regtrans-ms

2008-06-22 21:24 . 2008-06-22 21:24 524,288 --ahs---- C:\ntuser.dat{9cd7b3bc-4086-11dd-ba02-00188bdef1c0}.TMContainer00000000000000000002.regtrans-ms

2008-06-22 21:24 . 2008-06-22 21:24 524,288 --ahs---- C:\ntuser.dat{9cd7b3bc-4086-11dd-ba02-00188bdef1c0}.TMContainer00000000000000000001.regtrans-ms

2008-06-22 21:24 . 2008-06-22 22:42 262,144 --a------ C:\ntuser.dat

2008-06-22 21:24 . 2008-06-22 22:51 65,536 --ahs---- C:\ntuser.dat{9cd7b3c0-4086-11dd-ba02-00188bdef1c0}.TM.blf

2008-06-22 21:24 . 2008-06-22 21:24 65,536 --ahs---- C:\ntuser.dat{9cd7b3bc-4086-11dd-ba02-00188bdef1c0}.TM.blf

2008-06-22 21:24 . 2008-06-22 22:42 5,120 --ah----- C:\ntuser.dat.LOG1

2008-06-22 21:24 . 2008-06-22 21:24 0 --ah----- C:\ntuser.dat.LOG2

2008-06-21 23:42 . 2008-06-21 23:42 <DIR> d-------- C:\Users\All Users\WindowsSearch

2008-06-21 23:42 . 2008-06-21 23:42 <DIR> d-------- C:\ProgramData\WindowsSearch

2008-06-21 23:03 . 2008-06-21 23:03 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2008-06-21 22:33 . 2008-06-27 15:38 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy

2008-06-21 22:33 . 2008-06-27 15:38 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy

2008-06-21 22:33 . 2008-06-27 15:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy

2008-06-21 20:39 . 2008-06-21 20:39 <DIR> d-------- C:\PerfLogs

2008-06-21 10:43 . 2008-06-21 10:44 <DIR> d-------- C:\Users\Public\fotos ana 21.06.08

2008-06-17 17:35 . 2008-06-17 17:35 <DIR> d-------- C:\Meus documentos WebEx

2008-06-17 17:17 . 2008-06-17 17:17 <DIR> d-------- C:\Users\Ana Cecilia\WebEx

2008-06-17 17:17 . 2008-06-17 17:18 <DIR> d-------- C:\Users\Ana Cecilia\AppData\Roaming\webex

2008-06-17 17:17 . 2008-06-17 17:17 <DIR> d-------- C:\Users\All Users\WebEx

2008-06-17 17:17 . 2008-06-17 17:17 <DIR> d-------- C:\ProgramData\WebEx

2008-06-15 19:05 . 2008-06-15 19:05 <DIR> d-------- C:\Users\Ana Cecilia\AppData\Roaming\Nero

2008-06-15 14:05 . 2008-06-15 14:05 <DIR> d-------- C:\Users\administrador\AppData\Roaming\Talkback

2008-06-15 12:12 . 2008-06-15 12:12 <DIR> d-------- C:\Users\Eduardo\AppData\Roaming\Nero

2008-06-15 10:40 . 2008-06-15 10:40 <DIR> d-------- C:\Users\Pedro\AppData\Roaming\Talkback

2008-06-15 10:34 . 2008-06-15 10:34 <DIR> d-------- C:\Users\Pedro\AppData\Roaming\Nero

2008-06-15 08:53 . 2008-06-15 08:53 <DIR> d-------- C:\Users\Carolina\AppData\Roaming\Talkback

2008-06-15 08:51 . 2008-06-15 08:51 <DIR> d-------- C:\Users\Carolina\AppData\Roaming\Nero

2008-06-14 22:05 . 2008-06-14 22:05 <DIR> d-------- C:\Program Files\NeroInstall.bak

2008-06-14 21:54 . 2008-06-14 21:54 <DIR> d-------- C:\Users\administrador\AppData\Roaming\Nero

2008-06-14 21:52 . 2008-04-23 01:42 428,544 --a------ C:\Windows\System32\EncDec.dll

2008-06-14 21:52 . 2008-04-23 01:42 293,376 --a------ C:\Windows\System32\psisdecd.dll

2008-06-14 21:52 . 2008-04-23 01:41 218,624 --a------ C:\Windows\System32\psisrndr.ax

2008-06-14 21:52 . 2008-01-19 04:33 80,896 --a------ C:\Windows\System32\MSNP.ax

2008-06-14 21:52 . 2008-01-19 04:33 69,632 --a------ C:\Windows\System32\Mpeg2Data.ax

2008-06-14 21:52 . 2008-04-23 01:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax

2008-06-14 21:39 . 2008-06-14 21:39 <DIR> d-------- C:\Users\All Users\Nero

2008-06-14 21:39 . 2008-06-14 21:39 <DIR> d-------- C:\ProgramData\Nero

2008-06-14 21:39 . 2008-06-14 21:39 <DIR> d-------- C:\Program Files\Nero

2008-06-14 21:39 . 2008-06-14 21:47 <DIR> d-------- C:\Program Files\Common Files\Nero

2008-06-14 21:16 . 2008-06-14 21:16 <DIR> d-------- C:\Windows\Mozilla

2008-06-14 21:16 . 2008-06-14 21:16 0 --a------ C:\Windows\nsreg.dat

2008-06-14 21:05 . 2008-06-14 21:05 <DIR> d-------- C:\Program Files\MediaCoder

2008-06-10 21:10 . 2008-04-24 23:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb

2008-06-10 21:10 . 2008-04-25 01:35 826,880 --a------ C:\Windows\System32\wininet.dll

2008-06-10 19:39 . 2008-04-26 05:08 1,314,816 --a------ C:\Windows\System32\quartz.dll

2008-06-10 19:27 . 2008-05-09 22:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys

2008-06-08 22:59 . 2008-06-08 23:48 <DIR> d-------- C:\Users\administrador\AppData\Roaming\Vso

2008-06-08 22:59 . 2008-06-08 22:59 <DIR> d-------- C:\Program Files\DVDFab 5

2008-06-08 22:59 . 2008-06-08 22:59 47,360 --a------ C:\Windows\System32\drivers\pcouffin.sys

2008-06-08 22:59 . 2008-06-08 22:59 47,360 --a------ C:\Users\administrador\AppData\Roaming\pcouffin.sys

2008-06-08 22:32 . 2008-06-08 22:32 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

2008-06-08 22:31 . 2000-06-22 13:49 842,240 --a------ C:\Windows\System32\ir414422.rra

2008-06-08 22:31 . 2000-06-23 10:36 745,984 --a------ C:\Windows\System32\ir504931.rra

2008-06-08 22:31 . 2000-06-26 11:57 202,240 --a------ C:\Windows\System32\ir324615.rra

2008-06-08 22:31 . 2000-06-23 14:06 192,000 --a------ C:\Windows\System32\iac2470f.rra

2008-06-08 22:31 . 2000-06-22 18:11 145,408 --a------ C:\Windows\System32\Ivfs4a2a.rra

2008-06-08 22:27 . 2008-06-08 22:27 <DIR> d-------- C:\Program Files\LucasArts

2008-06-07 19:32 . 2008-06-30 22:10 <DIR> d-------- C:\Users\administrador\AppData\Roaming\skypePM

2008-06-07 19:32 . 2008-06-07 19:32 32 --a------ C:\Users\All Users\ezsid.dat

2008-06-07 19:32 . 2008-06-07 19:32 32 --a------ C:\ProgramData\ezsid.dat

2008-06-07 19:12 . 2008-06-07 19:12 <DIR> d-------- C:\Program Files\Common Files\Skype

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-05 11:07 --------- d-----w C:\Program Files\McAfee

2008-07-01 02:34 --------- d-----w C:\Users\administrador\AppData\Roaming\Skype

2008-06-26 14:46 --------- d-----w C:\Users\administrador\AppData\Roaming\SiteAdvisor

2008-06-22 10:08 --------- d-----w C:\Users\administrador\AppData\Roaming\D-Link Media Server

2008-06-22 01:08 --------- d-----w C:\ProgramData\McAfee

2008-06-22 01:01 --------- d-----w C:\Program Files\SiteAdvisor

2008-06-21 23:56 174 --sha-w C:\Program Files\desktop.ini

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Sidebar

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Mail

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Journal

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Defender

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Collaboration

2008-06-21 23:44 --------- d-----w C:\Program Files\Windows Calendar

2008-06-21 23:01 82,432 ----a-w C:\Windows\System32\axaltocm.dll

2008-06-21 23:01 101,888 ----a-w C:\Windows\System32\ifxcardm.dll

2008-06-19 22:51 --------- d-----w C:\Users\Pedro\AppData\Roaming\SiteAdvisor

2008-06-09 01:28 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-06-07 22:37 --------- d-----w C:\ProgramData\DVD Shrink

2008-06-07 22:12 --------- d-----w C:\ProgramData\Skype

2008-06-07 22:12 --------- d-----w C:\Program Files\Skype

2008-05-27 23:19 --------- d-----w C:\Users\Carolina\AppData\Roaming\SiteAdvisor

2008-05-26 01:21 --------- d-----w C:\Program Files\BitLocker

2008-05-26 01:18 --------- d-----w C:\Program Files\Microsoft Games

2008-05-26 01:17 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-05-21 18:07 --------- d-----w C:\Users\Ana Cecilia\AppData\Roaming\SiteAdvisor

2008-05-15 06:07 --------- d-----w C:\ProgramData\Microsoft Help

2008-04-11 20:23 38,400 ----a-w C:\Windows\System32\SoundSchemes.exe

2008-02-27 15:22 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-02-27 15:22 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-02-27 15:22 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 04:33 1233920]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 04:33 125952]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 04:33 202240]

"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-03-27 04:06 7092024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-12-12 10:02 98304]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2006-12-12 10:03 106496]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2006-12-12 10:02 81920]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]

"stezinit"="C:\Windows\sprscore.exe" [2007-04-22 12:38 724992]

"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]

"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 09:33 176128]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-03-13 15:42 73728]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-03-13 15:42 8425472]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-03-13 15:42 81920]

C:\Users\Ana Cecilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [8/24/2007 4:45:42 AM 101784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLinkedConnections"= 1 (0x1)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"LogonHoursAction"= 2 (0x2)

"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Planner Reminders Tray Icon.lnk]

backup=C:\Windows\pss\Event Planner Reminders Tray Icon.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^administrador^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^D-Link Media Server.lnk]

backup=C:\Windows\pss\D-Link Media Server.lnk.Startup

backupExtension=.Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\5ebf4fb6

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM5d8c7c2a

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]

--a------ 2008-03-27 04:06 7092024 C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

--a------ 2008-02-28 17:07 1828136 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]

--a------ 2007-08-03 22:33 582992 C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McENUI]

--a------ 2007-11-30 05:42 1164576 C:\PROGRA~1\McAfee\MHN\McENUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]

--a------ 2008-02-18 16:29 2221352 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]

--a------ 2007-02-09 14:18 36904 C:\Program Files\SiteAdvisor\6261\SiteAdv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2008-02-01 17:22 21898024 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"TCP Query User{509CDB8A-E5C5-4417-B030-5D4F77F649DA}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{C916445A-A2E1-485F-9B3F-FA79E6344074}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"{F8A21B42-5653-4AE6-9798-407DF8B97686}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent

"{FA1320AA-C7A9-4FD4-A723-45CF7DAB2B93}"= TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent

"{97B09293-C71A-4D38-836F-E2285D69B10C}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{79E8AE58-C6C1-4959-8F5E-83C79569A954}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{E4C3E3C2-1E6F-4A98-B5B3-855D5208C33C}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{8477D68D-E84B-4D13-A323-FCBA534D928A}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove

"{491436DF-45C0-49B7-8670-5039A9F2878B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{77D8212F-05E9-4274-B985-650ECCC27804}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{2C3306B6-DCF7-4055-94C3-A5E7110A6CC3}"= UDP:18444:BitComet 18444 TCP

"{06708002-746F-4DF8-9C8F-E6D2FF12FC82}"= TCP:18444:BitComet 18444 UDP

"{FA16A787-E957-460B-8EE1-9AE9FF8B79F7}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{6E5F5096-8658-4DF1-A0BB-7C8BBDDEEAD4}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R3 b57nd60x;%SvcDispName%;C:\Windows\system32\DRIVERS\b57nd60x.sys [2008-01-19 01:25]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

GPSvcGroup REG_MULTI_SZ GPSvc

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]

%SystemRoot%\system32\soundschemes.exe /AddRegistration

.

Contents of the 'Scheduled Tasks' folder

"2008-05-15 13:09:59 C:\Windows\Tasks\McDefragTask.job"

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'

"2008-06-01 04:00:55 C:\Windows\Tasks\McQcTask.job"

- c:\program files\mcafee\mqc\QcConsol.exe

"2008-07-05 19:26:36 C:\Windows\Tasks\User_Feed_Synchronization-{FF3AAD01-EFCD-43F8-B8EE-C6FC21507060}.job"

- C:\Windows\system32\msfeedssync.exe

.

- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{b75ab0c8-03d5-4592-9821-a48d54d66b14} - MssShellExt.dll

MSConfigStartUp-SpybotSD TeaTimer - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-05 23:39:34

Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-07-05 23:42:04

ComboFix-quarantined-files.txt 2008-07-06 02:42:01

Pre-Run: 99,092,213,760 bytes free

Post-Run: 99,244,834,816 bytes free

230 --- E O F --- 2008-06-25 06:00:35

Logfile of HijackThis v1.99.1

Scan saved at 23:45:36, on 05/07/2008

Platform: Unknown Windows (WinNT 6.00.1905 SP1)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\System32\mobsync.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\sprscore.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\wpcumi.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\rundys32.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

c:\PROGRA~1\mcafee\msc\mcuimgr.exe

C:\Program Files\SiteAdvisor\6261\SiteAdv.exe

C:\Windows\Explorer.exe

C:\Downloads\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll