[Resolvido!] seg o log do hijack

HTR · Julho 20, 2008

Galera...eu estou com esse malware, não sei oque ele faz, mas o fato dele estar na minha maquina me encomoda...

espero que possam me ajudar, vi um topico parecido...mais resolvi postar o meu proprio para verificar se ah mais algum problema...

seg o log do hijack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:28:58, on 20/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll

O4 - HKLM\..\Run: [bootSkin Startup Jobs] "C:\ARQUIV~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [LogonStudio] "C:\Arquivos de programas\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{B780AFBB-D844-4C7E-8263-1E8F0D867FAA}: NameServer = 200.204.0.10 200.204.0.138

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

--

End of file - 4746 bytes

DigRam · Julho 21, 2008

Boa Noite! HTR

<@> Faça o download do ComboFix.

<@> Baixe-o para o Desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e Firewall.

<@> Feche todas as janelas e execute a ferramenta!

Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
Salve-a no Desktop,renomeada como: Kombo.exe

Ps: Nomeie durante o salvamento,e não após salvá-la!

Ps: Caso ocorra alguma mensagem de erro,rode o ComboFix em Modo de Segurança.

<@> Abrirá a janela Auto Scan. Aguarde!

<@> Digite a opção para continuar e < Enter >

<@> Aguarde a conclusão! Durante o scan,evite tocar no mouse ou teclado!

<@> Para parar ou sair do ComboFix,tecle "N".

-------------------------------------

<@> Poste o relatório: C:\ComboFix.txt,na sua resposta + Log do HJT,atualizado.

Abraços!

HTR · Julho 21, 2008

ComboFix 08-07-20.5 - HTR 2008-07-21 4:14:26.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.636 [GMT -3:00]

Executando de: C:\Documents and Settings\HTR\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\Documents and Settings\All Users\Documentos\Stardock\WindowBlinds\FROIS-01\_desktop.ini

C:\WINDOWS\system32\28463

C:\WINDOWS\system32\28463\AKV.exe

C:\WINDOWS\system32\28463\LFXH.001

C:\WINDOWS\system32\28463\LFXH.002

C:\WINDOWS\system32\28463\LFXH.005

C:\WINDOWS\system32\28463\LFXH.006

C:\WINDOWS\system32\28463\LFXH.007

C:\WINDOWS\system32\28463\LFXH.009

C:\WINDOWS\system32\28463\LFXH.exe

C:\WINDOWS\system32\ckvo0.dll

D:\Autorun.inf

.

((((((((((((((((((((((( Ficheiros criados de 2008-06-21 to 2008-07-21 ))))))))))))))))))))))))))))))))

.

2008-07-21 01:11 . 2008-07-21 01:11 <DIR> d-------- C:\Arquivos de programas\Total Video Converter

2008-07-21 00:46 . 2005-02-01 13:20 5,760,056 --a------ C:\WINDOWS\Darkstar.bmp

2008-07-20 18:28 . 2008-07-20 18:28 <DIR> d-------- C:\Arquivos de programas\Trend Micro

2008-07-20 18:23 . 2008-07-20 18:23 <DIR> d-------- C:\Hijack

2008-07-20 17:42 . 2008-07-21 04:09 69 --a------ C:\WINDOWS\NeroDigital.ini

2008-07-20 17:39 . 2008-07-20 17:39 <DIR> d-------- C:\Documents and Settings\HTR\Dados de aplicativos\Ahead

2008-07-20 17:38 . 2008-07-20 17:38 <DIR> d-------- C:\Documents and Settings\HTR\Dados de aplicativos\CyberLink

2008-07-20 17:38 . 2008-07-20 17:38 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2008-07-20 17:38 . 2008-07-20 17:38 <DIR> d-------- C:\Arquivos de programas\Nero

2008-07-20 17:38 . 2008-07-20 17:39 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Ahead

2008-07-20 17:37 . 2008-07-20 17:37 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\CyberLink

2008-07-20 17:35 . 2008-07-20 17:36 <DIR> d-------- C:\Arquivos de programas\CyberLink

2008-07-20 17:35 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll

2008-07-20 15:20 . 2008-07-20 15:20 0 --a------ C:\WINDOWS\WB.ini

2008-07-20 15:13 . 2008-07-20 15:13 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE

2008-07-20 04:12 . 2008-07-21 01:03 <DIR> d-------- C:\downloads

2008-07-20 04:12 . 2008-07-21 04:16 <DIR> d-------- C:\Documents and Settings\HTR\Dados de aplicativos\Orbit

2008-07-20 04:12 . 2008-07-20 04:12 <DIR> d-------- C:\Documents and Settings\HTR\Dados de aplicativos\GrabPro

2008-07-20 04:12 . 2008-07-20 18:26 <DIR> d-------- C:\Arquivos de programas\Orbitdownloader

2008-07-20 03:40 . 2008-07-20 03:40 <DIR> d-------- C:\Documents and Settings\HTR\Dados de aplicativos\Media Player Classic

2008-07-20 03:32 . 2007-09-04 13:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll

2008-07-20 03:22 . 2008-07-04 03:34 860,160 --a------ C:\WINDOWS\system32\lameACM.acm

2008-07-20 03:22 . 2008-01-10 09:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll

2008-07-20 03:22 . 2004-01-25 13:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll

2008-07-20 03:22 . 2008-01-10 09:16 159,839 --a------ C:\WINDOWS\system32\xvidvfw.dll

2008-07-20 03:22 . 2007-09-20 21:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm

2008-07-20 03:22 . 2007-10-03 12:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml

2008-07-20 03:20 . 2008-05-22 19:22 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll

2008-07-20 03:19 . 2008-05-30 20:22 683,520 --a------ C:\WINDOWS\system32\divx.dll

2008-07-20 03:19 . 2008-05-22 19:19 81,920 --a------ C:\WINDOWS\system32\dpl100.dll

2008-07-20 03:14 . 2008-06-12 15:36 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll

2008-07-20 03:14 . 2007-07-10 13:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest

2008-07-20 03:13 . 2003-03-19 00:14 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll

2008-07-20 03:13 . 2004-01-11 19:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll

2008-07-20 03:12 . 2008-07-20 03:22 <DIR> d-------- C:\Arquivos de programas\K-Lite Codec Pack

2008-07-18 13:25 . 2008-07-21 04:16 24 --a------ C:\WINDOWS\LogonStudio.ini

2008-07-18 13:23 . 2008-07-18 13:23 <DIR> d-------- C:\Arquivos de programas\WinCustomize

2008-07-18 13:23 . 2000-10-10 13:01 198,656 --a------ C:\WINDOWS\system32\comdlg32.ocx

2008-07-18 13:23 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll

2008-07-18 00:07 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

2008-07-18 00:07 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll

2008-07-18 00:07 . 2008-07-18 00:07 120,251 -r-hs---- C:\ivcvknr.bat

2008-07-18 00:07 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui

2008-07-17 20:48 . 2008-07-17 20:48 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\NVIDIA

2008-07-17 03:11 . 2008-06-14 14:59 272,384 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-07-17 03:11 . 2008-06-14 14:59 272,384 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-07-17 03:04 . 2008-07-20 15:49 <DIR> d-------- C:\Documents and Settings\HTR\Dados de aplicativos\Tibia

2008-07-17 03:04 . 2008-07-17 03:04 <DIR> d-------- C:\Arquivos de programas\Tibia

2008-07-17 03:00 . 2008-07-19 18:45 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2008-07-17 02:48 . 2008-07-17 02:48 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2008-07-17 02:48 . 2008-07-17 02:48 <DIR> d-------- C:\Documents and Settings\HTR\Contacts

2008-07-17 02:29 . 2008-07-17 02:31 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-07-17 02:29 . 2008-07-17 02:48 <DIR> d-------- C:\Arquivos de programas\Windows Live

2008-07-17 02:29 . 2008-07-17 02:37 <DIR> d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-07-17 02:23 . 2008-07-17 02:23 0 --a------ C:\WINDOWS\nsreg.dat

2008-07-17 02:16 . 2008-07-17 02:16 <DIR> d---s---- C:\Documents and Settings\HTR\UserData

2008-07-17 01:54 . 2008-07-20 15:15 <DIR> d-------- C:\Arquivos de programas\Stardock

2008-07-17 01:54 . 2008-07-18 14:41 162,432 --a------ C:\WINDOWS\system32\drivers\vidstub.sys

2008-07-17 01:30 . 2008-07-17 01:30 <DIR> d-------- C:\WINDOWS\system32\Lang

2008-07-17 01:30 . 2008-07-17 01:30 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav

2008-07-17 01:30 . 2008-07-17 01:30 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav

2008-07-17 01:27 . 2008-07-21 00:46 3,932,214 --a------ C:\WINDOWS\AW_XenoMorph1280.bmp

2008-07-17 01:26 . 2008-07-17 01:54 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Stardock

2008-07-17 01:26 . 2008-07-21 00:46 <DIR> d-------- C:\Arquivos de programas\AlienGUIse

2008-07-17 01:26 . 2008-07-17 01:26 115,233 -r-hs---- C:\p83gjy.exe

2008-07-17 01:26 . 2008-07-20 17:42 77,312 --------- C:\WINDOWS\system32\ckvo1.dll

2008-07-17 01:26 . 2008-04-26 16:14 42,672 --------- C:\WINDOWS\system32\wbsys.dll

2008-07-17 01:25 . 2008-07-16 13:09 117,001 -r-hs---- C:\33gmhso.bat

2008-07-17 01:22 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

2008-07-17 01:09 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll

2008-07-17 01:03 . 2008-07-17 01:03 <DIR> d-------- C:\WINDOWS\SHELLNEW

2008-07-17 01:03 . 2008-07-19 18:38 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2008-07-17 01:02 . 2008-07-17 01:02 <DIR> dr-h----- C:\MSOCache

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-20 20:36 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-07-20 20:35 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2008-07-18 16:25 6,581,248 ----a-w C:\WINDOWS\system32\logonuiX.exe

2008-07-17 03:37 315,392 ----a-w C:\WINDOWS\HideWin.exe

2008-07-17 03:37 --------- d-----w C:\Arquivos de programas\Realtek

2008-07-17 03:26 --------- d-----w C:\Arquivos de programas\microsoft frontpage

2008-07-17 03:25 --------- d-----w C:\Arquivos de programas\Serviços on-line

2008-07-17 03:24 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Serviços

2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll

2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys

2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys

2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys

2008-05-07 05:15 1,292,288 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-21 07:02 661,504 ----a-w C:\WINDOWS\system32\wininet.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BootSkin Startup Jobs"="C:\ARQUIV~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" [2004-03-24 13:37 262144]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-16 04:35 7630848]

"LogonStudio"="C:\Arquivos de programas\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38 987187]

"RemoteControl"="C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]

"LanguageShortcut"="C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]

"SecurDisc"="C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe" [2007-02-12 12:23 1620480]

"InCD"="C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe" [2007-02-12 12:19 1050112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

C:\Documents and Settings\HTR\Menu Iniciar\Programas\Inicializar\

Alienware Dock.lnk - C:\Arquivos de programas\AlienGUIse\AlienwareDock\ObjectDock.exe [2008-07-21 00:44:51 2074360]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Orbit.lnk - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe [2008-07-20 04:12:06 1690824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]

2008-07-20 15:18 229376 C:\Arquivos de programas\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^HTR^Menu Iniciar^Programas^Inicializar^WinFlip.exe]

path=C:\Documents and Settings\HTR\Menu Iniciar\Programas\Inicializar\WinFlip.exe

backup=C:\WINDOWS\pss\WinFlip.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

--a------ 2006-08-16 04:35 7630848 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

--a------ 2006-08-16 04:35 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

-r------- 2005-05-03 07:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

--a------ 2006-08-16 04:35 1617920 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

-r------- 2006-12-19 00:12 16062464 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

-r------- 2006-05-16 07:04 2879488 C:\WINDOWS\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=

"C:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8991152-5687-11dd-acee-001bb98adc89}]

\Shell\AutoRun\command - ybj8df.exe

\Shell\explore\Command - ybj8df.exe

\Shell\open\Command - ybj8df.exe

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe

HKLM-Run-LFXH Agent - C:\WINDOWS\system32\28463\LFXH.exe

MSConfigStartUp-kamsoft - C:\WINDOWS\system32\ckvo.exe

MSConfigStartUp-LFXH Agent - C:\WINDOWS\system32\28463\LFXH.exe

.

------- Supplementary Scan -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.google.com.br/

O8 -: &Download by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 -: &Grab video by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 -: Do&wnload selected by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 -: Down&load all by Orbit - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-21 04:16:33

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\wdfmgr.exe

.

**************************************************************************

.

Tempo para conclusÆo: 2008-07-21 4:17:29 - machine was rebooted

ComboFix-quarantined-files.txt 2008-07-21 07:17:27

Pre-Run: 7 pasta(s) 24,170,246,144 bytes disponíveis

Post-Run: 10 pasta(s) 24,483,135,488 bytes dispon¡veis

213 --- E O F --- 2008-07-19 22:04:38

_______________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 04:18:44, on 21/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\AlienGUIse\AlienwareDock\ObjectDock.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896