[Resolvido!] Malware CiD

ptonella · Setembro 8, 2008

Oi.

O tal do CID também anda me infernizando, toda hora abre uma pop-up de ringtones, mercado livre...

Ajuda, por favor!

O Hijackthis me mostrou essa mensagem antes de fazer dar o log:

An unexpected error has occurred at procedure: modMain_CheckOther1Item()

Error #75 - Path/File access error

Please email me at merijn@spywareinfo.com, reporting the following:

* What you were trying to fix when the error occurred, if applicable

* How you can reproduce the error

* A complete HijackThis scan log, if possible

Windows version: Windows NT 6.00.1904

MSIE version: 7.0.6000.16711

HijackThis version: 1.99.1

This message has been copied to your clipboard.

Click OK to continue the rest of the scan.

Logfile of HijackThis v1.99.1

Scan saved at 19:47:34, on 08/09/2008

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16711)

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Java\jre1.6.0\bin\jusched.exe

C:\Windows\sttray.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Mx One\mogtr.exe

C:\Program Files\Panda Security\Panda Antivirus 2008\ApVxdWin.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Panda Security\Panda Antivirus 2008\WebProxy.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\iTunes\iTunes.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Users\Pati\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.la.dell.com/content/default.as...;l=pt&s=gen

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fornecido por Dell

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\BR\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=052607 serial=DR12CRS-1736730-ynq lang=BP

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Mx_One_Guardian_Tiempo_Real] C:\Program Files\Mx One\mogtr.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus 2008\APVXDWIN.EXE" /s

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [uTorrent] "C:\Users\Pati\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [proc drive] "C:\ProgramData\draw dumb dumb.rdplk"

O4 - HKCU\..\Run: [Army browse cdrom vga] "C:\ProgramData\Owns Blah Mix.ljvqyep"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O15 - Trusted Zone: http://s4.travian.pt

O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.33/g_bin/eng/roulette_2_0_0_27.cab

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://www.atrativa.com.br/games/applets/g...bugs/axhost.cab

O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.33/g_bin/eng/marbles_2_0_0_32.cab

O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://67.15.101.33/g_bin/eng/darts_2_0_0_42.cab

O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.33/g_bin/eng/words_2_0_0_51.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.atrativa.com.br/games/applets/p...opcaploader.cab

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: avldr - C:\Windows\SYSTEM32\avldr.dll

O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll

O23 - Service: McAfee Application Installer Cleanup (0270271192582006) (0270271192582006mcinstcleanup) - Unknown owner - C:\Users\Pati\AppData\Local\Temp\027027~1.EXE (file missing)

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Serviço iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\PsCtrls.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\pavsrvx86.exe

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\PsImSvc.exe

O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus 2008\PskSvc.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe

O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

jgarcia · Setembro 9, 2008

Opa ptonella,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

Abraços.

ptonella · Setembro 9, 2008

Olá.

Correu tudo certo, até o momento que o ComboFix gerou o log... depois disso ele parou de funcionar, se fechou, a única coisa que aparececia era o bloco de notas com as informações do escaneamento. Fechei o bloco de notas, e a tela estava toda preta. Dei crtl+alt+del e reiniciei o computador.

Quando o computador reiniciou, apareceu na tela esse arquivo:

"draw dumb dumb.rdplk" e o windows me perguntou como eu gostaria de abri-lo, com algum programa que eu já possuo, ou procurando na net...

E o SpyBot me pediu várias autorizações, tive que desliga-lo...

:wacko:

ComboFix 08-09-05.10 - Pati 2008-09-08 22:34:37.1 - NTFSx86

Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1046.18.318 [GMT -3:00]

Executando de: C:\Users\Pati\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat

C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat

C:\Windows\system32\x64

----- BITS: Sites possivelmente infetados -----

http://au.download.winj+|Cv+@J:NGD_DQ{zZOmOezO@WU Client DownloadS-1-5-18@x`l@\???? 6VwoQZCDHM6VwoQZCDHMXu r0 r0 r0000oWvZOmOGD_DQ{zGD_DQ{zGD_DQ{z+@J:Nj+|Cvte.com

.

((((((((((((((((((((((( Ficheiros criados de 2008-08-09 to 2008-09-09 ))))))))))))))))))))))))))))))))

.

Nenhum ficheiro/arquivo criado durante este período

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-09 00:57 --------- d-----w C:\Program Files\Mx One

2008-09-09 00:20 --------- d-----w C:\Users\Pati\AppData\Roaming\uTorrent

2008-09-08 23:28 --------- d-----w C:\ProgramData\Spybot - Search & Destroy

2008-09-08 23:18 --------- d-----w C:\Program Files\CCleaner

2008-09-08 22:40 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-09-08 22:38 --------- d-----w C:\Users\Pati\AppData\Roaming\Skype

2008-09-08 19:03 --------- d-----w C:\Users\Pati\AppData\Roaming\skypePM

2008-09-08 02:24 --------- d-----w C:\Program Files\Megacubo

2008-09-07 23:35 --------- d-----w C:\Users\Pati\AppData\Roaming\Megacubo

2008-09-07 22:12 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-09-07 20:18 --------- d-----w C:\Program Files\Windows Live

2008-09-07 20:14 --------- d-----w C:\ProgramData\WLInstaller

2008-09-06 01:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-09-06 00:46 --------- d-----w C:\Program Files\Panda Security

2008-09-05 17:12 --------- d-----w C:\ProgramData\Avira

2008-09-05 02:18 --------- d-----w C:\ProgramData\sentinel

2008-09-04 23:46 --------- d-----w C:\Program Files\Common Files\Panda Software

2008-09-04 02:02 --------- d-----w C:\Program Files\Microsoft Windows OneCare Live

2008-09-04 01:26 --------- d-----w C:\ProgramData\bird online bind

2008-09-03 02:34 --------- d-----w C:\Program Files\Common Files\PX Storage Engine

2008-09-03 01:52 --------- d-----w C:\Program Files\IObit

2008-09-03 01:23 --------- d-----w C:\ProgramData\Mfcd upload army browse

2008-08-31 15:58 --------- d-----w C:\Users\Pati\AppData\Roaming\NCH Swift Sound

2008-08-31 15:58 --------- d-----w C:\Program Files\NCH Swift Sound

2008-08-30 18:05 --------- d-----w C:\ProgramData\NCH Swift Sound

2008-08-30 18:04 --------- d-----w C:\Users\Pati\AppData\Roaming\Recordpad

2008-08-30 18:04 --------- d-----w C:\Program Files\NCH Software

2008-08-28 02:39 --------- d-----w C:\Program Files\SopCast

2008-08-23 21:36 --------- d-----w C:\Program Files\Encore DEMO

2008-08-20 02:22 56 ---ha-w C:\Users\All Users\ezsidmv.dat

2008-08-20 02:22 56 ---ha-w C:\ProgramData\ezsidmv.dat

2008-08-20 02:19 --------- d-----w C:\ProgramData\Skype

2008-08-20 02:19 --------- d-----w C:\Program Files\Skype

2008-08-20 02:19 --------- d-----w C:\Program Files\Common Files\Skype

2008-08-16 18:24 --------- d-----w C:\ProgramData\Nero

2008-08-16 18:24 --------- d-----w C:\Program Files\Common Files\Nero

2008-08-15 13:32 --------- d-----w C:\ProgramData\Microsoft Help

2008-08-15 13:28 --------- d-----w C:\Program Files\Windows Mail

2008-08-08 01:33 --------- d-----w C:\Users\Pati\AppData\Roaming\NCH Software

2008-07-28 02:16 --------- d-----w C:\Users\Pati\AppData\Roaming\Nero

2008-07-28 02:11 --------- d-----w C:\Program Files\Nero

2008-07-27 18:30 --------- d-----w C:\Program Files\Common Files\Adobe

2008-07-27 18:30 --------- d-----w C:\Program Files\Bonjour

2008-07-27 18:12 --------- d-----w C:\Program Files\Common Files\Macrovision Shared

2008-07-27 16:57 --------- d-----w C:\Program Files\Google

2008-07-27 16:52 --------- d-----w C:\Program Files\Photo Recovery Wizard

2008-07-27 16:34 --------- d-----w C:\Users\Pati\AppData\Roaming\LimeWire

2008-07-25 00:14 --------- d-----w C:\Program Files\Apple Software Update

2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe

2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll

2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll

2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll

2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll

2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll

2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll

2008-07-19 01:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll

2008-07-18 23:44 31,232 ----a-w C:\Windows\System32\wuapp.exe

2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll

2008-07-10 12:20 174 --sha-w C:\Program Files\desktop.ini

2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll

2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll

2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll

2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe

2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll

2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll

2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll

2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL

2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll

2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll

2008-03-14 23:28 32 ----a-w C:\Users\All Users\ezsid.dat

2008-03-14 23:28 32 ----a-w C:\ProgramData\ezsid.dat

2007-05-06 18:13 0 ----a-w C:\Users\Pati\AppData\Roaming\wklnhst.dat

2008-04-24 12:43 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-04-24 12:43 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-04-24 12:43 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias & legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"proc drive"="C:\ProgramData\draw dumb dumb.rdplk" [X]

"Army browse cdrom vga"="C:\ProgramData\Owns Blah Mix.ljvqyep" [X]

"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 167368]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-14 1232896]

"uTorrent"="C:\Users\Pati\Program Files\uTorrent\uTorrent.exe" [2008-08-15 267056]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-11 21741864]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Shockwave Updater"="C:\Windows\System32\Adobe\Shockwave 11\SwHelper_1100429.exe" [2008-03-19 439736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-02-09 98304]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-02-09 106496]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-02-09 81920]

"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-05-02 77824]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]

"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]

"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\BR\Programs\Registration.exe" [2003-11-28 729088]

"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 385024]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 267048]

"Mx_One_Guardian_Tiempo_Real"="C:\Program Files\Mx One\mogtr.exe" [2008-07-29 32768]

"APVXDWIN"="C:\Program Files\Panda Security\Panda Antivirus 2008\APVXDWIN.EXE" [2007-10-04 455984]

"SigmatelSysTrayApp"="sttray.exe" [2007-02-08 C:\Windows\sttray.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]

2007-02-15 19:02 50736 C:\Windows\System32\avldr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

R0 CLFS;Common Log (CLFS);C:\Windows\system32\CLFS.sys [2008-02-14 224824]

R0 Ecache;ReadyBoost Caching Driver;C:\Windows\system32\drivers\ecache.sys [2006-11-02 132200]

R0 FileInfo;File Information FS MiniFilter;C:\Windows\system32\drivers\fileinfo.sys [2006-11-02 56424]

R0 msisadrv;Driver de Classe ISA/EISA;C:\Windows\system32\drivers\msisadrv.sys [2007-05-02 13928]

R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 28544]

R0 spldr;Security Processor Loader Driver;C:\Windows\system32\drivers\spldr.sys [2006-11-02 18536]

R0 volmgr;Volume Manager Driver;C:\Windows\system32\drivers\volmgr.sys [2007-05-02 50280]

R0 volmgrx;Dynamic Volume Manager;C:\Windows\system32\drivers\volmgrx.sys [2006-11-02 290408]

R1 DfsC;Dfs Client Driver;C:\Windows\system32\Drivers\dfsc.sys [2006-11-02 74752]

R1 nsiproxy;NSI proxy service;C:\Windows\system32\drivers\nsiproxy.sys [2006-11-02 16384]

R1 RDPENCDD;RDP Encoder Mirror Driver;C:\Windows\system32\drivers\rdpencdd.sys [2006-11-02 6144]

R1 ShldDrv;Panda File Shield Driver;C:\Windows\system32\DRIVERS\ShlDrv51.sys [2007-05-23 38968]

R1 Smb;Protocolos TCP/IP e TCP/IPv6 Orientados a Mensagens (sessão SMB);C:\Windows\system32\DRIVERS\smb.sys [2006-11-02 66048]

R1 tdx;Driver de Suporte a TDI Herdado de NetIO;C:\Windows\system32\DRIVERS\tdx.sys [2006-11-02 68096]

R1 Wanarpv6;Remote Access IPv6 ARP Driver;C:\Windows\system32\DRIVERS\wanarp.sys [2008-01-14 61952]

R2 AmFSM;AmFSM;C:\Windows\system32\DRIVERS\amm8660.sys [2007-09-28 46648]

R2 AudioEndpointBuilder;Construtor de Pontos de Extremidade de Áudio do Windows;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 BFE;Mecanismo de Filtragem Básica;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 DPS;Serviço de Diretiva de Diagnóstico;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 FDResPub;Publicação de Recursos de Descoberta de Função;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 gpsvc;Cliente da Diretiva de Grupo;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 IAANTMON;Intel® Matrix Storage Event Monitor;C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2006-09-29 81920]

R2 IKEEXT;Módulos de Criação de Chaves IKE e AuthIP do IPSec;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 iphlpsvc;Auxiliar de IP;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 KtmRm;KtmRm para Coordenador de Transações Distribuídas;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver;C:\Windows\system32\DRIVERS\lltdio.sys [2006-11-02 47104]

R2 luafv;UAC File Virtualization;C:\Windows\system32\drivers\luafv.sys [2006-11-02 83456]

R2 MMCSS;Agendador de Classes de Multimídia;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 MpsSvc;Firewall do Windows;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 netprofm;Serviço da Lista de Redes;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 NlaSvc;Reconhecimento de Locais de Rede;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 nsi;Serviço de Interface de Armazenamento de Rede;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 PavProc;Panda Process Protection Driver;C:\Windows\system32\DRIVERS\PavProc.sys [2007-07-12 178872]

R2 PcaSvc;Serviço Auxiliar de Compatibilidade de Programas;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 PEAUTH;PEAUTH;C:\Windows\system32\drivers\peauth.sys [2006-11-02 878080]

R2 ProfSvc;Serviço de Perfil de Usuário;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 PskSvcRetail;Panda PSK service;C:\Program Files\Panda Security\Panda Antivirus 2008\PskSvc.exe [2007-03-21 27696]

R2 slsvc;Licenciamento de Software;C:\Windows\system32\SLsvc.exe [2008-01-14 2605568]

R2 SysMain;Superfetch;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R2 TabletInputService;Serviço de Entrada de Tablet PC;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 tcpipreg;TCP/IP Registry Compatibility;C:\Windows\system32\drivers\tcpipreg.sys [2006-11-02 27648]

R2 UxSms;Gerenciador de Sessão do Gerenciador de Janelas da Área de Trabalho;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R2 WerSvc;Serviço de Relatórios de Erro do Windows;C:\Windows\System32\svchost.exe [2006-11-02 22016]

R3 Appinfo;Informações sobre Aplicativos;C:\Windows\system32\svchost.exe [2006-11-02 22016]

R3 bowser;Bowser;C:\Windows\system32\DRIVERS\bowser.sys [2006-11-02 69632]

R3 DXGKrnl;LDDM Graphics Subsystem;C:\Windows\system32\drivers\dxgkrnl.sys [2008-01-14 619008]

R3 iScsiPrt;Driver iScsiPort;C:\Windows\system32\DRIVERS\msiscsi.sys [2006-11-02 168552]

R3 monitor;Microsoft Monitor Class Function Driver Service;C:\Windows\system32\DRIVERS\monitor.sys [2007-12-16 41984]

R3 mpsdrv;Driver de Autorização do Firewall do Windows;C:\Windows\system32\drivers\mpsdrv.sys [2008-01-14 63488]

R3 mrxsmb10;SMB 1.x MiniRedirector;C:\Windows\system32\DRIVERS\mrxsmb10.sys [2006-11-02 211456]

R3 mrxsmb20;SMB 2.0 MiniRedirector;C:\Windows\system32\DRIVERS\mrxsmb20.sys [2008-01-14 58368]

R3 srv2;srv2;C:\Windows\system32\DRIVERS\srv2.sys [2008-01-14 130048]

R3 srvnet;srvnet;C:\Windows\system32\DRIVERS\srvnet.sys [2008-01-14 84992]

R3 tunnel;Driver do Adaptador de Miniporta de Encapsulamento do Microsoft IPv6;C:\Windows\system32\DRIVERS\tunnel.sys [2008-01-14 23040]

R3 umbus;Driver de Enumerador UMBus;C:\Windows\system32\DRIVERS\umbus.sys [2006-11-02 34816]

R3 WdiSystemHost;Host do Sistema de Diagnósticos;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S2 0270271192582006mcinstcleanup;McAfee Application Installer Cleanup (0270271192582006);C:\Users\Pati\AppData\Local\Temp\027027~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini [ ]

S2 EMDMgmt;ReadyBoost;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver;C:\Windows\system32\drivers\brfiltlo.sys [2006-11-02 13568]

S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver;C:\Windows\system32\drivers\brfiltup.sys [2006-11-02 5248]

S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\Windows\system32\drivers\brusbser.sys [2006-11-02 11904]

S3 DFSR;Replicação DFS;C:\Windows\system32\DFSR.exe [2006-11-02 2089984]

S3 E1G60;Intel® PRO/1000 NDIS 6 Adapter Driver;C:\Windows\system32\DRIVERS\E1G60I32.sys [2006-11-02 117760]

S3 fdPHost;Host de Provedor da Descoberta de Função;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 Filetrace;FileTrace;C:\Windows\system32\drivers\filetrace.sys [2006-11-02 27648]

S3 IPBusEnum;Enumerador de Barramento PnP-X IP;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 KeyIso;Isolamento de Chave CNG;C:\Windows\system32\lsass.exe [2006-11-02 7680]

S3 lltdsvc;Mapeador da Descoberta de Topologia da Camada de Link;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 MSiSCSI;Serviço Iniciador Microsoft iSCSI;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 MsRPC;MsRPC;C:\Windows\system32\drivers\MsRPC.sys [2006-11-02 160872]

S3 NativeWifiP;NativeWiFi Filter;C:\Windows\system32\DRIVERS\nwifi.sys [2008-02-14 154624]

S3 p2pimsvc;Gerenciador de Identidades de Mesmo Nível da Microsoft;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 p2psvc;Agrupamento de Rede de Mesmo Nível;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 pla;Logs e alertas de desempenho;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 PNRPAutoReg;Serviço de Publicação de Nome de Computador do PNRP;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 PNRPsvc;Protocolo de resolução de nomes de mesmo nível;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 QWAVE;Quality Windows Audio Video Experience;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 SDRSVC;Backup do Windows;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 SessionEnv;Configuração dos serviços de terminal;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 sffp_mmc;SFF Storage Protocol Driver for MMC;C:\Windows\system32\drivers\sffp_mmc.sys [2006-11-02 12800]

S3 SLUINotify;Serviço de Notificação da Interface de Usuário do Licenciamento de Software;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 TBS;Serviços Base de TPM;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 THREADORDER;Servidor de Ordem de Thread;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 TrustedInstaller;Instalador de Módulos do Windows;C:\Windows\servicing\TrustedInstaller.exe [2008-02-14 27136]

S3 tssecsrv;Terminal Services Security Filter Driver;C:\Windows\system32\DRIVERS\tssecsrv.sys [2006-11-02 23552]

S3 UI0Detect;Detecção de Serviços Interativos;C:\Windows\system32\UI0Detect.exe [2006-11-02 35840]

S3 uliagpkx;Uli AGP Bus Filter;C:\Windows\system32\drivers\uliagpkx.sys [2007-05-02 58472]

S3 wcncsvc;Conexão Fácil do Windows - Registrador de Configuração;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 WcsPlugInService;Sistema de Cores do Windows;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 WdiServiceHost;Host do Serviço de Diagnóstico;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 Wecsvc;Coletor de Eventos do Windows;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 wercplsupport;Suporte do Painel de Controle Relatórios de Problemas e Soluções;C:\Windows\System32\svchost.exe [2006-11-02 22016]

S3 Wlansvc;Configuração Automática de WLAN;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S3 WPCSvc;Controle dos Pais;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S4 adp94xx;adp94xx;C:\Windows\system32\drivers\adp94xx.sys [2006-11-02 420968]

S4 adpahci;adpahci;C:\Windows\system32\drivers\adpahci.sys [2006-11-02 297576]

S4 arcsas;arcsas;C:\Windows\system32\drivers\arcsas.sys [2006-11-02 67688]

S4 Brserid;Brother MFC Serial Port Interface Driver (WDM);C:\Windows\system32\drivers\brserid.sys [2006-11-02 71808]

S4 BrSerWdm;Brother WDM Serial driver;C:\Windows\system32\drivers\brserwdm.sys [2006-11-02 62336]

S4 BrUsbMdm;Brother MFC USB Fax Only Modem;C:\Windows\system32\drivers\brusbmdm.sys [2006-11-02 12160]

S4 CertPropSvc;Propagação de Certificado;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S4 circlass;Consumer IR Devices;C:\Windows\system32\drivers\circlass.sys [2006-11-02 35328]

S4 Crusoe;Transmeta Crusoe Processor Driver;C:\Windows\system32\drivers\crusoe.sys [2006-11-02 38912]

S4 elxstor;elxstor;C:\Windows\system32\drivers\elxstor.sys [2006-11-02 316520]

S4 HpCISSs;HpCISSs;C:\Windows\system32\drivers\hpcisss.sys [2006-11-02 37480]

S4 iaStorV;Intel RAID Controller Vista;C:\Windows\system32\drivers\iastorv.sys [2006-11-02 232040]

S4 IPMIDRV;IPMIDRV;C:\Windows\system32\drivers\ipmidrv.sys [2006-11-02 65536]

S4 iteraid;ITERAID_Service_Install;C:\Windows\system32\drivers\iteraid.sys [2006-11-02 35944]

S4 LSI_FC;LSI_FC;C:\Windows\system32\drivers\lsi_fc.sys [2006-11-02 65640]

S4 LSI_SAS;LSI_SAS;C:\Windows\system32\drivers\lsi_sas.sys [2006-11-02 65640]

S4 LSI_SCSI;LSI_SCSI;C:\Windows\system32\drivers\lsi_scsi.sys [2006-11-02 65640]

S4 megasas;megasas;C:\Windows\system32\drivers\megasas.sys [2006-11-02 28776]

S4 mpio;Microsoft Multi-Path Bus Driver;C:\Windows\system32\drivers\mpio.sys [2006-11-02 78952]

S4 msahci;msahci;C:\Windows\system32\drivers\msahci.sys [2007-05-02 25784]

S4 msdsm;Microsoft Multi-Path Device Specific Module;C:\Windows\system32\drivers\msdsm.sys [2006-11-02 80488]

S4 nfrd960;nfrd960;C:\Windows\system32\drivers\nfrd960.sys [2006-11-02 45160]

S4 ntrigdigi;N-trig HID Tablet Driver;C:\Windows\system32\drivers\ntrigdigi.sys [2006-11-02 20608]

S4 nvstor;nvstor;C:\Windows\system32\drivers\nvstor.sys [2006-11-02 40040]

S4 ql2300;QLogic Fibre Channel Miniport Driver;C:\Windows\system32\drivers\ql2300.sys [2006-11-02 900712]

S4 ql40xx;QLogic iSCSI Miniport Driver;C:\Windows\system32\drivers\ql40xx.sys [2006-11-02 106088]

S4 SCPolicySvc;Diretiva de Remoção de Cartão Inteligente;C:\Windows\system32\svchost.exe [2006-11-02 22016]

S4 SiSRaid4;SiSRaid4;C:\Windows\system32\drivers\sisraid4.sys [2006-11-02 71784]

S4 uliahci;uliahci;C:\Windows\system32\drivers\uliahci.sys [2006-11-02 235112]

S4 ulsata2;ulsata2;C:\Windows\system32\drivers\ulsata2.sys [2006-11-02 115816]

S4 usbcir;eHome Infrared Receiver (USBCIR);C:\Windows\system32\drivers\usbcir.sys [2006-11-02 68608]

S4 ViaC7;VIA C7 Processor Driver;C:\Windows\system32\drivers\viac7.sys [2006-11-02 39424]

S4 vsmraid;vsmraid;C:\Windows\system32\drivers\vsmraid.sys [2006-11-02 112232]

S4 WacomPen;Wacom Serial Pen HID Driver;C:\Windows\system32\drivers\wacompen.sys [2006-11-02 20608]

S4 Wd;Microsoft Watchdog Timer Driver;C:\Windows\system32\drivers\wd.sys [2006-11-02 19560]

S4 WinRM;Windows Remote Management (WS-Management);C:\Windows\System32\svchost.exe [2006-11-02 22016]

S4 WPDBusEnum;Serviço Enumerador de Dispositivos Portáteis;C:\Windows\system32\svchost.exe [2006-11-02 22016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

NetworkServiceNetworkRestricted REG_MULTI_SZ PolicyAgent

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

WerSvcGroup REG_MULTI_SZ wersvc

swprv REG_MULTI_SZ swprv

regsvc REG_MULTI_SZ RemoteRegistry

wcssvc REG_MULTI_SZ WcsPlugInService

DcomLaunch REG_MULTI_SZ PlugPlay DcomLaunch

wdisvc REG_MULTI_SZ WdiServiceHost

sdrsvc REG_MULTI_SZ sdrsvc

secsvcs REG_MULTI_SZ WinDefend

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

AeLookupSvc

wercplsupport

Themes

CertPropSvc

SCPolicySvc

lanmanserver

gpsvc

IKEEXT

AudioSrv

FastUserSwitchingCompatibility

Nla

NWCWorkstation

SRService

Wmi

WmdmPmSp

TermService

wuauserv

BITS

ShellHWDetection

LogonHours

PCAudit

helpsvc

uploadmgr

iphlpsvc

seclogon

AppInfo

msiscsi

MMCSS

ProfSvc

EapHost

winmgmt

schedule

SessionEnv

browser

hkmsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b383ec79-e460-11dc-8802-0015c536e6bb}]

\shell\auto\command - Knight.exe open

\shell\find\command - Knight.exe open

\shell\install\command - Knight.exe open

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbc47966-fe6e-11dc-8802-0015c536e6bb}]

\shell\auto\command - G:\Knight.exe open

\shell\find\command - G:\Knight.exe open

\shell\install\command - G:\Knight.exe open

*Newly Created Service* - CATCHME

*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI

.

Conteúdo da pasta 'Tarefas Agendadas'

.

------- Ccan Suplementar -------

.

FireFox -: Profile - C:\Users\Pati\AppData\Roaming\Mozilla\Firefox\Profiles\3avcd5bf.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.br/

FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava11.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava12.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava13.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava14.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava32.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npoji610.dll

FF -: plugin - C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll

FF -: plugin - C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-08 22:44:00

Windows 6.0.6000 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2008-09-08 22:55:43

ComboFix-quarantined-files.txt 2008-09-09 01:55:38

Pre-Run: O sistema não pode encontrar o texto correspondente à mensagem de número 0x2379 no arquivo de mensagens para Application.

Post-Run: 98,857,799,680 bytes disponíveis

393 --- E O F --- 2008-09-07 22:13:47

jgarcia · Setembro 10, 2008

Opa ptonella,

Siga as instruções:

1. Abra o Bloco de Notas -> Copie (Control + C) e Cole (Control + V) todo o texto incluído no "Quote":

File::
C:\Users\Pati\AppData\Roaming\wklnhst.dat

C:\Users\All Users\ezsidmv.dat

C:\Users\All Users\ezsid.dat

C:\ProgramData\draw dumb dumb.rdplk

C:\ProgramData\Owns Blah Mix.ljvqyep

C:\ProgramData\ezsidmv.dat

C:\ProgramData\ezsid.dat

C:\Program Files\desktop.ini

G:\Knight.exe

Folder::

C:\ProgramData\bird online bind

C:\ProgramData\Mfcd upload army browse

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"proc drive"=-

"Army browse cdrom vga"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000000

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b383ec79-e460-11dc-8802-0015c536e6bb}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbc47966-fe6e-11dc-8802-0015c536e6bb}]

ATENÇÃO: O script acima foi elaborado especificamente para a infecção contida neste computador. Utilizá-lo em outra máquina poderá originar graves problemas ao usuário.

2. Salve o arquivo como CFScript.txt;

3. Tal como exemplificado na foto abaixo, arraste o arquivo CFScript.txt para o ComboFix.exe.

4. Ao término do processo a ferramenta irá gerar um log. Poste-o (C:\ComboFix.txt) em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

PS.: Execute a ação com o seu pendrive conectado ao PC.

ptonella · Setembro 10, 2008

Olá.

Segue logo do ComboFix e do HijackThis:

ComboFix 08-09-05.10 - Pati 2008-09-09 21:57:00.2 - NTFSx86

Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1046.18.370 [GMT -3:00]

Executando de: C:\Users\Pati\Desktop\ComboFix.exe

Command switches used :: C:\Users\Pati\Desktop\CFScript.txt

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Program Files\desktop.ini

C:\ProgramData\bird online bind

C:\ProgramData\bird online bind\fcvmijbb.exe

C:\ProgramData\draw dumb dumb.rdplk

C:\ProgramData\ezsid.dat

C:\ProgramData\ezsidmv.dat

C:\ProgramData\Mfcd upload army browse

C:\ProgramData\Mfcd upload army browse\Heart Body.exe

C:\ProgramData\Owns Blah Mix.ljvqyep

C:\Users\All Users\ezsid.dat

C:\Users\All Users\ezsidmv.dat

C:\Users\Pati\AppData\Roaming\wklnhst.dat

G:\autorun.inf

.

((((((((((((((((((((((( Ficheiros criados de 2008-08-10 to 2008-09-10 ))))))))))))))))))))))))))))))))

.

Nenhum ficheiro/arquivo criado durante este período

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-09 22:10 --------- d-----w C:\Users\Pati\AppData\Roaming\uTorrent

2008-09-09 22:10 --------- d-----w C:\Users\Pati\AppData\Roaming\Skype

2008-09-09 19:08 --------- d-----w C:\Users\Pati\AppData\Roaming\skypePM

2008-09-09 03:14 --------- d-----w C:\ProgramData\Spybot - Search & Destroy

2008-09-09 02:31 --------- d-----w C:\Program Files\Mx One