Ir para conteúdo

POWERED BY:

Arquivado

Este tópico foi arquivado e está fechado para novas respostas.

Aldeboy

[Arquivado] Remover Iexplore.exe e outras tralhas

Por , em Tópicos Arquivados (Seguranca & Malwares)

Recommended Posts

Aldeboy    0

Aldeboy
Postado

segue o LOG do HiJack

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:25:11, on 22/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Winamp\winampa.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\ARQUIV~1\AVG\AVG8\avgupd.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Opera\opera.exe

C:\Arquivos de programas\uTorrent\uTorrent.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Aldemir\Desktop\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portuguese.eazel.com/pt/index.php?r...&d=79919176

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (file missing)

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Long Internet Team Stupid] C:\Documents and Settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKCU\..\Run: [Web remote] C:\DOCUME~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [uTorrent] "C:\Arquivos de programas\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe

O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

 

--

End of file - 9649 bytes

 

 

e do LopSD

 

 

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

 

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2

X86-based PC ( Multiprocessor Free : AMD Athlon 64 X2 Dual Core Processor 4800+ )

BIOS : BIOS Date: 12/04/07 17:14:27 Ver: 08.00.12

USER : Aldemir ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Activated)

C:\ (Local Disk) - NTFS - Total:49 Go (Free:5 Go)

D:\ (Local Disk) - NTFS - Total:182 Go (Free:25 Go)

F:\ (CD or DVD)

G:\ (CD or DVD)

I:\ (CD or DVD)

 

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [1] ( seg 22/12/2008| 0:18 )

 

--------------------\\ Lista de pastas em DADOSD~1

 

[16/12/2008|19:32] C:\DOCUME~1\Aldemir\DADOSD~1\Adobe

[29/11/2008|10:20] C:\DOCUME~1\Aldemir\DADOSD~1\AdobeUM

[27/07/2008|00:05] C:\DOCUME~1\Aldemir\DADOSD~1\Autodesk

[27/07/2008|14:05] C:\DOCUME~1\Aldemir\DADOSD~1\AVGTOOLBAR

[12/10/2008|18:48] C:\DOCUME~1\Aldemir\DADOSD~1\CmapTools

[25/08/2008|20:51] C:\DOCUME~1\Aldemir\DADOSD~1\Corel

[26/07/2008|17:22] C:\DOCUME~1\Aldemir\DADOSD~1\DAEMON Tools

[17/08/2008|14:18] C:\DOCUME~1\Aldemir\DADOSD~1\DivX

[19/10/2008|16:52] C:\DOCUME~1\Aldemir\DADOSD~1\fretsonfire

[28/07/2008|18:34] C:\DOCUME~1\Aldemir\DADOSD~1\Google

[29/07/2008|23:52] C:\DOCUME~1\Aldemir\DADOSD~1\GrabPro

[26/07/2008|15:04] C:\DOCUME~1\Aldemir\DADOSD~1\Identities

[26/07/2008|15:13] C:\DOCUME~1\Aldemir\DADOSD~1\InstallShield

[24/11/2008|06:41] C:\DOCUME~1\Aldemir\DADOSD~1\Leadertech

[26/07/2008|18:15] C:\DOCUME~1\Aldemir\DADOSD~1\Macromedia

[15/08/2008|22:56] C:\DOCUME~1\Aldemir\DADOSD~1\Media Player Classic

[14/12/2008|19:10] C:\DOCUME~1\Aldemir\DADOSD~1\Microsoft

[26/07/2008|15:33] C:\DOCUME~1\Aldemir\DADOSD~1\Mozilla

[23/08/2008|17:38] C:\DOCUME~1\Aldemir\DADOSD~1\Nero

[28/07/2008|18:03] C:\DOCUME~1\Aldemir\DADOSD~1\Opera

[21/12/2008|15:07] C:\DOCUME~1\Aldemir\DADOSD~1\Orbit

[20/08/2008|17:21] C:\DOCUME~1\Aldemir\DADOSD~1\Pegasys Inc

[10/11/2008|18:20] C:\DOCUME~1\Aldemir\DADOSD~1\Real

[29/08/2008|16:26] C:\DOCUME~1\Aldemir\DADOSD~1\SecuROM

[14/12/2008|14:58] C:\DOCUME~1\Aldemir\DADOSD~1\soft intra bird

[22/12/2008|00:18] C:\DOCUME~1\Aldemir\DADOSD~1\uTorrent

[17/10/2008|20:49] C:\DOCUME~1\Aldemir\DADOSD~1\Winamp

[26/07/2008|18:21] C:\DOCUME~1\Aldemir\DADOSD~1\WinRAR

 

[15/12/2008|09:00] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Adobe

[26/07/2008|23:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Autodesk

[18/12/2008|18:40] C:\DOCUME~1\ALLUSE~1\DADOSD~1\avg8

[14/12/2008|15:10] C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet

[20/09/2008|10:28] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Corel

[16/12/2008|19:07] C:\DOCUME~1\ALLUSE~1\DADOSD~1\FLEXnet

[21/12/2008|15:16] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google

[25/08/2008|20:50] C:\DOCUME~1\ALLUSE~1\DADOSD~1\InstallShield

[15/12/2008|10:04] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Messenger Plus!

[19/12/2008|20:30] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft

[26/10/2008|19:41] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft Help

[23/08/2008|17:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Nero

[13/08/2008|12:02] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NFS Underground

[14/10/2008|17:01] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NVIDIA

[26/07/2008|19:12] C:\DOCUME~1\ALLUSE~1\DADOSD~1\nView_Profiles

[28/07/2008|18:59] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Real

[28/07/2008|18:30] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy

 

[08/10/2008|18:01] C:\DOCUME~1\CONVID~1\DADOSD~1\AVGTOOLBAR

[14/10/2008|11:14] C:\DOCUME~1\CONVID~1\DADOSD~1\DivX

[08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Identities

[08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Microsoft

[10/10/2008|22:03] C:\DOCUME~1\CONVID~1\DADOSD~1\Mozilla

[10/10/2008|22:01] C:\DOCUME~1\CONVID~1\DADOSD~1\Opera

[14/10/2008|21:28] C:\DOCUME~1\CONVID~1\DADOSD~1\Orbit

[14/10/2008|10:57] C:\DOCUME~1\CONVID~1\DADOSD~1\Winamp

 

[26/07/2008|14:51] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Microsoft

 

[26/07/2008|16:26] C:\DOCUME~1\LOCALS~1\DADOSD~1\Microsoft

 

[26/07/2008|16:26] C:\DOCUME~1\NETWOR~1\DADOSD~1\Microsoft

 

--------------------\\ Tarefas Agendadas na pasta C:\WINDOWS\Tasks

 

[22/12/2008 00:00][--ah-----] C:\WINDOWS\tasks\ACF2C7C2918D7A0A.job

[21/12/2008 21:52][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job

[21/12/2008 15:06][--ah-----] C:\WINDOWS\tasks\SA.DAT

[28/10/2001 16:07][-r-h-----] C:\WINDOWS\tasks\desktop.ini

 

( ACF2C7C2918D7A0A.job )=( c:\docume~1\aldemir\dadosd~1\softin~1\storesecondone.exe )

 

--------------------\\ Lista de pastas em C:\Arquivos de programas

 

[15/12/2008|08:55] C:\Arquivos de programas\Adobe

[01/11/2008|17:47] C:\Arquivos de programas\Aide PDF to DXF Converter

[26/07/2008|23:36] C:\Arquivos de programas\AnswerWorks 4.0

[20/12/2008|15:45] C:\Arquivos de programas\Arquivos comuns

[26/07/2008|23:37] C:\Arquivos de programas\AutoCAD 2007

[26/07/2008|23:15] C:\Arquivos de programas\Autodesk

[26/07/2008|16:26] C:\Arquivos de programas\AVG

[16/08/2008|15:19] C:\Arquivos de programas\AviSynth 2.5

[16/08/2008|15:32] C:\Arquivos de programas\AVIXDVD

[15/12/2008|08:59] C:\Arquivos de programas\Bonjour

[19/11/2008|16:57] C:\Arquivos de programas\C-evo2

[26/07/2008|14:48] C:\Arquivos de programas\ComPlus Applications

[25/08/2008|21:23] C:\Arquivos de programas\Conduit

[20/09/2008|10:28] C:\Arquivos de programas\Corel

[26/07/2008|23:06] C:\Arquivos de programas\DAEMON Tools Lite

[20/08/2008|17:20] C:\Arquivos de programas\DivX

[13/08/2008|11:33] C:\Arquivos de programas\EA GAMES

[26/07/2008|19:48] C:\Arquivos de programas\FineRecovery

[02/08/2008|14:45] C:\Arquivos de programas\Free FLV to AVI Video Converter

[12/11/2008|17:53] C:\Arquivos de programas\GameVicio

[28/07/2008|18:33] C:\Arquivos de programas\Google

[21/12/2008|15:06] C:\Arquivos de programas\InstallShield Installation Information

[14/12/2008|12:51] C:\Arquivos de programas\Internet Explorer

[05/10/2008|20:52] C:\Arquivos de programas\Justiça Eleitoral

[28/07/2008|18:59] C:\Arquivos de programas\K-Lite Codec Pack

[26/07/2008|23:11] C:\Arquivos de programas\LG mobile

[10/08/2008|16:14] C:\Arquivos de programas\Maxis

[09/11/2008|17:29] C:\Arquivos de programas\Megacubo

[26/07/2008|20:36] C:\Arquivos de programas\Messenger

[15/12/2008|08:01] C:\Arquivos de programas\Messenger Plus! Live

[21/12/2008|15:15] C:\Arquivos de programas\MessengerDiscovery

[26/07/2008|15:51] C:\Arquivos de programas\MessengerPlus! 3

[19/12/2008|20:30] C:\Arquivos de programas\Microsoft

[26/07/2008|14:51] C:\Arquivos de programas\microsoft frontpage

[25/08/2008|23:22] C:\Arquivos de programas\Microsoft IntelliPoint 5.2

[22/08/2008|21:02] C:\Arquivos de programas\Microsoft Office

[30/07/2008|12:56] C:\Arquivos de programas\Microsoft Visual Studio

[22/08/2008|20:56] C:\Arquivos de programas\Microsoft Visual Studio 8

[22/08/2008|21:03] C:\Arquivos de programas\Microsoft Works

[22/08/2008|21:01] C:\Arquivos de programas\Microsoft.NET

[26/07/2008|14:49] C:\Arquivos de programas\Movie Maker

[18/12/2008|23:49] C:\Arquivos de programas\Mozilla Firefox

[22/08/2008|21:02] C:\Arquivos de programas\MSBuild

[26/07/2008|14:48] C:\Arquivos de programas\MSN Gaming Zone

[29/07/2008|04:00] C:\Arquivos de programas\MSXML 4.0

[23/08/2008|17:35] C:\Arquivos de programas\Nero

[23/08/2008|17:38] C:\Arquivos de programas\NeroInstall.bak

[26/07/2008|14:49] C:\Arquivos de programas\NetMeeting

[26/07/2008|15:15] C:\Arquivos de programas\NVIDIA Corporation

[27/10/2008|10:54] C:\Arquivos de programas\One-click Ringtone Converter

[28/07/2008|18:03] C:\Arquivos de programas\Opera

[18/12/2008|08:00] C:\Arquivos de programas\Orbitdownloader

[26/07/2008|14:49] C:\Arquivos de programas\Outlook Express

[25/08/2008|21:23] C:\Arquivos de programas\RadarSync

[26/07/2008|18:35] C:\Arquivos de programas\Raptor_Shareware

[14/12/2008|13:32] C:\Arquivos de programas\Realtek

[26/07/2008|14:50] C:\Arquivos de programas\Serviços on-line

[11/12/2008|23:45] C:\Arquivos de programas\soft intra bird

[12/09/2008|23:04] C:\Arquivos de programas\SopCast

[28/07/2008|18:29] C:\Arquivos de programas\Spybot - Search & Destroy

[17/08/2008|16:07] C:\Arquivos de programas\sub2divx

[25/08/2008|21:24] C:\Arquivos de programas\The Weather Channel FW

[26/07/2008|15:04] C:\Arquivos de programas\Uninstall Information

[27/08/2008|17:18] C:\Arquivos de programas\Unity

[26/07/2008|17:24] C:\Arquivos de programas\uTorrent

[17/10/2008|20:46] C:\Arquivos de programas\Winamp

[19/12/2008|20:30] C:\Arquivos de programas\Windows Live

[19/12/2008|20:30] C:\Arquivos de programas\Windows Live SkyDrive

[23/08/2008|17:34] C:\Arquivos de programas\Windows Media Player

[26/07/2008|14:48] C:\Arquivos de programas\Windows NT

[26/07/2008|14:50] C:\Arquivos de programas\WindowsUpdate

[03/08/2008|00:56] C:\Arquivos de programas\WinRAR

[26/07/2008|14:51] C:\Arquivos de programas\xerox

[12/10/2008|18:44] C:\Arquivos de programas\Zero G Registry

 

--------------------\\ Lista de pastas em C:\Arquivos de programas\Arquivos comuns

 

[15/12/2008|08:58] C:\Arquivos de programas\Arquivos comuns\Adobe

[26/07/2008|23:36] C:\Arquivos de programas\Arquivos comuns\Autodesk Shared

[20/09/2008|10:28] C:\Arquivos de programas\Arquivos comuns\Corel

[20/09/2008|10:29] C:\Arquivos de programas\Arquivos comuns\Designer

[13/08/2008|11:36] C:\Arquivos de programas\Arquivos comuns\DirectX

[25/08/2008|20:50] C:\Arquivos de programas\Arquivos comuns\InstallShield

[15/12/2008|08:44] C:\Arquivos de programas\Arquivos comuns\Macrovision Shared

[19/12/2008|20:30] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared

[26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\MSSoap

[23/08/2008|17:36] C:\Arquivos de programas\Arquivos comuns\Nero

[26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\ODBC

[25/08/2008|20:49] C:\Arquivos de programas\Arquivos comuns\Protexis

[26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\Serviços

[11/09/2008|23:54] C:\Arquivos de programas\Arquivos comuns\snppro

[26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\SpeechEngines

[14/12/2008|14:20] C:\Arquivos de programas\Arquivos comuns\SWF Studio

[22/08/2008|21:07] C:\Arquivos de programas\Arquivos comuns\System

[19/12/2008|19:35] C:\Arquivos de programas\Arquivos comuns\Windows Live

 

--------------------\\ Process

 

( 53 Processes )

 

iexplore.exe ~ [PID:620]

iexplore.exe ~ [PID:524]

 

--------------------\\ Procura pelo S_Lop

 

Não foram encontradas pastas com o Lop!

 

--------------------\\ Procura por Arquivos/Ficheiros e pastas do Lop

 

C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet

C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet\4 SURF.exe

C:\DOCUME~1\Aldemir\DADOSD~1\softin~1

C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\okgmrjdg.exe

C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\PlayPlatformAxisJoy.exe

C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\SETUP HOPE LIST.exe

C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\store second one.exe

C:\Arquivos de programas\softin~1

C:\Arquivos de programas\Orbitdownloader

C:\Arquivos de programas\Orbitdownloader\addons

C:\Arquivos de programas\Orbitdownloader\banurl.ini

C:\Arquivos de programas\Orbitdownloader\changelog.txt

C:\Arquivos de programas\Orbitdownloader\download.dll

C:\Arquivos de programas\Orbitdownloader\Grab.exe

C:\Arquivos de programas\Orbitdownloader\GrabDll.dll

C:\Arquivos de programas\Orbitdownloader\GrabKernel.dll

C:\Arquivos de programas\Orbitdownloader\GrabPro.dll

C:\Arquivos de programas\Orbitdownloader\idht.dll

C:\Arquivos de programas\Orbitdownloader\Lang.ini

C:\Arquivos de programas\Orbitdownloader\language

C:\Arquivos de programas\Orbitdownloader\libeay32.dll

C:\Arquivos de programas\Orbitdownloader\magic.mgc

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\Orbitdownloader\saction.dll

C:\Arquivos de programas\Orbitdownloader\siteinfo.ini

C:\Arquivos de programas\Orbitdownloader\ssleay32.dll

C:\Arquivos de programas\Orbitdownloader\unins000.dat

C:\Arquivos de programas\Orbitdownloader\unins000.exe

C:\Arquivos de programas\Orbitdownloader\update

C:\Arquivos de programas\Orbitdownloader\winfile.dll

C:\DOCUME~1\Aldemir\Cookies\aldemir@www.adserver5[1].txt

C:\DOCUME~1\Aldemir\Cookies\aldemir@pacificpoker[1].txt

C:\DOCUME~1\Aldemir\Cookies\aldemir@www.lop[2].txt

C:\WINDOWS\Tasks\ACF2C7C2918D7A0A.job

 

--------------------\\ Procura no Registro

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Web remote"="C:\\DOCUME~1\\Aldemir\\DADOSD~1\\SOFTIN~1\\SETUP HOPE LIST.exe"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Long Internet Team Stupid"="C:\\Documents and Settings\\All Users\\Dados de aplicativos\\comp two long internet\\Wipe Enc.exe"

 

--------------------\\ Verificando o Arquivos/Ficheiros Hosts

 

Arquivos/Ficheiros Hosts LIMPO

 

 

--------------------\\ Procurando Arquivos/Ficheiros ocultos com o Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-22 00:19:23

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 1

 

--------------------\\ Procurando por outras infecções

 

--------------------\\ Cracks & Keygens ..

 

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Adobe Photoshop CS3 Extended + Crack.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Age Of Empires 3 full DVD +crack + serial.iso.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\AutoCAD 2007 with CRACK.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Need.For.Speed.Undercover.Crack.and.Keygen.Only-RELOADED.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Nero 8 Ultra Edition 8.3.2.1b + Working Serial + Crack.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Pro.Evolution.Soccer.2008[PCDVD][spanish-EN-FR-GE-IT-POR] + CRACK + KEYGEN (Gusnor).torrent

C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack

C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack\Sims2EP7.exe

C:\DOCUME~1\Aldemir\Recent\AutoCAD_2007_with_CRACK.3793037.TPB.lnk

 

 

[F:171][D:7]-> C:\DOCUME~1\Aldemir\CONFIG~1\Temp

[F:95][D:0]-> C:\DOCUME~1\Aldemir\Cookies

[F:217][D:4]-> C:\DOCUME~1\Aldemir\CONFIG~1\TEMPOR~1\content.IE5

 

1 - "C:\Lop SD\LopR_1.txt" - seg 22/12/2008| 0:21 - Option : [1]

 

--------------------\\ Verificação completa em 0:21:54

 

 

GRATO!

Compartilhar este post

Link para o post
Compartilhar em outros sites

MGuitar    11

MGuitar
Postado

Dê um duplo clique no Lop S&D, pressione a tecla "P", digite 2 e dê um Enter.

 

Poste o log do Lop S&D aqui, juntamente com um novo log do HijackThis.

Compartilhar este post

Link para o post
Compartilhar em outros sites

Aldeboy    0

Aldeboy
Postado

Desculpe a demora, festas de fim de ano, Round One: Xmas

 

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

 

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2

X86-based PC ( Multiprocessor Free : AMD Athlon 64 X2 Dual Core Processor 4800+ )

BIOS : BIOS Date: 12/04/07 17:14:27 Ver: 08.00.12

USER : Aldemir ( Administrator )

BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 081225-0] 4.8.1296 (Activated)

C:\ (Local Disk) - NTFS - Total:49 Go (Free:5 Go)

D:\ (Local Disk) - NTFS - Total:182 Go (Free:25 Go)

F:\ (CD or DVD)

G:\ (CD or DVD)

I:\ (CD or DVD)

 

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [2] ( --- 26/12/2008| 9:30 )

 

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ REMOVIDOS

 

Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\okgmrjdg.exe

Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\PlayPlatformAxisJoy.exe

Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\SETUP HOPE LIST.exe

Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\store second one.exe

Deletado! - C:\Arquivos de programas\Orbitdownloader\addons

Deletado! - C:\Arquivos de programas\Orbitdownloader\banurl.ini

Deletado! - C:\Arquivos de programas\Orbitdownloader\changelog.txt

Falha ! - C:\Arquivos de programas\Orbitdownloader\download.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\Grab.exe

Deletado! - C:\Arquivos de programas\Orbitdownloader\GrabDll.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\GrabKernel.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll

Falha ! - C:\Arquivos de programas\Orbitdownloader\idht.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\Lang.ini

Deletado! - C:\Arquivos de programas\Orbitdownloader\language

Deletado! - C:\Arquivos de programas\Orbitdownloader\libeay32.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\magic.mgc

Deletado! - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

Deletado! - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll

Falha ! - C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

Deletado! - C:\Arquivos de programas\Orbitdownloader\saction.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\siteinfo.ini

Deletado! - C:\Arquivos de programas\Orbitdownloader\ssleay32.dll

Deletado! - C:\Arquivos de programas\Orbitdownloader\unins000.dat

Deletado! - C:\Arquivos de programas\Orbitdownloader\unins000.exe

Deletado! - C:\Arquivos de programas\Orbitdownloader\update

Deletado! - C:\Arquivos de programas\Orbitdownloader\winfile.dll

Deletado! - C:\DOCUME~1\Aldemir\Cookies\aldemir@www.adserver5[1].txt

Deletado! - C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet

Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1

Deletado! - C:\Arquivos de programas\softin~1

Deletado! - C:\Arquivos de programas\Orbitdownloader

-

[ Arquivos/Ficheiros Hosts ] .. RESTAURADO

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

 

 

--------------------\\ Lista de pastas em DADOSD~1

 

[16/12/2008|19:32] C:\DOCUME~1\Aldemir\DADOSD~1\Adobe

[29/11/2008|10:20] C:\DOCUME~1\Aldemir\DADOSD~1\AdobeUM

[27/07/2008|00:05] C:\DOCUME~1\Aldemir\DADOSD~1\Autodesk

[27/07/2008|14:05] C:\DOCUME~1\Aldemir\DADOSD~1\AVGTOOLBAR

[12/10/2008|18:48] C:\DOCUME~1\Aldemir\DADOSD~1\CmapTools

[25/08/2008|20:51] C:\DOCUME~1\Aldemir\DADOSD~1\Corel

[26/07/2008|17:22] C:\DOCUME~1\Aldemir\DADOSD~1\DAEMON Tools

[17/08/2008|14:18] C:\DOCUME~1\Aldemir\DADOSD~1\DivX

[19/10/2008|16:52] C:\DOCUME~1\Aldemir\DADOSD~1\fretsonfire

[21/12/2008|15:17] C:\DOCUME~1\Aldemir\DADOSD~1\Google

[29/07/2008|23:52] C:\DOCUME~1\Aldemir\DADOSD~1\GrabPro

[26/07/2008|15:04] C:\DOCUME~1\Aldemir\DADOSD~1\Identities

[26/07/2008|15:13] C:\DOCUME~1\Aldemir\DADOSD~1\InstallShield

[24/11/2008|06:41] C:\DOCUME~1\Aldemir\DADOSD~1\Leadertech

[26/07/2008|18:15] C:\DOCUME~1\Aldemir\DADOSD~1\Macromedia

[15/08/2008|22:56] C:\DOCUME~1\Aldemir\DADOSD~1\Media Player Classic

[14/12/2008|19:10] C:\DOCUME~1\Aldemir\DADOSD~1\Microsoft

[23/12/2008|16:32] C:\DOCUME~1\Aldemir\DADOSD~1\Miranda

[26/07/2008|15:33] C:\DOCUME~1\Aldemir\DADOSD~1\Mozilla

[23/08/2008|17:38] C:\DOCUME~1\Aldemir\DADOSD~1\Nero

[28/07/2008|18:03] C:\DOCUME~1\Aldemir\DADOSD~1\Opera

[25/12/2008|21:18] C:\DOCUME~1\Aldemir\DADOSD~1\Orbit

[20/08/2008|17:21] C:\DOCUME~1\Aldemir\DADOSD~1\Pegasys Inc

[10/11/2008|18:20] C:\DOCUME~1\Aldemir\DADOSD~1\Real

[29/08/2008|16:26] C:\DOCUME~1\Aldemir\DADOSD~1\SecuROM

[26/12/2008|09:30] C:\DOCUME~1\Aldemir\DADOSD~1\uTorrent

[17/10/2008|20:49] C:\DOCUME~1\Aldemir\DADOSD~1\Winamp

[26/07/2008|18:21] C:\DOCUME~1\Aldemir\DADOSD~1\WinRAR

 

[15/12/2008|09:00] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Adobe

[26/07/2008|23:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Autodesk

[18/12/2008|18:40] C:\DOCUME~1\ALLUSE~1\DADOSD~1\avg8

[20/09/2008|10:28] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Corel

[16/12/2008|19:07] C:\DOCUME~1\ALLUSE~1\DADOSD~1\FLEXnet

[21/12/2008|15:16] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google

[25/08/2008|20:50] C:\DOCUME~1\ALLUSE~1\DADOSD~1\InstallShield

[15/12/2008|10:04] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Messenger Plus!

[19/12/2008|20:30] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft

[26/10/2008|19:41] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft Help

[23/08/2008|17:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Nero

[13/08/2008|12:02] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NFS Underground

[14/10/2008|17:01] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NVIDIA

[26/07/2008|19:12] C:\DOCUME~1\ALLUSE~1\DADOSD~1\nView_Profiles

[28/07/2008|18:59] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Real

[23/12/2008|12:40] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy

 

[08/10/2008|18:01] C:\DOCUME~1\CONVID~1\DADOSD~1\AVGTOOLBAR

[14/10/2008|11:14] C:\DOCUME~1\CONVID~1\DADOSD~1\DivX

[08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Identities

[08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Microsoft

[10/10/2008|22:03] C:\DOCUME~1\CONVID~1\DADOSD~1\Mozilla

[10/10/2008|22:01] C:\DOCUME~1\CONVID~1\DADOSD~1\Opera

[14/10/2008|21:28] C:\DOCUME~1\CONVID~1\DADOSD~1\Orbit

[14/10/2008|10:57] C:\DOCUME~1\CONVID~1\DADOSD~1\Winamp

 

[26/07/2008|14:51] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Microsoft

 

[26/07/2008|16:26] C:\DOCUME~1\LOCALS~1\DADOSD~1\Microsoft

 

[26/07/2008|16:26] C:\DOCUME~1\NETWOR~1\DADOSD~1\Microsoft

 

--------------------\\ Tarefas Agendadas na pasta C:\WINDOWS\Tasks

 

[26/12/2008 09:00][--ah-----] C:\WINDOWS\tasks\B09177379072EB83.job

[26/12/2008 06:19][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job

[25/12/2008 21:17][--ah-----] C:\WINDOWS\tasks\SA.DAT

[28/10/2001 16:07][-r-h-----] C:\WINDOWS\tasks\desktop.ini

 

( B09177379072EB83.job )=( c:\docume~1\aldemir\dadosd~1\softin~1\storesecondone.exe )

 

--------------------\\ Lista de pastas em C:\Arquivos de programas

 

[15/12/2008|08:55] C:\Arquivos de programas\Adobe

[01/11/2008|17:47] C:\Arquivos de programas\Aide PDF to DXF Converter

[26/07/2008|23:36] C:\Arquivos de programas\AnswerWorks 4.0

[20/12/2008|15:45] C:\Arquivos de programas\Arquivos comuns

[26/07/2008|23:37] C:\Arquivos de programas\AutoCAD 2007

[26/07/2008|23:15] C:\Arquivos de programas\Autodesk

[26/07/2008|16:26] C:\Arquivos de programas\AVG

[16/08/2008|15:19] C:\Arquivos de programas\AviSynth 2.5

[16/08/2008|15:32] C:\Arquivos de programas\AVIXDVD

[15/12/2008|08:59] C:\Arquivos de programas\Bonjour

[19/11/2008|16:57] C:\Arquivos de programas\C-evo2

[26/07/2008|14:48] C:\Arquivos de programas\ComPlus Applications

[25/08/2008|21:23] C:\Arquivos de programas\Conduit

[20/09/2008|10:28] C:\Arquivos de programas\Corel

[26/07/2008|23:06] C:\Arquivos de programas\DAEMON Tools Lite

[20/08/2008|17:20] C:\Arquivos de programas\DivX

[13/08/2008|11:33] C:\Arquivos de programas\EA GAMES

[26/07/2008|19:48] C:\Arquivos de programas\FineRecovery

[02/08/2008|14:45] C:\Arquivos de programas\Free FLV to AVI Video Converter

[12/11/2008|17:53] C:\Arquivos de programas\GameVicio

[28/07/2008|18:33] C:\Arquivos de programas\Google

[21/12/2008|15:06] C:\Arquivos de programas\InstallShield Installation Information

[14/12/2008|12:51] C:\Arquivos de programas\Internet Explorer

[05/10/2008|20:52] C:\Arquivos de programas\Justiça Eleitoral

[28/07/2008|18:59] C:\Arquivos de programas\K-Lite Codec Pack

[26/07/2008|23:11] C:\Arquivos de programas\LG mobile

[10/08/2008|16:14] C:\Arquivos de programas\Maxis

[09/11/2008|17:29] C:\Arquivos de programas\Megacubo

[26/07/2008|20:36] C:\Arquivos de programas\Messenger

[15/12/2008|08:01] C:\Arquivos de programas\Messenger Plus! Live

[21/12/2008|15:15] C:\Arquivos de programas\MessengerDiscovery

[26/07/2008|15:51] C:\Arquivos de programas\MessengerPlus! 3

[19/12/2008|20:30] C:\Arquivos de programas\Microsoft

[26/07/2008|14:51] C:\Arquivos de programas\microsoft frontpage

[25/08/2008|23:22] C:\Arquivos de programas\Microsoft IntelliPoint 5.2

[22/08/2008|21:02] C:\Arquivos de programas\Microsoft Office

[30/07/2008|12:56] C:\Arquivos de programas\Microsoft Visual Studio

[22/08/2008|20:56] C:\Arquivos de programas\Microsoft Visual Studio 8

[22/08/2008|21:03] C:\Arquivos de programas\Microsoft Works

[22/08/2008|21:01] C:\Arquivos de programas\Microsoft.NET

[26/07/2008|14:49] C:\Arquivos de programas\Movie Maker

[18/12/2008|23:49] C:\Arquivos de programas\Mozilla Firefox

[22/08/2008|21:02] C:\Arquivos de programas\MSBuild

[26/07/2008|14:48] C:\Arquivos de programas\MSN Gaming Zone

[29/07/2008|04:00] C:\Arquivos de programas\MSXML 4.0

[23/08/2008|17:35] C:\Arquivos de programas\Nero

[23/08/2008|17:38] C:\Arquivos de programas\NeroInstall.bak

[26/07/2008|14:49] C:\Arquivos de programas\NetMeeting

[26/07/2008|15:15] C:\Arquivos de programas\NVIDIA Corporation

[27/10/2008|10:54] C:\Arquivos de programas\One-click Ringtone Converter

[28/07/2008|18:03] C:\Arquivos de programas\Opera

[26/07/2008|14:49] C:\Arquivos de programas\Outlook Express

[25/08/2008|21:23] C:\Arquivos de programas\RadarSync

[26/07/2008|18:35] C:\Arquivos de programas\Raptor_Shareware

[14/12/2008|13:32] C:\Arquivos de programas\Realtek

[26/07/2008|14:50] C:\Arquivos de programas\Serviços on-line

[12/09/2008|23:04] C:\Arquivos de programas\SopCast

[28/07/2008|18:29] C:\Arquivos de programas\Spybot - Search & Destroy

[17/08/2008|16:07] C:\Arquivos de programas\sub2divx

[25/08/2008|21:24] C:\Arquivos de programas\The Weather Channel FW

[26/07/2008|15:04] C:\Arquivos de programas\Uninstall Information

[27/08/2008|17:18] C:\Arquivos de programas\Unity

[26/07/2008|17:24] C:\Arquivos de programas\uTorrent

[17/10/2008|20:46] C:\Arquivos de programas\Winamp

[19/12/2008|20:30] C:\Arquivos de programas\Windows Live

[19/12/2008|20:30] C:\Arquivos de programas\Windows Live SkyDrive

[23/08/2008|17:34] C:\Arquivos de programas\Windows Media Player

[26/07/2008|14:48] C:\Arquivos de programas\Windows NT

[26/07/2008|14:50] C:\Arquivos de programas\WindowsUpdate

[03/08/2008|00:56] C:\Arquivos de programas\WinRAR

[26/07/2008|14:51] C:\Arquivos de programas\xerox

[12/10/2008|18:44] C:\Arquivos de programas\Zero G Registry

 

--------------------\\ Lista de pastas em C:\Arquivos de programas\Arquivos comuns

 

[15/12/2008|08:58] C:\Arquivos de programas\Arquivos comuns\Adobe

[26/07/2008|23:36] C:\Arquivos de programas\Arquivos comuns\Autodesk Shared

[20/09/2008|10:28] C:\Arquivos de programas\Arquivos comuns\Corel

[20/09/2008|10:29] C:\Arquivos de programas\Arquivos comuns\Designer

[13/08/2008|11:36] C:\Arquivos de programas\Arquivos comuns\DirectX

[25/08/2008|20:50] C:\Arquivos de programas\Arquivos comuns\InstallShield

[15/12/2008|08:44] C:\Arquivos de programas\Arquivos comuns\Macrovision Shared

[19/12/2008|20:30] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared

[26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\MSSoap

[23/08/2008|17:36] C:\Arquivos de programas\Arquivos comuns\Nero

[26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\ODBC

[25/08/2008|20:49] C:\Arquivos de programas\Arquivos comuns\Protexis

[26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\Serviços

[11/09/2008|23:54] C:\Arquivos de programas\Arquivos comuns\snppro

[26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\SpeechEngines

[14/12/2008|14:20] C:\Arquivos de programas\Arquivos comuns\SWF Studio

[22/08/2008|21:07] C:\Arquivos de programas\Arquivos comuns\System

[19/12/2008|19:35] C:\Arquivos de programas\Arquivos comuns\Windows Live

 

--------------------\\ Process

 

( 46 Processes )

 

... OK !

 

--------------------\\ Procura pelo S_Lop

 

Não foram encontradas pastas com o Lop!

 

--------------------\\ Procura por Arquivos/Ficheiros e pastas do Lop

 

C:\DOCUME~1\Aldemir\CONFIG~1\Temp\sta286.exe

C:\WINDOWS\Tasks\B09177379072EB83.job

 

--------------------\\ Procura no Registro

 

..... OK !

 

--------------------\\ Verificando o Arquivos/Ficheiros Hosts

 

Arquivos/Ficheiros Hosts LIMPO

 

 

--------------------\\ Procurando Arquivos/Ficheiros ocultos com o Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-26 09:31:23

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 1

 

--------------------\\ Procurando por outras infecções

 

--------------------\\ Cracks & Keygens ..

 

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Adobe Photoshop CS3 Extended + Crack.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Age Of Empires 3 full DVD +crack + serial.iso.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\AutoCAD 2007 with CRACK.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Need.For.Speed.Undercover.Crack.and.Keygen.Only-RELOADED.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Nero 8 Ultra Edition 8.3.2.1b + Working Serial + Crack.torrent

C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Pro.Evolution.Soccer.2008[PCDVD][spanish-EN-FR-GE-IT-POR] + CRACK + KEYGEN (Gusnor).torrent

C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack

C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack\Sims2EP7.exe

 

 

[F:240][D:3]-> C:\DOCUME~1\Aldemir\CONFIG~1\Temp

[F:25][D:0]-> C:\DOCUME~1\Aldemir\Cookies

[F:189][D:4]-> C:\DOCUME~1\Aldemir\CONFIG~1\TEMPOR~1\content.IE5

 

1 - "C:\Lop SD\LopR_1.txt" - seg 22/12/2008| 0:21 - Option : [1]

2 - "C:\Lop SD\LopR_2.txt" - --- 26/12/2008| 9:32 - Option : [2]

 

--------------------\\ Verificação completa em 9:32:49

Compartilhar este post

Link para o post
Compartilhar em outros sites

Aldeboy    0

Aldeboy
Postado

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:56:25, on 26/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Winamp\winampa.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Arquivos de programas\uTorrent\uTorrent.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Arquivos de programas\Opera\opera.exe

C:\Documents and Settings\Aldemir\Desktop\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portuguese.eazel.com/pt/index.php?r...&d=79919176

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll (file missing)

O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [Long Internet Team Stupid] C:\Documents and Settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [uTorrent] "C:\Arquivos de programas\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [Web remote] C:\DOCUME~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe

O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

 

--

End of file - 9233 bytes

Compartilhar este post

Link para o post
Compartilhar em outros sites

MGuitar    11

MGuitar
Postado

- Faça o download do ComboFix e salve-o na área de trabalho;

 

● Desative temporariamente o seu antivirus para não detectar a ferramenta como vírus;

● Duplo clique no ícone combofix.exe para iniciar o scan;

● Leia o contrato que aparecerá e clique em Sim para continuar;

● Abrirá uma janela do Console de Recuperação, clique em Sim para instalar. Se aparecer outra janela do Console, clique em OK > Sim;

● Aguarde enquanto o ComboFix faz o scan;

● Se ocorrer algum problema durante o scan, reinicie seu computador em Modo de Segurança e repita o procedimento;

● Não clique na janela do ComboFix e procure não utilizar o teclado também, para não atrapalhar a varredura da ferramenta;

● Se quiser sair ou parar o ComboFix, tecle N;

● Quando terminar seu micro será reiniciado. Após o reinicio, a ferramenta executará novamente, aguarde;

● Será gerado um log em C:\ComboFix.txt.

 

Cole este log em sua próxima resposta.

Compartilhar este post

Link para o post
Compartilhar em outros sites

Aldeboy    0

Aldeboy
Postado

ComboFix 08-12-26.03 - Aldemir 2008-12-26 23:45:49.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1023.637 [GMT -2:00]

Executando de: c:\documents and settings\Aldemir\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)

AV: avast! antivirus 4.8.1296 [VPS 081226-0] *On-access scanning disabled* (Outdated)

* Criado um novo ponto de restauro

.

 

(((((((((((((((( Arquivos/Ficheiros criados de 2008-11-27 to 2008-12-27 ))))))))))))))))))))))))))))

.

 

2008-12-23 16:32 . 2008-12-23 16:32 <DIR> d-------- c:\documents and settings\Aldemir\Dados de aplicativos\Miranda

2008-12-23 12:34 . 2008-12-23 12:35 <DIR> d-------- C:\CCleaner

2008-12-22 00:17 . 2008-12-26 09:32 <DIR> d-------- C:\Lop SD

2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive

2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Microsoft

2008-12-19 19:35 . 2008-12-19 19:35 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Windows Live

2008-12-16 19:07 . 2008-12-16 19:07 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\FLEXnet

2008-12-15 15:21 . 2008-12-15 15:22 <DIR> d-------- C:\DUCTILCAD

2008-12-15 10:04 . 2008-12-15 10:04 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2008-12-15 09:57 . 2008-12-15 09:57 <DIR> d-------- C:\backups

2008-12-15 09:55 . 2007-06-28 14:36 401,720 --a------ C:\HijackThis.exe

2008-12-15 08:58 . 2008-12-15 08:59 <DIR> d-------- c:\arquivos de programas\Bonjour

2008-12-15 08:44 . 2008-12-15 08:44 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Macrovision Shared

2008-12-14 18:24 . 2008-12-21 15:15 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery

2008-12-14 18:24 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx

2008-12-14 14:20 . 2008-12-14 14:20 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\SWF Studio

2008-12-14 13:32 . 2005-05-03 08:43 69,632 -r------- c:\windows\Alcmtr.exe

2008-12-14 13:07 . 2008-12-14 13:07 <DIR> d-------- C:\!KillBox

2008-12-14 12:49 . 2008-12-14 12:49 230 --a------ c:\windows\system32\spupdsvc.inf

2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ c:\windows\system32\sirenacm.dll

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-27 01:41 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\uTorrent

2008-12-25 23:18 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\Orbit

2008-12-23 17:44 66,872 ----a-w c:\windows\system32\PnkBstrA.exe

2008-12-23 14:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-12-21 17:06 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2008-12-19 22:30 --------- d-----w c:\arquivos de programas\Windows Live

2008-12-18 20:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\avg8

2008-12-15 10:58 --------- d-----w c:\arquivos de programas\Arquivos comuns\Adobe

2008-12-15 10:01 --------- d-----w c:\arquivos de programas\Messenger Plus! Live

2008-12-14 16:20 1,386,496 ----a-w c:\windows\system32\msvbvm60.dll

2008-12-14 15:32 --------- d-----w c:\arquivos de programas\Realtek

2008-12-13 01:49 183,112 ----a-w c:\windows\system32\PnkBstrB.exe

2008-12-13 01:49 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys

2008-11-29 12:20 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\AdobeUM

2008-11-24 08:41 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\Leadertech

2008-11-19 18:57 --------- d-----w c:\arquivos de programas\C-evo2

2008-11-12 19:53 --------- d-----w c:\arquivos de programas\GameVicio

2008-11-09 19:29 --------- d-----w c:\arquivos de programas\Megacubo

2008-11-01 19:47 --------- d-----w c:\arquivos de programas\Aide PDF to DXF Converter

2008-10-27 12:54 --------- d-----w c:\arquivos de programas\One-click Ringtone Converter

2008-08-05 00:25 88 --sh--r c:\windows\system32\FEA71E9E71.sys

2008-08-05 00:26 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys

.

 

((((((((((((((((((((((((((((( snapshot@2008-12-15_ 8.35.29,60 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-11-24 08:31:28 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll

+ 2008-12-20 17:50:13 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll

- 2008-11-24 08:31:29 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll

+ 2008-12-20 17:50:13 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll

- 2008-11-24 08:31:29 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll

+ 2008-12-20 17:50:13 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll

- 2008-11-24 08:31:24 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:06 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:25 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:07 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:26 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:08 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:26 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:08 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:26 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:09 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:27 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:10 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:27 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:10 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:27 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:10 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:27 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:11 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:29 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

+ 2008-12-20 17:50:14 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll

- 2008-11-24 08:31:29 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll

+ 2008-12-20 17:50:14 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll

- 2008-11-24 08:31:30 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll

+ 2008-12-20 17:50:15 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll

- 2008-11-24 08:31:30 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll

+ 2008-12-20 17:50:15 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll

- 2008-11-24 08:31:30 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll

+ 2008-12-20 17:50:15 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll

- 2008-11-24 08:31:28 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll

+ 2008-12-20 17:50:13 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\ARPPRODUCTICON.exe

+ 2008-12-20 17:59:57 8,854 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut2_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 8,854 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut21_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut3_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut31_46F42615BA3145A0BE102D2119749E95_1.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut32_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut4_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut41_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut42_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut5_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut51_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut6_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut71_46F42615BA3145A0BE102D2119749E95.exe

+ 2008-12-19 22:30:05 62,288 ----a-r c:\windows\Installer\{844649F4-8B62-4B1F-85D9-F3098DF32F3C}\IconWlc.exe

+ 2008-12-19 22:31:11 80,395 ----a-r c:\windows\Installer\{C8DD4EAD-674B-461B-94D5-4C80CCFB8401}\MsblIco.Exe

+ 2006-02-28 14:41:34 61,440 ----a-w c:\windows\system32\dns-sd.exe

+ 2006-02-28 14:41:22 53,248 ----a-w c:\windows\system32\dnssd.dll

- 2008-10-20 18:22:23 352,976 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2008-12-15 12:03:08 1,639,576 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2007-03-21 22:54:16 77,312 ----a-w c:\windows\system32\TWAIN_32.DLL

+ 2007-03-21 22:54:16 48,560 ----a-w c:\windows\system32\TWUNK_16.EXE

+ 2007-03-21 22:54:16 69,632 ----a-w c:\windows\system32\TWUNK_32.EXE

+ 2008-12-21 00:38:18 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_60c.dat

+ 2006-06-05 16:14:28 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll

+ 2006-06-05 16:14:28 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll

+ 2006-06-05 16:14:28 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll

+ 2007-11-06 22:23:58 224,768 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll

+ 2007-11-07 03:19:34 568,832 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll

+ 2007-11-07 03:19:34 655,872 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll

.

-- Snapshot resetado para data atual --

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

"uTorrent"="c:\arquivos de programas\uTorrent\uTorrent.exe" [2008-10-13 270128]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]

"SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"Google Update"="c:\documents and settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]

"MessengerPlus3"="c:\arquivos de programas\MessengerPlus! 3\MsgPlus.exe" [2008-07-26 190024]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-20 7680000]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-20 86016]

"WinampAgent"="c:\arquivos de programas\Winamp\winampa.exe" [2008-07-09 36352]

"Long Internet Team Stupid"="c:\documents and settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe" [bU]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [2007-06-15 c:\windows\SkyTel.exe]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\EA GAMES\\Need For Speed Underground\\Speed.exe"=

"c:\\Arquivos de programas\\Opera\\opera.exe"=

"c:\\Documents and Settings\\Aldemir\\Meus documentos\\Downloads\\Counter-Strike 1.6 + Half-Life\\hl.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\Megacubo\\megacubo.exe"=

"d:\\Arquivos de programas\\Aspyr\\Guitar Hero III\\GH3.exe"=

"d:\\Arquivos de programas\\amsn\\bin\\wish.exe"=

"d:\\Arquivos de programas\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"=

"c:\\Arquivos de programas\\Arquivos comuns\\Nero\\Nero Web\\SetupX.exe"=

"d:\\Arquivos de programas\\Microsoft Games\\Age of Empires III\\age3.exe"=

"c:\\Documents and Settings\\Aldemir\\Configurações locais\\Dados de aplicativos\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"d:\\Arquivos de programas\\Aspyr\\Guitar Hero Aerosmith\\Guitar Hero Aerosmith.exe"=

"d:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

 

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-14 111184]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-07-26 97928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-14 20560]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [2008-07-26 875288]

R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 231704]

R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-26 76040]

R3 SNPPRO;USB PC Camera (snppro);c:\windows\system32\DRIVERS\snppro.sys [2008-09-11 10186496]

R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2008-07-26 30368]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c08f748-8183-11dd-869b-001e8cdb2b41}]

\Shell\AutoRun\command - CONFIG\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe

\Shell\open\command - CONFIG\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe

.

Conteúdo da pasta 'Tarefas Agendadas'

 

2008-12-27 c:\windows\Tasks\B09177379072EB83.job

- c:\docume~1\aldemir\dadosd~1\softin~1\store second one.exe []

 

2008-12-26 c:\windows\Tasks\GoogleUpdateTaskUser.job

- c:\documents and settings\Aldemir\Configura []

.

- - - - ORFÃOS REMOVIDOS - - - -

 

HKCU-Run-Web remote - c:\docume~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe

 

 

.

------- Scan Suplementar -------

.

uStart Page = hxxp://portuguese.eazel.com/pt/index.php?rvs=hompag&d=79919176

IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Aldemir\Dados de aplicativos\Mozilla\Firefox\Profiles\2v6axl0o.default\

FF - prefs.js: browser.startup.homepage - hxxp://pt-BR.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pt-BR:official

FF - component: c:\arquivos de programas\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\arquivos de programas\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\npdivx32.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\nprpjplug.dll

FF - plugin: c:\arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll

 

ATTENTION: FIREFOX POLICES IS IN FORCE

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-26 23:48:26

Windows 5.1.2600 Service Pack 2 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

 

- - - - - - - > 'winlogon.exe'(720)

c:\windows\system32\avgrsstx.dll

 

- - - - - - - > 'lsass.exe'(804)

c:\windows\system32\avgrsstx.dll

.

Tempo para conclusão: 2008-12-26 23:49:13

ComboFix-quarantined-files.txt 2008-12-27 01:49:11

ComboFix2.txt 2008-12-20 17:47:16

ComboFix3.txt 2008-12-15 10:36:02

 

Pré-execução: 5.960.720.384 bytes disponíveis

Pós execução: 5,975,633,920 bytes disponíveis

 

247 --- E O F --- 2008-07-30 06:00:45

Compartilhar este post

Link para o post
Compartilhar em outros sites

MGuitar    11

MGuitar
Postado

Delete a pasta C:\Qoobox e o log C:\ComboFix.txt.

 

Selecione e copie este conteúdo abaixo (começando de File). Cole o conteudo copiado dentro do bloco de notas de seu PC e salve-o no desktop como CFScript.txt

 

File::

c:\documents and settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe

c:\windows\Tasks\B09177379072EB83.job

c:\docume~1\aldemir\dadosd~1\softin~1\store second one.exe

Folder::

C:\!KillBox

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Long Internet Team Stupid"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000000

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c08f748-8183-11dd-869b-001e8cdb2b41}]

DirLook::

C:\backups

 

Arraste o CFScript para o ComboFix como na imagem aqui abaixo e aguarde a execução automática da ferramenta:

 

CFScript.gif

 

● Se for solicitado à você, pressione Enter para iniciar o processo de remoção;

● Não use o mouse nem o teclado quando o ComboFix estiver rodando;

● Quando terminar, será gerado um novo log que estará em C:\ComboFix.txt;

● Talvez seu computador seja reiniciado automaticamente. Caso não ocorra, reinicie-o manualmente.

 

Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.

Compartilhar este post

Link para o post
Compartilhar em outros sites

Aldeboy    0

Aldeboy
Postado

Log HiJackThis

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:56:25, on 26/12/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Winamp\winampa.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Arquivos de programas\uTorrent\uTorrent.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Arquivos de programas\Opera\opera.exe

C:\Documents and Settings\Aldemir\Desktop\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portuguese.eazel.com/pt/index.php?r...&d=79919176

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll (file missing)

O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [Long Internet Team Stupid] C:\Documents and Settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [uTorrent] "C:\Arquivos de programas\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [Web remote] C:\DOCUME~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe

O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

 

--

End of file - 9233 bytes

 

 

Log ComboFix

 

ComboFix 08-12-29.01 - Aldemir 2008-12-30 0:01:09.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1023.400 [GMT -2:00]

Executando de: c:\documents and settings\Aldemir\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Aldemir\Desktop\CFScript.txt

* Criado um novo ponto de restauro

 

FILE ::

c:\docume~1\aldemir\dadosd~1\softin~1\store second one.exe

c:\documents and settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe

c:\windows\Tasks\B09177379072EB83.job

.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\!KillBox

c:\!killbox\Logs\kb.log

c:\windows\Tasks\B09177379072EB83.job

 

.

(((((((((((((((( Arquivos/Ficheiros criados de 2008-11-28 to 2008-12-30 ))))))))))))))))))))))))))))

.

 

2008-12-23 16:32 . 2008-12-23 16:32 <DIR> d-------- c:\documents and settings\Aldemir\Dados de aplicativos\Miranda

2008-12-23 12:34 . 2008-12-23 12:35 <DIR> d-------- C:\CCleaner

2008-12-22 00:17 . 2008-12-26 09:32 <DIR> d-------- C:\Lop SD

2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive

2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Microsoft

2008-12-19 19:35 . 2008-12-19 19:35 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Windows Live

2008-12-16 19:07 . 2008-12-16 19:07 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\FLEXnet

2008-12-15 15:21 . 2008-12-15 15:22 <DIR> d-------- C:\DUCTILCAD

2008-12-15 10:04 . 2008-12-15 10:04 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2008-12-15 09:57 . 2008-12-15 09:57 <DIR> d-------- C:\backups

2008-12-15 09:55 . 2007-06-28 14:36 401,720 --a------ C:\HijackThis.exe

2008-12-15 08:58 . 2008-12-15 08:59 <DIR> d-------- c:\arquivos de programas\Bonjour

2008-12-15 08:44 . 2008-12-15 08:44 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Macrovision Shared

2008-12-14 18:24 . 2008-12-21 15:15 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery

2008-12-14 18:24 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx

2008-12-14 14:20 . 2008-12-14 14:20 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\SWF Studio

2008-12-14 13:32 . 2005-05-03 08:43 69,632 -r------- c:\windows\Alcmtr.exe

2008-12-14 12:49 . 2008-12-14 12:49 230 --a------ c:\windows\system32\spupdsvc.inf

2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ c:\windows\system32\sirenacm.dll

2008-11-24 06:45 . 2008-12-12 23:49 183,112 --a------ c:\windows\system32\PnkBstrB.exe

2008-11-24 06:45 . 2008-12-12 23:49 138,184 --a------ c:\windows\system32\drivers\PnkBstrK.sys

2008-11-24 06:45 . 2008-12-23 15:44 66,872 --a------ c:\windows\system32\PnkBstrA.exe

2008-11-24 06:41 . 2008-11-24 06:41 <DIR> d-------- c:\documents and settings\Aldemir\Dados de aplicativos\Leadertech

2008-11-24 06:40 . 2008-11-24 06:40 <DIR> d-------- c:\windows\system32\LogFiles

2008-11-19 16:57 . 2008-11-19 16:57 <DIR> d-------- c:\arquivos de programas\C-evo2

2008-11-12 17:53 . 2008-11-12 17:53 <DIR> d-------- c:\arquivos de programas\GameVicio

2008-11-06 16:48 . 2007-12-03 02:10 644,400 --a------ c:\windows\system32\MSCOMCT2.OCX

2008-11-06 16:27 . 2008-11-06 16:27 <DIR> d-------- c:\windows\system32\URTTEMP

2008-11-01 17:47 . 2008-11-01 17:47 <DIR> d-------- c:\arquivos de programas\Aide PDF to DXF Converter

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-30 02:01 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\uTorrent

2008-12-25 23:18 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\Orbit

2008-12-23 14:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-12-21 17:06 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2008-12-19 22:30 --------- d-----w c:\arquivos de programas\Windows Live

2008-12-18 20:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\avg8

2008-12-15 10:58 --------- d-----w c:\arquivos de programas\Arquivos comuns\Adobe

2008-12-15 10:01 --------- d-----w c:\arquivos de programas\Messenger Plus! Live

2008-12-14 16:20 1,386,496 ----a-w c:\windows\system32\msvbvm60.dll

2008-12-14 15:32 --------- d-----w c:\arquivos de programas\Realtek

2008-11-29 12:20 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\AdobeUM

2008-11-09 19:29 --------- d-----w c:\arquivos de programas\Megacubo

2008-08-05 00:25 88 --sh--r c:\windows\system32\FEA71E9E71.sys

2008-08-05 00:26 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys

.

 

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

---- Directory of C:\backups ----

 

2008-12-15 09:57 95 --a------ c:\backups\backup-20081215-095736-173

2008-12-15 09:57 95 --a------ c:\backups\backup-20081215-095735-833

2008-12-15 09:57 86 --a------ c:\backups\backup-20081215-095736-157

2008-12-15 09:57 79 --a------ c:\backups\backup-20081215-095736-115

2008-12-15 09:57 76 --a------ c:\backups\backup-20081215-095736-491

2008-12-15 09:57 74 --a------ c:\backups\backup-20081215-095736-218

2008-12-15 09:57 64 --a------ c:\backups\backup-20081215-095736-883

2008-12-15 09:57 44 --a------ c:\backups\backup-20081215-095736-655

2008-12-15 09:57 39 --a------ c:\backups\backup-20081215-095736-613

2008-12-15 09:57 151 --a------ c:\backups\backup-20081215-095736-285

2008-12-15 09:57 150 --a------ c:\backups\backup-20081215-095735-467

2008-12-15 09:57 139 --a------ c:\backups\backup-20081215-095736-473

2008-12-15 09:57 138 --a------ c:\backups\backup-20081215-095735-647

2008-12-15 09:57 133 --a------ c:\backups\backup-20081215-095736-849

2008-12-15 09:57 129 --a------ c:\backups\backup-20081215-095735-544

2008-12-15 09:57 120 --a------ c:\backups\backup-20081215-095736-702

2008-12-15 09:57 120 --a------ c:\backups\backup-20081215-095735-237

2008-12-15 09:57 119 --a------ c:\backups\backup-20081215-095735-490

2008-12-15 09:57 117 --a------ c:\backups\backup-20081215-095735-772

2008-12-15 09:57 113 --a------ c:\backups\backup-20081215-095736-809

2008-12-15 09:57 113 --a------ c:\backups\backup-20081215-095735-838

2008-12-15 09:57 112 --a------ c:\backups\backup-20081215-095735-823

2008-12-15 09:57 111 --a------ c:\backups\backup-20081215-095735-575

2008-12-15 09:57 109 --a------ c:\backups\backup-20081215-095736-679

2008-08-30 10:27 455960 --a------ c:\backups\backup-20081215-095735-647.dll

2008-07-26 16:26 2055960 --a------ c:\backups\backup-20081215-095736-679.dll

2008-07-21 18:57 126152 --a------ c:\backups\backup-20081215-095735-237.dll

2008-07-07 10:41 1562448 --a------ c:\backups\backup-20081215-095735-838.dll

2003-05-15 02:03 147456 --a------ c:\backups\backup-20081215-095736-285.dll

2003-05-15 01:47 50376 --a------ c:\backups\backup-20081215-095735-467.dll

 

 

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

"uTorrent"="c:\arquivos de programas\uTorrent\uTorrent.exe" [2008-10-13 270128]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312]

"SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"Google Update"="c:\documents and settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]

"MessengerPlus3"="c:\arquivos de programas\MessengerPlus! 3\MsgPlus.exe" [2008-07-26 190024]

"Web remote"="c:\docume~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe" [bU]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-20 7680000]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-20 86016]

"WinampAgent"="c:\arquivos de programas\Winamp\winampa.exe" [2008-07-09 36352]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [2007-06-15 c:\windows\SkyTel.exe]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\EA GAMES\\Need For Speed Underground\\Speed.exe"=

"c:\\Arquivos de programas\\Opera\\opera.exe"=

"c:\\Documents and Settings\\Aldemir\\Meus documentos\\Downloads\\Counter-Strike 1.6 + Half-Life\\hl.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\Megacubo\\megacubo.exe"=

"d:\\Arquivos de programas\\Aspyr\\Guitar Hero III\\GH3.exe"=

"d:\\Arquivos de programas\\amsn\\bin\\wish.exe"=

"d:\\Arquivos de programas\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"=

"c:\\Arquivos de programas\\Arquivos comuns\\Nero\\Nero Web\\SetupX.exe"=

"d:\\Arquivos de programas\\Microsoft Games\\Age of Empires III\\age3.exe"=

"c:\\Documents and Settings\\Aldemir\\Configurações locais\\Dados de aplicativos\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"d:\\Arquivos de programas\\Aspyr\\Guitar Hero Aerosmith\\Guitar Hero Aerosmith.exe"=

"d:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

 

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-14 111184]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-07-26 97928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-14 20560]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [2008-07-26 875288]

R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 231704]

R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-26 76040]

R3 SNPPRO;USB PC Camera (snppro);c:\windows\system32\DRIVERS\snppro.sys [2008-09-11 10186496]

R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2008-07-26 30368]

 

*Newly Created Service* - CATCHME

.

Conteúdo da pasta 'Tarefas Agendadas'

 

2008-12-30 c:\windows\Tasks\GoogleUpdateTaskUser.job

- c:\documents and settings\Aldemir\Configura []

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://portuguese.eazel.com/pt/index.php?rvs=hompag&d=79919176

IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Aldemir\Dados de aplicativos\Mozilla\Firefox\Profiles\2v6axl0o.default\

FF - prefs.js: browser.startup.homepage - hxxp://pt-BR.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pt-BR:official

FF - component: c:\arquivos de programas\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\arquivos de programas\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\npdivx32.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\nprpjplug.dll

FF - plugin: c:\arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll

 

ATTENTION: FIREFOX POLICES IS IN FORCE

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-30 00:03:01

Windows 5.1.2600 Service Pack 2 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

 

- - - - - - - > 'winlogon.exe'(720)

c:\windows\system32\avgrsstx.dll

 

- - - - - - - > 'lsass.exe'(804)

c:\windows\system32\avgrsstx.dll

.

Tempo para conclusão: 2008-12-30 0:03:51

ComboFix-quarantined-files.txt 2008-12-30 02:03:48

ComboFix2.txt 2008-12-27 01:49:16

ComboFix3.txt 2008-12-20 17:47:16

ComboFix4.txt 2008-12-15 10:36:02

 

Pré-execução: 5.840.117.760 bytes disponíveis

Pós execução: 5,844,393,984 bytes disponíveis

 

213 --- E O F --- 2008-07-30 06:00:45

Compartilhar este post

Link para o post
Compartilhar em outros sites

Mário Monteiro    179

Mário Monteiro
Postado

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.

Compartilhar este post

Link para o post
Compartilhar em outros sites
Ir para a lista de tópicos Tópicos Arquivados (Seguranca & Malwares)
×

Informação importante

Ao usar o fórum, você concorda com nossos Termos e condições.

  Aceito