Aldeboy 0 Denunciar post Postado Dezembro 22, 2008 segue o LOG do HiJack Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:25:11, on 22/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\ARQUIV~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Arquivos de programas\Winamp\winampa.exe C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe C:\Arquivos de programas\Bonjour\mDNSResponder.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\ARQUIV~1\AVG\AVG8\avgrsx.exe C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Orbitdownloader\orbitdm.exe C:\ARQUIV~1\AVG\AVG8\avgemc.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Arquivos de programas\Orbitdownloader\orbitnet.exe D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\ARQUIV~1\AVG\AVG8\avgupd.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\Arquivos de programas\Opera\opera.exe C:\Arquivos de programas\uTorrent\uTorrent.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Aldemir\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portuguese.eazel.com/pt/index.php?r...&d=79919176 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (file missing) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Long Internet Team Stupid] C:\Documents and Settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [skyTel] SkyTel.EXE O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe" O4 - HKCU\..\Run: [Web remote] C:\DOCUME~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [uTorrent] "C:\Arquivos de programas\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 9649 bytes e do LopSD --------------------\\ Lop S&D 4.2.5-0 XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : AMD Athlon 64 X2 Dual Core Processor 4800+ ) BIOS : BIOS Date: 12/04/07 17:14:27 Ver: 08.00.12 USER : Aldemir ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Activated) C:\ (Local Disk) - NTFS - Total:49 Go (Free:5 Go) D:\ (Local Disk) - NTFS - Total:182 Go (Free:25 Go) F:\ (CD or DVD) G:\ (CD or DVD) I:\ (CD or DVD) "C:\Lop SD" ( MAJ : 19-12-2008|23:40 ) Option : [1] ( seg 22/12/2008| 0:18 ) --------------------\\ Lista de pastas em DADOSD~1 [16/12/2008|19:32] C:\DOCUME~1\Aldemir\DADOSD~1\Adobe [29/11/2008|10:20] C:\DOCUME~1\Aldemir\DADOSD~1\AdobeUM [27/07/2008|00:05] C:\DOCUME~1\Aldemir\DADOSD~1\Autodesk [27/07/2008|14:05] C:\DOCUME~1\Aldemir\DADOSD~1\AVGTOOLBAR [12/10/2008|18:48] C:\DOCUME~1\Aldemir\DADOSD~1\CmapTools [25/08/2008|20:51] C:\DOCUME~1\Aldemir\DADOSD~1\Corel [26/07/2008|17:22] C:\DOCUME~1\Aldemir\DADOSD~1\DAEMON Tools [17/08/2008|14:18] C:\DOCUME~1\Aldemir\DADOSD~1\DivX [19/10/2008|16:52] C:\DOCUME~1\Aldemir\DADOSD~1\fretsonfire [28/07/2008|18:34] C:\DOCUME~1\Aldemir\DADOSD~1\Google [29/07/2008|23:52] C:\DOCUME~1\Aldemir\DADOSD~1\GrabPro [26/07/2008|15:04] C:\DOCUME~1\Aldemir\DADOSD~1\Identities [26/07/2008|15:13] C:\DOCUME~1\Aldemir\DADOSD~1\InstallShield [24/11/2008|06:41] C:\DOCUME~1\Aldemir\DADOSD~1\Leadertech [26/07/2008|18:15] C:\DOCUME~1\Aldemir\DADOSD~1\Macromedia [15/08/2008|22:56] C:\DOCUME~1\Aldemir\DADOSD~1\Media Player Classic [14/12/2008|19:10] C:\DOCUME~1\Aldemir\DADOSD~1\Microsoft [26/07/2008|15:33] C:\DOCUME~1\Aldemir\DADOSD~1\Mozilla [23/08/2008|17:38] C:\DOCUME~1\Aldemir\DADOSD~1\Nero [28/07/2008|18:03] C:\DOCUME~1\Aldemir\DADOSD~1\Opera [21/12/2008|15:07] C:\DOCUME~1\Aldemir\DADOSD~1\Orbit [20/08/2008|17:21] C:\DOCUME~1\Aldemir\DADOSD~1\Pegasys Inc [10/11/2008|18:20] C:\DOCUME~1\Aldemir\DADOSD~1\Real [29/08/2008|16:26] C:\DOCUME~1\Aldemir\DADOSD~1\SecuROM [14/12/2008|14:58] C:\DOCUME~1\Aldemir\DADOSD~1\soft intra bird [22/12/2008|00:18] C:\DOCUME~1\Aldemir\DADOSD~1\uTorrent [17/10/2008|20:49] C:\DOCUME~1\Aldemir\DADOSD~1\Winamp [26/07/2008|18:21] C:\DOCUME~1\Aldemir\DADOSD~1\WinRAR [15/12/2008|09:00] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Adobe [26/07/2008|23:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Autodesk [18/12/2008|18:40] C:\DOCUME~1\ALLUSE~1\DADOSD~1\avg8 [14/12/2008|15:10] C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet [20/09/2008|10:28] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Corel [16/12/2008|19:07] C:\DOCUME~1\ALLUSE~1\DADOSD~1\FLEXnet [21/12/2008|15:16] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google [25/08/2008|20:50] C:\DOCUME~1\ALLUSE~1\DADOSD~1\InstallShield [15/12/2008|10:04] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Messenger Plus! [19/12/2008|20:30] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft [26/10/2008|19:41] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft Help [23/08/2008|17:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Nero [13/08/2008|12:02] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NFS Underground [14/10/2008|17:01] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NVIDIA [26/07/2008|19:12] C:\DOCUME~1\ALLUSE~1\DADOSD~1\nView_Profiles [28/07/2008|18:59] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Real [28/07/2008|18:30] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy [08/10/2008|18:01] C:\DOCUME~1\CONVID~1\DADOSD~1\AVGTOOLBAR [14/10/2008|11:14] C:\DOCUME~1\CONVID~1\DADOSD~1\DivX [08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Identities [08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Microsoft [10/10/2008|22:03] C:\DOCUME~1\CONVID~1\DADOSD~1\Mozilla [10/10/2008|22:01] C:\DOCUME~1\CONVID~1\DADOSD~1\Opera [14/10/2008|21:28] C:\DOCUME~1\CONVID~1\DADOSD~1\Orbit [14/10/2008|10:57] C:\DOCUME~1\CONVID~1\DADOSD~1\Winamp [26/07/2008|14:51] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Microsoft [26/07/2008|16:26] C:\DOCUME~1\LOCALS~1\DADOSD~1\Microsoft [26/07/2008|16:26] C:\DOCUME~1\NETWOR~1\DADOSD~1\Microsoft --------------------\\ Tarefas Agendadas na pasta C:\WINDOWS\Tasks [22/12/2008 00:00][--ah-----] C:\WINDOWS\tasks\ACF2C7C2918D7A0A.job [21/12/2008 21:52][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job [21/12/2008 15:06][--ah-----] C:\WINDOWS\tasks\SA.DAT [28/10/2001 16:07][-r-h-----] C:\WINDOWS\tasks\desktop.ini ( ACF2C7C2918D7A0A.job )=( c:\docume~1\aldemir\dadosd~1\softin~1\storesecondone.exe ) --------------------\\ Lista de pastas em C:\Arquivos de programas [15/12/2008|08:55] C:\Arquivos de programas\Adobe [01/11/2008|17:47] C:\Arquivos de programas\Aide PDF to DXF Converter [26/07/2008|23:36] C:\Arquivos de programas\AnswerWorks 4.0 [20/12/2008|15:45] C:\Arquivos de programas\Arquivos comuns [26/07/2008|23:37] C:\Arquivos de programas\AutoCAD 2007 [26/07/2008|23:15] C:\Arquivos de programas\Autodesk [26/07/2008|16:26] C:\Arquivos de programas\AVG [16/08/2008|15:19] C:\Arquivos de programas\AviSynth 2.5 [16/08/2008|15:32] C:\Arquivos de programas\AVIXDVD [15/12/2008|08:59] C:\Arquivos de programas\Bonjour [19/11/2008|16:57] C:\Arquivos de programas\C-evo2 [26/07/2008|14:48] C:\Arquivos de programas\ComPlus Applications [25/08/2008|21:23] C:\Arquivos de programas\Conduit [20/09/2008|10:28] C:\Arquivos de programas\Corel [26/07/2008|23:06] C:\Arquivos de programas\DAEMON Tools Lite [20/08/2008|17:20] C:\Arquivos de programas\DivX [13/08/2008|11:33] C:\Arquivos de programas\EA GAMES [26/07/2008|19:48] C:\Arquivos de programas\FineRecovery [02/08/2008|14:45] C:\Arquivos de programas\Free FLV to AVI Video Converter [12/11/2008|17:53] C:\Arquivos de programas\GameVicio [28/07/2008|18:33] C:\Arquivos de programas\Google [21/12/2008|15:06] C:\Arquivos de programas\InstallShield Installation Information [14/12/2008|12:51] C:\Arquivos de programas\Internet Explorer [05/10/2008|20:52] C:\Arquivos de programas\Justiça Eleitoral [28/07/2008|18:59] C:\Arquivos de programas\K-Lite Codec Pack [26/07/2008|23:11] C:\Arquivos de programas\LG mobile [10/08/2008|16:14] C:\Arquivos de programas\Maxis [09/11/2008|17:29] C:\Arquivos de programas\Megacubo [26/07/2008|20:36] C:\Arquivos de programas\Messenger [15/12/2008|08:01] C:\Arquivos de programas\Messenger Plus! Live [21/12/2008|15:15] C:\Arquivos de programas\MessengerDiscovery [26/07/2008|15:51] C:\Arquivos de programas\MessengerPlus! 3 [19/12/2008|20:30] C:\Arquivos de programas\Microsoft [26/07/2008|14:51] C:\Arquivos de programas\microsoft frontpage [25/08/2008|23:22] C:\Arquivos de programas\Microsoft IntelliPoint 5.2 [22/08/2008|21:02] C:\Arquivos de programas\Microsoft Office [30/07/2008|12:56] C:\Arquivos de programas\Microsoft Visual Studio [22/08/2008|20:56] C:\Arquivos de programas\Microsoft Visual Studio 8 [22/08/2008|21:03] C:\Arquivos de programas\Microsoft Works [22/08/2008|21:01] C:\Arquivos de programas\Microsoft.NET [26/07/2008|14:49] C:\Arquivos de programas\Movie Maker [18/12/2008|23:49] C:\Arquivos de programas\Mozilla Firefox [22/08/2008|21:02] C:\Arquivos de programas\MSBuild [26/07/2008|14:48] C:\Arquivos de programas\MSN Gaming Zone [29/07/2008|04:00] C:\Arquivos de programas\MSXML 4.0 [23/08/2008|17:35] C:\Arquivos de programas\Nero [23/08/2008|17:38] C:\Arquivos de programas\NeroInstall.bak [26/07/2008|14:49] C:\Arquivos de programas\NetMeeting [26/07/2008|15:15] C:\Arquivos de programas\NVIDIA Corporation [27/10/2008|10:54] C:\Arquivos de programas\One-click Ringtone Converter [28/07/2008|18:03] C:\Arquivos de programas\Opera [18/12/2008|08:00] C:\Arquivos de programas\Orbitdownloader [26/07/2008|14:49] C:\Arquivos de programas\Outlook Express [25/08/2008|21:23] C:\Arquivos de programas\RadarSync [26/07/2008|18:35] C:\Arquivos de programas\Raptor_Shareware [14/12/2008|13:32] C:\Arquivos de programas\Realtek [26/07/2008|14:50] C:\Arquivos de programas\Serviços on-line [11/12/2008|23:45] C:\Arquivos de programas\soft intra bird [12/09/2008|23:04] C:\Arquivos de programas\SopCast [28/07/2008|18:29] C:\Arquivos de programas\Spybot - Search & Destroy [17/08/2008|16:07] C:\Arquivos de programas\sub2divx [25/08/2008|21:24] C:\Arquivos de programas\The Weather Channel FW [26/07/2008|15:04] C:\Arquivos de programas\Uninstall Information [27/08/2008|17:18] C:\Arquivos de programas\Unity [26/07/2008|17:24] C:\Arquivos de programas\uTorrent [17/10/2008|20:46] C:\Arquivos de programas\Winamp [19/12/2008|20:30] C:\Arquivos de programas\Windows Live [19/12/2008|20:30] C:\Arquivos de programas\Windows Live SkyDrive [23/08/2008|17:34] C:\Arquivos de programas\Windows Media Player [26/07/2008|14:48] C:\Arquivos de programas\Windows NT [26/07/2008|14:50] C:\Arquivos de programas\WindowsUpdate [03/08/2008|00:56] C:\Arquivos de programas\WinRAR [26/07/2008|14:51] C:\Arquivos de programas\xerox [12/10/2008|18:44] C:\Arquivos de programas\Zero G Registry --------------------\\ Lista de pastas em C:\Arquivos de programas\Arquivos comuns [15/12/2008|08:58] C:\Arquivos de programas\Arquivos comuns\Adobe [26/07/2008|23:36] C:\Arquivos de programas\Arquivos comuns\Autodesk Shared [20/09/2008|10:28] C:\Arquivos de programas\Arquivos comuns\Corel [20/09/2008|10:29] C:\Arquivos de programas\Arquivos comuns\Designer [13/08/2008|11:36] C:\Arquivos de programas\Arquivos comuns\DirectX [25/08/2008|20:50] C:\Arquivos de programas\Arquivos comuns\InstallShield [15/12/2008|08:44] C:\Arquivos de programas\Arquivos comuns\Macrovision Shared [19/12/2008|20:30] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared [26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\MSSoap [23/08/2008|17:36] C:\Arquivos de programas\Arquivos comuns\Nero [26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\ODBC [25/08/2008|20:49] C:\Arquivos de programas\Arquivos comuns\Protexis [26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\Serviços [11/09/2008|23:54] C:\Arquivos de programas\Arquivos comuns\snppro [26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\SpeechEngines [14/12/2008|14:20] C:\Arquivos de programas\Arquivos comuns\SWF Studio [22/08/2008|21:07] C:\Arquivos de programas\Arquivos comuns\System [19/12/2008|19:35] C:\Arquivos de programas\Arquivos comuns\Windows Live --------------------\\ Process ( 53 Processes ) iexplore.exe ~ [PID:620] iexplore.exe ~ [PID:524] --------------------\\ Procura pelo S_Lop Não foram encontradas pastas com o Lop! --------------------\\ Procura por Arquivos/Ficheiros e pastas do Lop C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet\4 SURF.exe C:\DOCUME~1\Aldemir\DADOSD~1\softin~1 C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\okgmrjdg.exe C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\PlayPlatformAxisJoy.exe C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\SETUP HOPE LIST.exe C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\store second one.exe C:\Arquivos de programas\softin~1 C:\Arquivos de programas\Orbitdownloader C:\Arquivos de programas\Orbitdownloader\addons C:\Arquivos de programas\Orbitdownloader\banurl.ini C:\Arquivos de programas\Orbitdownloader\changelog.txt C:\Arquivos de programas\Orbitdownloader\download.dll C:\Arquivos de programas\Orbitdownloader\Grab.exe C:\Arquivos de programas\Orbitdownloader\GrabDll.dll C:\Arquivos de programas\Orbitdownloader\GrabKernel.dll C:\Arquivos de programas\Orbitdownloader\GrabPro.dll C:\Arquivos de programas\Orbitdownloader\idht.dll C:\Arquivos de programas\Orbitdownloader\Lang.ini C:\Arquivos de programas\Orbitdownloader\language C:\Arquivos de programas\Orbitdownloader\libeay32.dll C:\Arquivos de programas\Orbitdownloader\magic.mgc C:\Arquivos de programas\Orbitdownloader\orbitdm.exe C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll C:\Arquivos de programas\Orbitdownloader\orbitnet.exe C:\Arquivos de programas\Orbitdownloader\saction.dll C:\Arquivos de programas\Orbitdownloader\siteinfo.ini C:\Arquivos de programas\Orbitdownloader\ssleay32.dll C:\Arquivos de programas\Orbitdownloader\unins000.dat C:\Arquivos de programas\Orbitdownloader\unins000.exe C:\Arquivos de programas\Orbitdownloader\update C:\Arquivos de programas\Orbitdownloader\winfile.dll C:\DOCUME~1\Aldemir\Cookies\aldemir@www.adserver5[1].txt C:\DOCUME~1\Aldemir\Cookies\aldemir@pacificpoker[1].txt C:\DOCUME~1\Aldemir\Cookies\aldemir@www.lop[2].txt C:\WINDOWS\Tasks\ACF2C7C2918D7A0A.job --------------------\\ Procura no Registro [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Web remote"="C:\\DOCUME~1\\Aldemir\\DADOSD~1\\SOFTIN~1\\SETUP HOPE LIST.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Long Internet Team Stupid"="C:\\Documents and Settings\\All Users\\Dados de aplicativos\\comp two long internet\\Wipe Enc.exe" --------------------\\ Verificando o Arquivos/Ficheiros Hosts Arquivos/Ficheiros Hosts LIMPO --------------------\\ Procurando Arquivos/Ficheiros ocultos com o Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-22 00:19:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 1 --------------------\\ Procurando por outras infecções --------------------\\ Cracks & Keygens .. C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Adobe Photoshop CS3 Extended + Crack.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Age Of Empires 3 full DVD +crack + serial.iso.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\AutoCAD 2007 with CRACK.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Need.For.Speed.Undercover.Crack.and.Keygen.Only-RELOADED.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Nero 8 Ultra Edition 8.3.2.1b + Working Serial + Crack.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Pro.Evolution.Soccer.2008[PCDVD][spanish-EN-FR-GE-IT-POR] + CRACK + KEYGEN (Gusnor).torrent C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack\Sims2EP7.exe C:\DOCUME~1\Aldemir\Recent\AutoCAD_2007_with_CRACK.3793037.TPB.lnk [F:171][D:7]-> C:\DOCUME~1\Aldemir\CONFIG~1\Temp [F:95][D:0]-> C:\DOCUME~1\Aldemir\Cookies [F:217][D:4]-> C:\DOCUME~1\Aldemir\CONFIG~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - seg 22/12/2008| 0:21 - Option : [1] --------------------\\ Verificação completa em 0:21:54 GRATO! Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Dezembro 22, 2008 Dê um duplo clique no Lop S&D, pressione a tecla "P", digite 2 e dê um Enter. Poste o log do Lop S&D aqui, juntamente com um novo log do HijackThis. Compartilhar este post Link para o post Compartilhar em outros sites
Aldeboy 0 Denunciar post Postado Dezembro 26, 2008 Desculpe a demora, festas de fim de ano, Round One: Xmas --------------------\\ Lop S&D 4.2.5-0 XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : AMD Athlon 64 X2 Dual Core Processor 4800+ ) BIOS : BIOS Date: 12/04/07 17:14:27 Ver: 08.00.12 USER : Aldemir ( Administrator ) BOOT : Normal boot Antivirus : avast! antivirus 4.8.1296 [VPS 081225-0] 4.8.1296 (Activated) C:\ (Local Disk) - NTFS - Total:49 Go (Free:5 Go) D:\ (Local Disk) - NTFS - Total:182 Go (Free:25 Go) F:\ (CD or DVD) G:\ (CD or DVD) I:\ (CD or DVD) "C:\Lop SD" ( MAJ : 19-12-2008|23:40 ) Option : [2] ( --- 26/12/2008| 9:30 ) \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ REMOVIDOS Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\okgmrjdg.exe Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\PlayPlatformAxisJoy.exe Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\SETUP HOPE LIST.exe Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1\store second one.exe Deletado! - C:\Arquivos de programas\Orbitdownloader\addons Deletado! - C:\Arquivos de programas\Orbitdownloader\banurl.ini Deletado! - C:\Arquivos de programas\Orbitdownloader\changelog.txt Falha ! - C:\Arquivos de programas\Orbitdownloader\download.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\Grab.exe Deletado! - C:\Arquivos de programas\Orbitdownloader\GrabDll.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\GrabKernel.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll Falha ! - C:\Arquivos de programas\Orbitdownloader\idht.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\Lang.ini Deletado! - C:\Arquivos de programas\Orbitdownloader\language Deletado! - C:\Arquivos de programas\Orbitdownloader\libeay32.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\magic.mgc Deletado! - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe Deletado! - C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll Falha ! - C:\Arquivos de programas\Orbitdownloader\orbitnet.exe Deletado! - C:\Arquivos de programas\Orbitdownloader\saction.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\siteinfo.ini Deletado! - C:\Arquivos de programas\Orbitdownloader\ssleay32.dll Deletado! - C:\Arquivos de programas\Orbitdownloader\unins000.dat Deletado! - C:\Arquivos de programas\Orbitdownloader\unins000.exe Deletado! - C:\Arquivos de programas\Orbitdownloader\update Deletado! - C:\Arquivos de programas\Orbitdownloader\winfile.dll Deletado! - C:\DOCUME~1\Aldemir\Cookies\aldemir@www.adserver5[1].txt Deletado! - C:\DOCUME~1\ALLUSE~1\DADOSD~1\comp two long internet Deletado! - C:\DOCUME~1\Aldemir\DADOSD~1\softin~1 Deletado! - C:\Arquivos de programas\softin~1 Deletado! - C:\Arquivos de programas\Orbitdownloader - [ Arquivos/Ficheiros Hosts ] .. RESTAURADO \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ --------------------\\ Lista de pastas em DADOSD~1 [16/12/2008|19:32] C:\DOCUME~1\Aldemir\DADOSD~1\Adobe [29/11/2008|10:20] C:\DOCUME~1\Aldemir\DADOSD~1\AdobeUM [27/07/2008|00:05] C:\DOCUME~1\Aldemir\DADOSD~1\Autodesk [27/07/2008|14:05] C:\DOCUME~1\Aldemir\DADOSD~1\AVGTOOLBAR [12/10/2008|18:48] C:\DOCUME~1\Aldemir\DADOSD~1\CmapTools [25/08/2008|20:51] C:\DOCUME~1\Aldemir\DADOSD~1\Corel [26/07/2008|17:22] C:\DOCUME~1\Aldemir\DADOSD~1\DAEMON Tools [17/08/2008|14:18] C:\DOCUME~1\Aldemir\DADOSD~1\DivX [19/10/2008|16:52] C:\DOCUME~1\Aldemir\DADOSD~1\fretsonfire [21/12/2008|15:17] C:\DOCUME~1\Aldemir\DADOSD~1\Google [29/07/2008|23:52] C:\DOCUME~1\Aldemir\DADOSD~1\GrabPro [26/07/2008|15:04] C:\DOCUME~1\Aldemir\DADOSD~1\Identities [26/07/2008|15:13] C:\DOCUME~1\Aldemir\DADOSD~1\InstallShield [24/11/2008|06:41] C:\DOCUME~1\Aldemir\DADOSD~1\Leadertech [26/07/2008|18:15] C:\DOCUME~1\Aldemir\DADOSD~1\Macromedia [15/08/2008|22:56] C:\DOCUME~1\Aldemir\DADOSD~1\Media Player Classic [14/12/2008|19:10] C:\DOCUME~1\Aldemir\DADOSD~1\Microsoft [23/12/2008|16:32] C:\DOCUME~1\Aldemir\DADOSD~1\Miranda [26/07/2008|15:33] C:\DOCUME~1\Aldemir\DADOSD~1\Mozilla [23/08/2008|17:38] C:\DOCUME~1\Aldemir\DADOSD~1\Nero [28/07/2008|18:03] C:\DOCUME~1\Aldemir\DADOSD~1\Opera [25/12/2008|21:18] C:\DOCUME~1\Aldemir\DADOSD~1\Orbit [20/08/2008|17:21] C:\DOCUME~1\Aldemir\DADOSD~1\Pegasys Inc [10/11/2008|18:20] C:\DOCUME~1\Aldemir\DADOSD~1\Real [29/08/2008|16:26] C:\DOCUME~1\Aldemir\DADOSD~1\SecuROM [26/12/2008|09:30] C:\DOCUME~1\Aldemir\DADOSD~1\uTorrent [17/10/2008|20:49] C:\DOCUME~1\Aldemir\DADOSD~1\Winamp [26/07/2008|18:21] C:\DOCUME~1\Aldemir\DADOSD~1\WinRAR [15/12/2008|09:00] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Adobe [26/07/2008|23:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Autodesk [18/12/2008|18:40] C:\DOCUME~1\ALLUSE~1\DADOSD~1\avg8 [20/09/2008|10:28] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Corel [16/12/2008|19:07] C:\DOCUME~1\ALLUSE~1\DADOSD~1\FLEXnet [21/12/2008|15:16] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Google [25/08/2008|20:50] C:\DOCUME~1\ALLUSE~1\DADOSD~1\InstallShield [15/12/2008|10:04] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Messenger Plus! [19/12/2008|20:30] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft [26/10/2008|19:41] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft Help [23/08/2008|17:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Nero [13/08/2008|12:02] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NFS Underground [14/10/2008|17:01] C:\DOCUME~1\ALLUSE~1\DADOSD~1\NVIDIA [26/07/2008|19:12] C:\DOCUME~1\ALLUSE~1\DADOSD~1\nView_Profiles [28/07/2008|18:59] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Real [23/12/2008|12:40] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy [08/10/2008|18:01] C:\DOCUME~1\CONVID~1\DADOSD~1\AVGTOOLBAR [14/10/2008|11:14] C:\DOCUME~1\CONVID~1\DADOSD~1\DivX [08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Identities [08/10/2008|18:00] C:\DOCUME~1\CONVID~1\DADOSD~1\Microsoft [10/10/2008|22:03] C:\DOCUME~1\CONVID~1\DADOSD~1\Mozilla [10/10/2008|22:01] C:\DOCUME~1\CONVID~1\DADOSD~1\Opera [14/10/2008|21:28] C:\DOCUME~1\CONVID~1\DADOSD~1\Orbit [14/10/2008|10:57] C:\DOCUME~1\CONVID~1\DADOSD~1\Winamp [26/07/2008|14:51] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Microsoft [26/07/2008|16:26] C:\DOCUME~1\LOCALS~1\DADOSD~1\Microsoft [26/07/2008|16:26] C:\DOCUME~1\NETWOR~1\DADOSD~1\Microsoft --------------------\\ Tarefas Agendadas na pasta C:\WINDOWS\Tasks [26/12/2008 09:00][--ah-----] C:\WINDOWS\tasks\B09177379072EB83.job [26/12/2008 06:19][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job [25/12/2008 21:17][--ah-----] C:\WINDOWS\tasks\SA.DAT [28/10/2001 16:07][-r-h-----] C:\WINDOWS\tasks\desktop.ini ( B09177379072EB83.job )=( c:\docume~1\aldemir\dadosd~1\softin~1\storesecondone.exe ) --------------------\\ Lista de pastas em C:\Arquivos de programas [15/12/2008|08:55] C:\Arquivos de programas\Adobe [01/11/2008|17:47] C:\Arquivos de programas\Aide PDF to DXF Converter [26/07/2008|23:36] C:\Arquivos de programas\AnswerWorks 4.0 [20/12/2008|15:45] C:\Arquivos de programas\Arquivos comuns [26/07/2008|23:37] C:\Arquivos de programas\AutoCAD 2007 [26/07/2008|23:15] C:\Arquivos de programas\Autodesk [26/07/2008|16:26] C:\Arquivos de programas\AVG [16/08/2008|15:19] C:\Arquivos de programas\AviSynth 2.5 [16/08/2008|15:32] C:\Arquivos de programas\AVIXDVD [15/12/2008|08:59] C:\Arquivos de programas\Bonjour [19/11/2008|16:57] C:\Arquivos de programas\C-evo2 [26/07/2008|14:48] C:\Arquivos de programas\ComPlus Applications [25/08/2008|21:23] C:\Arquivos de programas\Conduit [20/09/2008|10:28] C:\Arquivos de programas\Corel [26/07/2008|23:06] C:\Arquivos de programas\DAEMON Tools Lite [20/08/2008|17:20] C:\Arquivos de programas\DivX [13/08/2008|11:33] C:\Arquivos de programas\EA GAMES [26/07/2008|19:48] C:\Arquivos de programas\FineRecovery [02/08/2008|14:45] C:\Arquivos de programas\Free FLV to AVI Video Converter [12/11/2008|17:53] C:\Arquivos de programas\GameVicio [28/07/2008|18:33] C:\Arquivos de programas\Google [21/12/2008|15:06] C:\Arquivos de programas\InstallShield Installation Information [14/12/2008|12:51] C:\Arquivos de programas\Internet Explorer [05/10/2008|20:52] C:\Arquivos de programas\Justiça Eleitoral [28/07/2008|18:59] C:\Arquivos de programas\K-Lite Codec Pack [26/07/2008|23:11] C:\Arquivos de programas\LG mobile [10/08/2008|16:14] C:\Arquivos de programas\Maxis [09/11/2008|17:29] C:\Arquivos de programas\Megacubo [26/07/2008|20:36] C:\Arquivos de programas\Messenger [15/12/2008|08:01] C:\Arquivos de programas\Messenger Plus! Live [21/12/2008|15:15] C:\Arquivos de programas\MessengerDiscovery [26/07/2008|15:51] C:\Arquivos de programas\MessengerPlus! 3 [19/12/2008|20:30] C:\Arquivos de programas\Microsoft [26/07/2008|14:51] C:\Arquivos de programas\microsoft frontpage [25/08/2008|23:22] C:\Arquivos de programas\Microsoft IntelliPoint 5.2 [22/08/2008|21:02] C:\Arquivos de programas\Microsoft Office [30/07/2008|12:56] C:\Arquivos de programas\Microsoft Visual Studio [22/08/2008|20:56] C:\Arquivos de programas\Microsoft Visual Studio 8 [22/08/2008|21:03] C:\Arquivos de programas\Microsoft Works [22/08/2008|21:01] C:\Arquivos de programas\Microsoft.NET [26/07/2008|14:49] C:\Arquivos de programas\Movie Maker [18/12/2008|23:49] C:\Arquivos de programas\Mozilla Firefox [22/08/2008|21:02] C:\Arquivos de programas\MSBuild [26/07/2008|14:48] C:\Arquivos de programas\MSN Gaming Zone [29/07/2008|04:00] C:\Arquivos de programas\MSXML 4.0 [23/08/2008|17:35] C:\Arquivos de programas\Nero [23/08/2008|17:38] C:\Arquivos de programas\NeroInstall.bak [26/07/2008|14:49] C:\Arquivos de programas\NetMeeting [26/07/2008|15:15] C:\Arquivos de programas\NVIDIA Corporation [27/10/2008|10:54] C:\Arquivos de programas\One-click Ringtone Converter [28/07/2008|18:03] C:\Arquivos de programas\Opera [26/07/2008|14:49] C:\Arquivos de programas\Outlook Express [25/08/2008|21:23] C:\Arquivos de programas\RadarSync [26/07/2008|18:35] C:\Arquivos de programas\Raptor_Shareware [14/12/2008|13:32] C:\Arquivos de programas\Realtek [26/07/2008|14:50] C:\Arquivos de programas\Serviços on-line [12/09/2008|23:04] C:\Arquivos de programas\SopCast [28/07/2008|18:29] C:\Arquivos de programas\Spybot - Search & Destroy [17/08/2008|16:07] C:\Arquivos de programas\sub2divx [25/08/2008|21:24] C:\Arquivos de programas\The Weather Channel FW [26/07/2008|15:04] C:\Arquivos de programas\Uninstall Information [27/08/2008|17:18] C:\Arquivos de programas\Unity [26/07/2008|17:24] C:\Arquivos de programas\uTorrent [17/10/2008|20:46] C:\Arquivos de programas\Winamp [19/12/2008|20:30] C:\Arquivos de programas\Windows Live [19/12/2008|20:30] C:\Arquivos de programas\Windows Live SkyDrive [23/08/2008|17:34] C:\Arquivos de programas\Windows Media Player [26/07/2008|14:48] C:\Arquivos de programas\Windows NT [26/07/2008|14:50] C:\Arquivos de programas\WindowsUpdate [03/08/2008|00:56] C:\Arquivos de programas\WinRAR [26/07/2008|14:51] C:\Arquivos de programas\xerox [12/10/2008|18:44] C:\Arquivos de programas\Zero G Registry --------------------\\ Lista de pastas em C:\Arquivos de programas\Arquivos comuns [15/12/2008|08:58] C:\Arquivos de programas\Arquivos comuns\Adobe [26/07/2008|23:36] C:\Arquivos de programas\Arquivos comuns\Autodesk Shared [20/09/2008|10:28] C:\Arquivos de programas\Arquivos comuns\Corel [20/09/2008|10:29] C:\Arquivos de programas\Arquivos comuns\Designer [13/08/2008|11:36] C:\Arquivos de programas\Arquivos comuns\DirectX [25/08/2008|20:50] C:\Arquivos de programas\Arquivos comuns\InstallShield [15/12/2008|08:44] C:\Arquivos de programas\Arquivos comuns\Macrovision Shared [19/12/2008|20:30] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared [26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\MSSoap [23/08/2008|17:36] C:\Arquivos de programas\Arquivos comuns\Nero [26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\ODBC [25/08/2008|20:49] C:\Arquivos de programas\Arquivos comuns\Protexis [26/07/2008|14:49] C:\Arquivos de programas\Arquivos comuns\Serviços [11/09/2008|23:54] C:\Arquivos de programas\Arquivos comuns\snppro [26/07/2008|11:44] C:\Arquivos de programas\Arquivos comuns\SpeechEngines [14/12/2008|14:20] C:\Arquivos de programas\Arquivos comuns\SWF Studio [22/08/2008|21:07] C:\Arquivos de programas\Arquivos comuns\System [19/12/2008|19:35] C:\Arquivos de programas\Arquivos comuns\Windows Live --------------------\\ Process ( 46 Processes ) ... OK ! --------------------\\ Procura pelo S_Lop Não foram encontradas pastas com o Lop! --------------------\\ Procura por Arquivos/Ficheiros e pastas do Lop C:\DOCUME~1\Aldemir\CONFIG~1\Temp\sta286.exe C:\WINDOWS\Tasks\B09177379072EB83.job --------------------\\ Procura no Registro ..... OK ! --------------------\\ Verificando o Arquivos/Ficheiros Hosts Arquivos/Ficheiros Hosts LIMPO --------------------\\ Procurando Arquivos/Ficheiros ocultos com o Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-26 09:31:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 1 --------------------\\ Procurando por outras infecções --------------------\\ Cracks & Keygens .. C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Adobe Photoshop CS3 Extended + Crack.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Age Of Empires 3 full DVD +crack + serial.iso.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\AutoCAD 2007 with CRACK.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Need.For.Speed.Undercover.Crack.and.Keygen.Only-RELOADED.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Nero 8 Ultra Edition 8.3.2.1b + Working Serial + Crack.torrent C:\DOCUME~1\Aldemir\Dados de aplicativos\uTorrent\Pro.Evolution.Soccer.2008[PCDVD][spanish-EN-FR-GE-IT-POR] + CRACK + KEYGEN (Gusnor).torrent C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack C:\DOCUME~1\Aldemir\Meus documentos\Downloads\The Sims 2\Documentation\Crack\Sims2EP7.exe [F:240][D:3]-> C:\DOCUME~1\Aldemir\CONFIG~1\Temp [F:25][D:0]-> C:\DOCUME~1\Aldemir\Cookies [F:189][D:4]-> C:\DOCUME~1\Aldemir\CONFIG~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - seg 22/12/2008| 0:21 - Option : [1] 2 - "C:\Lop SD\LopR_2.txt" - --- 26/12/2008| 9:32 - Option : [2] --------------------\\ Verificação completa em 9:32:49 Compartilhar este post Link para o post Compartilhar em outros sites
Aldeboy 0 Denunciar post Postado Dezembro 26, 2008 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:56:25, on 26/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe C:\Arquivos de programas\Bonjour\mDNSResponder.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\RTHDCPL.EXE C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE C:\ARQUIV~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Arquivos de programas\Winamp\winampa.exe C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Arquivos de programas\uTorrent\uTorrent.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\svchost.exe C:\ARQUIV~1\AVG\AVG8\avgemc.exe C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Arquivos de programas\Opera\opera.exe C:\Documents and Settings\Aldemir\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portuguese.eazel.com/pt/index.php?r...&d=79919176 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll (file missing) O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [skyTel] SkyTel.EXE O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe" O4 - HKLM\..\Run: [Long Internet Team Stupid] C:\Documents and Settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [uTorrent] "C:\Arquivos de programas\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [Web remote] C:\DOCUME~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 9233 bytes Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Dezembro 26, 2008 - Faça o download do ComboFix e salve-o na área de trabalho; ● Desative temporariamente o seu antivirus para não detectar a ferramenta como vírus; ● Duplo clique no ícone combofix.exe para iniciar o scan; ● Leia o contrato que aparecerá e clique em Sim para continuar; ● Abrirá uma janela do Console de Recuperação, clique em Sim para instalar. Se aparecer outra janela do Console, clique em OK > Sim; ● Aguarde enquanto o ComboFix faz o scan; ● Se ocorrer algum problema durante o scan, reinicie seu computador em Modo de Segurança e repita o procedimento; ● Não clique na janela do ComboFix e procure não utilizar o teclado também, para não atrapalhar a varredura da ferramenta; ● Se quiser sair ou parar o ComboFix, tecle N; ● Quando terminar seu micro será reiniciado. Após o reinicio, a ferramenta executará novamente, aguarde; ● Será gerado um log em C:\ComboFix.txt. Cole este log em sua próxima resposta. Compartilhar este post Link para o post Compartilhar em outros sites
Aldeboy 0 Denunciar post Postado Dezembro 27, 2008 ComboFix 08-12-26.03 - Aldemir 2008-12-26 23:45:49.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1023.637 [GMT -2:00] Executando de: c:\documents and settings\Aldemir\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated) AV: avast! antivirus 4.8.1296 [VPS 081226-0] *On-access scanning disabled* (Outdated) * Criado um novo ponto de restauro . (((((((((((((((( Arquivos/Ficheiros criados de 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))) . 2008-12-23 16:32 . 2008-12-23 16:32 <DIR> d-------- c:\documents and settings\Aldemir\Dados de aplicativos\Miranda 2008-12-23 12:34 . 2008-12-23 12:35 <DIR> d-------- C:\CCleaner 2008-12-22 00:17 . 2008-12-26 09:32 <DIR> d-------- C:\Lop SD 2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive 2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Microsoft 2008-12-19 19:35 . 2008-12-19 19:35 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Windows Live 2008-12-16 19:07 . 2008-12-16 19:07 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\FLEXnet 2008-12-15 15:21 . 2008-12-15 15:22 <DIR> d-------- C:\DUCTILCAD 2008-12-15 10:04 . 2008-12-15 10:04 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus! 2008-12-15 09:57 . 2008-12-15 09:57 <DIR> d-------- C:\backups 2008-12-15 09:55 . 2007-06-28 14:36 401,720 --a------ C:\HijackThis.exe 2008-12-15 08:58 . 2008-12-15 08:59 <DIR> d-------- c:\arquivos de programas\Bonjour 2008-12-15 08:44 . 2008-12-15 08:44 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Macrovision Shared 2008-12-14 18:24 . 2008-12-21 15:15 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery 2008-12-14 18:24 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx 2008-12-14 14:20 . 2008-12-14 14:20 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\SWF Studio 2008-12-14 13:32 . 2005-05-03 08:43 69,632 -r------- c:\windows\Alcmtr.exe 2008-12-14 13:07 . 2008-12-14 13:07 <DIR> d-------- C:\!KillBox 2008-12-14 12:49 . 2008-12-14 12:49 230 --a------ c:\windows\system32\spupdsvc.inf 2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ c:\windows\system32\sirenacm.dll . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-27 01:41 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\uTorrent 2008-12-25 23:18 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\Orbit 2008-12-23 17:44 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-12-23 14:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy 2008-12-21 17:06 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information 2008-12-19 22:30 --------- d-----w c:\arquivos de programas\Windows Live 2008-12-18 20:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\avg8 2008-12-15 10:58 --------- d-----w c:\arquivos de programas\Arquivos comuns\Adobe 2008-12-15 10:01 --------- d-----w c:\arquivos de programas\Messenger Plus! Live 2008-12-14 16:20 1,386,496 ----a-w c:\windows\system32\msvbvm60.dll 2008-12-14 15:32 --------- d-----w c:\arquivos de programas\Realtek 2008-12-13 01:49 183,112 ----a-w c:\windows\system32\PnkBstrB.exe 2008-12-13 01:49 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-29 12:20 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\AdobeUM 2008-11-24 08:41 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\Leadertech 2008-11-19 18:57 --------- d-----w c:\arquivos de programas\C-evo2 2008-11-12 19:53 --------- d-----w c:\arquivos de programas\GameVicio 2008-11-09 19:29 --------- d-----w c:\arquivos de programas\Megacubo 2008-11-01 19:47 --------- d-----w c:\arquivos de programas\Aide PDF to DXF Converter 2008-10-27 12:54 --------- d-----w c:\arquivos de programas\One-click Ringtone Converter 2008-08-05 00:25 88 --sh--r c:\windows\system32\FEA71E9E71.sys 2008-08-05 00:26 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-12-15_ 8.35.29,60 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-24 08:31:28 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll + 2008-12-20 17:50:13 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll - 2008-11-24 08:31:29 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll + 2008-12-20 17:50:13 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll - 2008-11-24 08:31:29 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll + 2008-12-20 17:50:13 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll - 2008-11-24 08:31:24 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:06 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:25 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:07 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:26 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:08 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:26 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:08 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:26 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:09 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:27 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:10 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:27 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:10 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:27 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:10 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:27 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:11 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:29 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-12-20 17:50:14 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-11-24 08:31:29 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll + 2008-12-20 17:50:14 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll - 2008-11-24 08:31:30 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll + 2008-12-20 17:50:15 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll - 2008-11-24 08:31:30 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll + 2008-12-20 17:50:15 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll - 2008-11-24 08:31:30 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll + 2008-12-20 17:50:15 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll - 2008-11-24 08:31:28 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll + 2008-12-20 17:50:13 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\ARPPRODUCTICON.exe + 2008-12-20 17:59:57 8,854 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut2_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 8,854 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut21_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut3_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut31_46F42615BA3145A0BE102D2119749E95_1.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut32_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut4_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut41_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut42_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut5_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut51_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut6_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-20 17:59:57 16,958 ----a-r c:\windows\Installer\{46F42615-BA31-45A0-BE10-2D2119749E95}\NewShortcut71_46F42615BA3145A0BE102D2119749E95.exe + 2008-12-19 22:30:05 62,288 ----a-r c:\windows\Installer\{844649F4-8B62-4B1F-85D9-F3098DF32F3C}\IconWlc.exe + 2008-12-19 22:31:11 80,395 ----a-r c:\windows\Installer\{C8DD4EAD-674B-461B-94D5-4C80CCFB8401}\MsblIco.Exe + 2006-02-28 14:41:34 61,440 ----a-w c:\windows\system32\dns-sd.exe + 2006-02-28 14:41:22 53,248 ----a-w c:\windows\system32\dnssd.dll - 2008-10-20 18:22:23 352,976 ----a-w c:\windows\system32\FNTCACHE.DAT + 2008-12-15 12:03:08 1,639,576 ----a-w c:\windows\system32\FNTCACHE.DAT + 2007-03-21 22:54:16 77,312 ----a-w c:\windows\system32\TWAIN_32.DLL + 2007-03-21 22:54:16 48,560 ----a-w c:\windows\system32\TWUNK_16.EXE + 2007-03-21 22:54:16 69,632 ----a-w c:\windows\system32\TWUNK_32.EXE + 2008-12-21 00:38:18 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_60c.dat + 2006-06-05 16:14:28 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll + 2006-06-05 16:14:28 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll + 2006-06-05 16:14:28 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll + 2007-11-06 22:23:58 224,768 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll + 2007-11-07 03:19:34 568,832 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll + 2007-11-07 03:19:34 655,872 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll . -- Snapshot resetado para data atual -- . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "uTorrent"="c:\arquivos de programas\uTorrent\uTorrent.exe" [2008-10-13 270128] "msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312] "SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Google Update"="c:\documents and settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2008-09-04 133104] "MessengerPlus3"="c:\arquivos de programas\MessengerPlus! 3\MsgPlus.exe" [2008-07-26 190024] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-20 7680000] "AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-20 86016] "WinampAgent"="c:\arquivos de programas\Winamp\winampa.exe" [2008-07-09 36352] "Long Internet Team Stupid"="c:\documents and settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe" [bU] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2007-06-15 c:\windows\SkyTel.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Arquivos de programas\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"= "c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"= "c:\\Arquivos de programas\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Arquivos de programas\\EA GAMES\\Need For Speed Underground\\Speed.exe"= "c:\\Arquivos de programas\\Opera\\opera.exe"= "c:\\Documents and Settings\\Aldemir\\Meus documentos\\Downloads\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Arquivos de programas\\Megacubo\\megacubo.exe"= "d:\\Arquivos de programas\\Aspyr\\Guitar Hero III\\GH3.exe"= "d:\\Arquivos de programas\\amsn\\bin\\wish.exe"= "d:\\Arquivos de programas\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "c:\\Arquivos de programas\\Arquivos comuns\\Nero\\Nero Web\\SetupX.exe"= "d:\\Arquivos de programas\\Microsoft Games\\Age of Empires III\\age3.exe"= "c:\\Documents and Settings\\Aldemir\\Configurações locais\\Dados de aplicativos\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "d:\\Arquivos de programas\\Aspyr\\Guitar Hero Aerosmith\\Guitar Hero Aerosmith.exe"= "d:\\Arquivos de programas\\uTorrent\\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-14 111184] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-07-26 97928] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-14 20560] R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [2008-07-26 875288] R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-26 76040] R3 SNPPRO;USB PC Camera (snppro);c:\windows\system32\DRIVERS\snppro.sys [2008-09-11 10186496] R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2008-07-26 30368] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c08f748-8183-11dd-869b-001e8cdb2b41}] \Shell\AutoRun\command - CONFIG\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe \Shell\open\command - CONFIG\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe . Conteúdo da pasta 'Tarefas Agendadas' 2008-12-27 c:\windows\Tasks\B09177379072EB83.job - c:\docume~1\aldemir\dadosd~1\softin~1\store second one.exe [] 2008-12-26 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Aldemir\Configura [] . - - - - ORFÃOS REMOVIDOS - - - - HKCU-Run-Web remote - c:\docume~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe . ------- Scan Suplementar ------- . uStart Page = hxxp://portuguese.eazel.com/pt/index.php?rvs=hompag&d=79919176 IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Aldemir\Dados de aplicativos\Mozilla\Firefox\Profiles\2v6axl0o.default\ FF - prefs.js: browser.startup.homepage - hxxp://pt-BR.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pt-BR:official FF - component: c:\arquivos de programas\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\arquivos de programas\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\arquivos de programas\Opera\program\plugins\npdivx32.dll FF - plugin: c:\arquivos de programas\Opera\program\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\Opera\program\plugins\nprpjplug.dll FF - plugin: c:\arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll ATTENTION: FIREFOX POLICES IS IN FORCE c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-26 23:48:26 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'winlogon.exe'(720) c:\windows\system32\avgrsstx.dll - - - - - - - > 'lsass.exe'(804) c:\windows\system32\avgrsstx.dll . Tempo para conclusão: 2008-12-26 23:49:13 ComboFix-quarantined-files.txt 2008-12-27 01:49:11 ComboFix2.txt 2008-12-20 17:47:16 ComboFix3.txt 2008-12-15 10:36:02 Pré-execução: 5.960.720.384 bytes disponíveis Pós execução: 5,975,633,920 bytes disponíveis 247 --- E O F --- 2008-07-30 06:00:45 Compartilhar este post Link para o post Compartilhar em outros sites
MGuitar 11 Denunciar post Postado Dezembro 28, 2008 Delete a pasta C:\Qoobox e o log C:\ComboFix.txt. Selecione e copie este conteúdo abaixo (começando de File). Cole o conteudo copiado dentro do bloco de notas de seu PC e salve-o no desktop como CFScript.txt File::c:\documents and settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe c:\windows\Tasks\B09177379072EB83.job c:\docume~1\aldemir\dadosd~1\softin~1\store second one.exe Folder:: C:\!KillBox Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Long Internet Team Stupid"=- [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000000 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c08f748-8183-11dd-869b-001e8cdb2b41}] DirLook:: C:\backups Arraste o CFScript para o ComboFix como na imagem aqui abaixo e aguarde a execução automática da ferramenta: ● Se for solicitado à você, pressione Enter para iniciar o processo de remoção; ● Não use o mouse nem o teclado quando o ComboFix estiver rodando; ● Quando terminar, será gerado um novo log que estará em C:\ComboFix.txt; ● Talvez seu computador seja reiniciado automaticamente. Caso não ocorra, reinicie-o manualmente. Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis. Compartilhar este post Link para o post Compartilhar em outros sites
Aldeboy 0 Denunciar post Postado Dezembro 31, 2008 Log HiJackThis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:56:25, on 26/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe C:\Arquivos de programas\Bonjour\mDNSResponder.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\RTHDCPL.EXE C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE C:\ARQUIV~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Arquivos de programas\Winamp\winampa.exe C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Arquivos de programas\uTorrent\uTorrent.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\svchost.exe C:\ARQUIV~1\AVG\AVG8\avgemc.exe C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Arquivos de programas\Opera\opera.exe C:\Documents and Settings\Aldemir\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://portuguese.eazel.com/pt/index.php?r...&d=79919176 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll (file missing) O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [skyTel] SkyTel.EXE O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe" O4 - HKLM\..\Run: [Long Internet Team Stupid] C:\Documents and Settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [uTorrent] "C:\Arquivos de programas\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [MessengerPlus3] "C:\Arquivos de programas\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [Web remote] C:\DOCUME~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Arquivos de programas\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 9233 bytes Log ComboFix ComboFix 08-12-29.01 - Aldemir 2008-12-30 0:01:09.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1023.400 [GMT -2:00] Executando de: c:\documents and settings\Aldemir\Desktop\ComboFix.exe Comandos utilizados :: c:\documents and settings\Aldemir\Desktop\CFScript.txt * Criado um novo ponto de restauro FILE :: c:\docume~1\aldemir\dadosd~1\softin~1\store second one.exe c:\documents and settings\All Users\Dados de aplicativos\comp two long internet\Wipe Enc.exe c:\windows\Tasks\B09177379072EB83.job . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\!KillBox c:\!killbox\Logs\kb.log c:\windows\Tasks\B09177379072EB83.job . (((((((((((((((( Arquivos/Ficheiros criados de 2008-11-28 to 2008-12-30 )))))))))))))))))))))))))))) . 2008-12-23 16:32 . 2008-12-23 16:32 <DIR> d-------- c:\documents and settings\Aldemir\Dados de aplicativos\Miranda 2008-12-23 12:34 . 2008-12-23 12:35 <DIR> d-------- C:\CCleaner 2008-12-22 00:17 . 2008-12-26 09:32 <DIR> d-------- C:\Lop SD 2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive 2008-12-19 20:30 . 2008-12-19 20:30 <DIR> d-------- c:\arquivos de programas\Microsoft 2008-12-19 19:35 . 2008-12-19 19:35 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Windows Live 2008-12-16 19:07 . 2008-12-16 19:07 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\FLEXnet 2008-12-15 15:21 . 2008-12-15 15:22 <DIR> d-------- C:\DUCTILCAD 2008-12-15 10:04 . 2008-12-15 10:04 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus! 2008-12-15 09:57 . 2008-12-15 09:57 <DIR> d-------- C:\backups 2008-12-15 09:55 . 2007-06-28 14:36 401,720 --a------ C:\HijackThis.exe 2008-12-15 08:58 . 2008-12-15 08:59 <DIR> d-------- c:\arquivos de programas\Bonjour 2008-12-15 08:44 . 2008-12-15 08:44 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Macrovision Shared 2008-12-14 18:24 . 2008-12-21 15:15 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery 2008-12-14 18:24 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx 2008-12-14 14:20 . 2008-12-14 14:20 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\SWF Studio 2008-12-14 13:32 . 2005-05-03 08:43 69,632 -r------- c:\windows\Alcmtr.exe 2008-12-14 12:49 . 2008-12-14 12:49 230 --a------ c:\windows\system32\spupdsvc.inf 2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ c:\windows\system32\sirenacm.dll 2008-11-24 06:45 . 2008-12-12 23:49 183,112 --a------ c:\windows\system32\PnkBstrB.exe 2008-11-24 06:45 . 2008-12-12 23:49 138,184 --a------ c:\windows\system32\drivers\PnkBstrK.sys 2008-11-24 06:45 . 2008-12-23 15:44 66,872 --a------ c:\windows\system32\PnkBstrA.exe 2008-11-24 06:41 . 2008-11-24 06:41 <DIR> d-------- c:\documents and settings\Aldemir\Dados de aplicativos\Leadertech 2008-11-24 06:40 . 2008-11-24 06:40 <DIR> d-------- c:\windows\system32\LogFiles 2008-11-19 16:57 . 2008-11-19 16:57 <DIR> d-------- c:\arquivos de programas\C-evo2 2008-11-12 17:53 . 2008-11-12 17:53 <DIR> d-------- c:\arquivos de programas\GameVicio 2008-11-06 16:48 . 2007-12-03 02:10 644,400 --a------ c:\windows\system32\MSCOMCT2.OCX 2008-11-06 16:27 . 2008-11-06 16:27 <DIR> d-------- c:\windows\system32\URTTEMP 2008-11-01 17:47 . 2008-11-01 17:47 <DIR> d-------- c:\arquivos de programas\Aide PDF to DXF Converter . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-30 02:01 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\uTorrent 2008-12-25 23:18 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\Orbit 2008-12-23 14:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy 2008-12-21 17:06 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information 2008-12-19 22:30 --------- d-----w c:\arquivos de programas\Windows Live 2008-12-18 20:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\avg8 2008-12-15 10:58 --------- d-----w c:\arquivos de programas\Arquivos comuns\Adobe 2008-12-15 10:01 --------- d-----w c:\arquivos de programas\Messenger Plus! Live 2008-12-14 16:20 1,386,496 ----a-w c:\windows\system32\msvbvm60.dll 2008-12-14 15:32 --------- d-----w c:\arquivos de programas\Realtek 2008-11-29 12:20 --------- d-----w c:\documents and settings\Aldemir\Dados de aplicativos\AdobeUM 2008-11-09 19:29 --------- d-----w c:\arquivos de programas\Megacubo 2008-08-05 00:25 88 --sh--r c:\windows\system32\FEA71E9E71.sys 2008-08-05 00:26 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\backups ---- 2008-12-15 09:57 95 --a------ c:\backups\backup-20081215-095736-173 2008-12-15 09:57 95 --a------ c:\backups\backup-20081215-095735-833 2008-12-15 09:57 86 --a------ c:\backups\backup-20081215-095736-157 2008-12-15 09:57 79 --a------ c:\backups\backup-20081215-095736-115 2008-12-15 09:57 76 --a------ c:\backups\backup-20081215-095736-491 2008-12-15 09:57 74 --a------ c:\backups\backup-20081215-095736-218 2008-12-15 09:57 64 --a------ c:\backups\backup-20081215-095736-883 2008-12-15 09:57 44 --a------ c:\backups\backup-20081215-095736-655 2008-12-15 09:57 39 --a------ c:\backups\backup-20081215-095736-613 2008-12-15 09:57 151 --a------ c:\backups\backup-20081215-095736-285 2008-12-15 09:57 150 --a------ c:\backups\backup-20081215-095735-467 2008-12-15 09:57 139 --a------ c:\backups\backup-20081215-095736-473 2008-12-15 09:57 138 --a------ c:\backups\backup-20081215-095735-647 2008-12-15 09:57 133 --a------ c:\backups\backup-20081215-095736-849 2008-12-15 09:57 129 --a------ c:\backups\backup-20081215-095735-544 2008-12-15 09:57 120 --a------ c:\backups\backup-20081215-095736-702 2008-12-15 09:57 120 --a------ c:\backups\backup-20081215-095735-237 2008-12-15 09:57 119 --a------ c:\backups\backup-20081215-095735-490 2008-12-15 09:57 117 --a------ c:\backups\backup-20081215-095735-772 2008-12-15 09:57 113 --a------ c:\backups\backup-20081215-095736-809 2008-12-15 09:57 113 --a------ c:\backups\backup-20081215-095735-838 2008-12-15 09:57 112 --a------ c:\backups\backup-20081215-095735-823 2008-12-15 09:57 111 --a------ c:\backups\backup-20081215-095735-575 2008-12-15 09:57 109 --a------ c:\backups\backup-20081215-095736-679 2008-08-30 10:27 455960 --a------ c:\backups\backup-20081215-095735-647.dll 2008-07-26 16:26 2055960 --a------ c:\backups\backup-20081215-095736-679.dll 2008-07-21 18:57 126152 --a------ c:\backups\backup-20081215-095735-237.dll 2008-07-07 10:41 1562448 --a------ c:\backups\backup-20081215-095735-838.dll 2003-05-15 02:03 147456 --a------ c:\backups\backup-20081215-095736-285.dll 2003-05-15 01:47 50376 --a------ c:\backups\backup-20081215-095735-467.dll (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "uTorrent"="c:\arquivos de programas\uTorrent\uTorrent.exe" [2008-10-13 270128] "msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312] "SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Google Update"="c:\documents and settings\Aldemir\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2008-09-04 133104] "MessengerPlus3"="c:\arquivos de programas\MessengerPlus! 3\MsgPlus.exe" [2008-07-26 190024] "Web remote"="c:\docume~1\Aldemir\DADOSD~1\SOFTIN~1\SETUP HOPE LIST.exe" [bU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-09-20 7680000] "AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-09-20 86016] "WinampAgent"="c:\arquivos de programas\Winamp\winampa.exe" [2008-07-09 36352] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2007-06-15 c:\windows\SkyTel.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Arquivos de programas\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"= "c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"= "c:\\Arquivos de programas\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Arquivos de programas\\EA GAMES\\Need For Speed Underground\\Speed.exe"= "c:\\Arquivos de programas\\Opera\\opera.exe"= "c:\\Documents and Settings\\Aldemir\\Meus documentos\\Downloads\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Arquivos de programas\\Megacubo\\megacubo.exe"= "d:\\Arquivos de programas\\Aspyr\\Guitar Hero III\\GH3.exe"= "d:\\Arquivos de programas\\amsn\\bin\\wish.exe"= "d:\\Arquivos de programas\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "c:\\Arquivos de programas\\Arquivos comuns\\Nero\\Nero Web\\SetupX.exe"= "d:\\Arquivos de programas\\Microsoft Games\\Age of Empires III\\age3.exe"= "c:\\Documents and Settings\\Aldemir\\Configurações locais\\Dados de aplicativos\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "d:\\Arquivos de programas\\Aspyr\\Guitar Hero Aerosmith\\Guitar Hero Aerosmith.exe"= "d:\\Arquivos de programas\\uTorrent\\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-14 111184] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-07-26 97928] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-14 20560] R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [2008-07-26 875288] R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-26 76040] R3 SNPPRO;USB PC Camera (snppro);c:\windows\system32\DRIVERS\snppro.sys [2008-09-11 10186496] R3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\Drivers\usb2vcom.sys [2008-07-26 30368] *Newly Created Service* - CATCHME . Conteúdo da pasta 'Tarefas Agendadas' 2008-12-30 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Aldemir\Configura [] . . ------- Scan Suplementar ------- . uStart Page = hxxp://portuguese.eazel.com/pt/index.php?rvs=hompag&d=79919176 IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Aldemir\Dados de aplicativos\Mozilla\Firefox\Profiles\2v6axl0o.default\ FF - prefs.js: browser.startup.homepage - hxxp://pt-BR.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pt-BR:official FF - component: c:\arquivos de programas\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\arquivos de programas\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\arquivos de programas\Opera\program\plugins\npdivx32.dll FF - plugin: c:\arquivos de programas\Opera\program\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\Opera\program\plugins\nprpjplug.dll FF - plugin: c:\arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll ATTENTION: FIREFOX POLICES IS IN FORCE c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-30 00:03:01 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'winlogon.exe'(720) c:\windows\system32\avgrsstx.dll - - - - - - - > 'lsass.exe'(804) c:\windows\system32\avgrsstx.dll . Tempo para conclusão: 2008-12-30 0:03:51 ComboFix-quarantined-files.txt 2008-12-30 02:03:48 ComboFix2.txt 2008-12-27 01:49:16 ComboFix3.txt 2008-12-20 17:47:16 ComboFix4.txt 2008-12-15 10:36:02 Pré-execução: 5.840.117.760 bytes disponíveis Pós execução: 5,844,393,984 bytes disponíveis 213 --- E O F --- 2008-07-30 06:00:45 Compartilhar este post Link para o post Compartilhar em outros sites
Mário Monteiro 179 Denunciar post Postado Janeiro 31, 2009 Tópico Arquivado Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
