[Arquivado] Análise log combofix.

[Kened 0]

Boa tarde.

 

Quando eu tento abrir o Gerenciador de Tarefas aparece uma mesagem assim: O 'Gerenciador de Tarefas' foi desativado pelo administrador.

 

Bom, procurei sobre isso no google.. achei um topico falando pra tentar arrumar isso pelo gpedit.msc.

Fiz tudo como estava lá e não deu certo, e verifiquei que no meu caso se tratava de um virus.

 

Também não consigo abrir/remover/instalar nenhum anti-virus, nem consigo entrar no modo de segurança... !

Aparece uma tela azul com algo escrito que eu não fiz questão de memorizar...

 

O que devo fazer agora?

 

Desde já, agradeço.

 

Segue abaixo o log do combofix.

 

 

ComboFix 09-01-11.04 - PC 2009-01-12 13:33:39.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1023.699 [GMT -2:00]

Executando de: c:\documents and settings\PC\Meus documentos\Downloads\ComboFix.exe

* Criado um novo ponto de restauro

.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Autorun.inf

C:\x2tpc.cmd

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_DAC970NT

-------\Service_dac970nt

 

 

(((((((((((((((( Arquivos/Ficheiros criados de 2008-12-12 to 2009-01-12 ))))))))))))))))))))))))))))

.

 

2009-01-12 11:31 . 2004-08-03 22:45 70,144 --a------ c:\windows\AhnRpta.exe

2009-01-12 03:39 . 2004-08-03 22:45 221,184 --a------ c:\windows\system32\wmpns.dll

2009-01-12 03:37 . 2009-01-12 13:36 90,112 -r-hs---- c:\windows\system32\ciuytr0.dll

2009-01-12 00:57 . 2009-01-12 13:22 181,760 -r-hs---- c:\windows\system32\vamsoft.exe

2009-01-11 19:11 . 2009-01-11 19:11 <DIR> d-------- c:\documents and settings\PC\Dados de aplicativos\Malwarebytes

2009-01-11 19:11 . 2009-01-11 19:11 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-01-11 19:11 . 2009-01-11 19:11 <DIR> d-------- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-01-11 19:11 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-11 19:11 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-11 03:32 . 2009-01-12 03:03 90,112 -r-hs---- c:\windows\system32\ciuytr2.dll

2009-01-11 02:13 . 2009-01-12 13:29 <DIR> d-------- C:\!KillBox

2009-01-11 02:02 . 2009-01-12 03:00 <DIR> d-------- C:\HijackThis

2009-01-11 02:02 . 2009-01-11 02:02 <DIR> d-------- c:\arquivos de programas\Trend Micro

2009-01-11 00:58 . 2009-01-11 21:50 <DIR> d-------- c:\arquivos de programas\MuDominium

2009-01-10 22:28 . 2001-08-17 21:53 4,992 --a------ c:\windows\system32\drivers\loop.sys

2009-01-10 22:28 . 2001-08-17 21:53 4,992 --a--c--- c:\windows\system32\dllcache\loop.sys

2009-01-10 14:58 . 2009-01-12 13:14 90,112 -r-hs---- c:\windows\system32\ciuytr1.dll

2009-01-10 14:57 . 2009-01-07 18:48 121,594 -r-hs---- C:\xcisvxl.com

2009-01-10 02:45 . 2009-01-10 02:45 <DIR> d--h----- c:\windows\system32\GroupPolicy

2009-01-10 02:26 . 2009-01-10 02:26 <DIR> d-------- c:\arquivos de programas\No-IP

2009-01-10 01:10 . 2009-01-10 01:19 1,690 --a------ c:\windows\ODBC.INI

2009-01-10 00:46 . 2009-01-10 00:46 1,744 --a------ c:\windows\sql.mif

2009-01-10 00:44 . 2000-08-06 01:51 274,489 --a------ c:\windows\system32\ntwdblib.dll

2009-01-10 00:44 . 2000-08-06 01:51 192,569 --a------ c:\windows\system32\msrpjt40.dll

2009-01-10 00:44 . 2000-07-07 12:20 81,920 --a------ c:\windows\system32\mdt2fw95.dll

2009-01-10 00:44 . 2000-08-06 01:50 36,939 --a------ c:\windows\system32\insrepim.exe

2009-01-10 00:44 . 2000-08-06 01:51 32,830 --a------ c:\windows\system32\dbmsshrn.dll

2009-01-10 00:44 . 2000-08-06 01:51 28,734 --a------ c:\windows\system32\dbmslpcn.dll

2009-01-10 00:43 . 2009-01-10 00:43 <DIR> d-------- c:\arquivos de programas\Microsoft SQL Server

2009-01-10 00:42 . 1998-10-29 16:45 306,688 --a------ c:\windows\IsUninst.exe

2009-01-10 00:42 . 2009-01-10 00:46 1,273 --a------ c:\windows\setup.iss

2009-01-09 23:36 . 2009-01-10 00:02 <DIR> d-------- c:\documents and settings\PC\Dados de aplicativos\Audacity

2009-01-09 17:51 . 2009-01-09 17:51 33 --a------ c:\windows\Multimedia manager.INI

2009-01-09 15:28 . 2009-01-11 21:55 <DIR> d-------- C:\SQLEVAL

2009-01-07 20:59 . 2009-01-07 20:59 <DIR> d-------- c:\documents and settings\PC\Dados de aplicativos\Samsung

2009-01-07 20:46 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll

2009-01-07 20:45 . 2009-01-07 20:57 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys

2009-01-07 20:35 . 2009-01-07 20:35 <DIR> d-------- c:\arquivos de programas\Samsung

2009-01-07 20:33 . 2009-01-07 20:46 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers

2009-01-07 20:33 . 2007-05-02 11:12 109,704 --a------ c:\windows\system32\drivers\ssm_mdm.sys

2009-01-07 20:33 . 2007-05-02 11:12 83,592 --a------ c:\windows\system32\drivers\ssm_bus.sys

2009-01-07 20:33 . 2007-05-02 11:12 15,112 --a------ c:\windows\system32\drivers\ssm_mdfl.sys

2009-01-07 20:33 . 2007-05-02 11:12 12,424 --a------ c:\windows\system32\drivers\ssm_whnt.sys

2009-01-07 20:33 . 2007-05-02 11:12 12,424 --a------ c:\windows\system32\drivers\ssm_wh.sys

2009-01-07 20:33 . 2007-05-02 11:12 12,424 --a------ c:\windows\system32\drivers\ssm_cmnt.sys

2009-01-07 20:33 . 2007-05-02 11:12 12,424 --a------ c:\windows\system32\drivers\ssm_cm.sys

2009-01-07 20:33 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico

2009-01-06 03:00 . 2009-01-06 03:00 <DIR> d-------- c:\documents and settings\PC\Dados de aplicativos\Yahoo!

2009-01-06 03:00 . 2009-01-06 10:22 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Yahoo! Companion

2009-01-06 03:00 . 2009-01-06 03:00 <DIR> d-------- c:\arquivos de programas\Yahoo!

2008-12-30 16:00 . 2009-01-10 23:03 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery

2008-12-30 16:00 . 2004-03-09 01:00 609,824 --a------ c:\windows\system32\COMCTL32.ocx

2008-12-30 16:00 . 2004-03-08 23:00 152,848 --a------ c:\windows\system32\comdlg32.OCX

2008-12-30 16:00 . 2004-03-09 01:00 124,688 --a------ c:\windows\system32\MSWINSCK.ocx

2008-12-28 14:59 . 2008-12-28 14:59 268 --ah----- C:\sqmdata07.sqm

2008-12-28 14:59 . 2008-12-28 14:59 244 --ah----- C:\sqmnoopt07.sqm

2008-12-28 11:28 . 2008-12-28 11:28 244 --ah----- C:\sqmnoopt06.sqm

2008-12-28 11:28 . 2008-12-28 11:28 232 --ah----- C:\sqmdata06.sqm

2008-12-28 10:23 . 2008-12-28 10:23 268 --ah----- C:\sqmdata05.sqm

2008-12-28 10:23 . 2008-12-28 10:23 244 --ah----- C:\sqmnoopt05.sqm

2008-12-27 15:30 . 2008-12-27 15:30 <DIR> d-------- c:\arquivos de programas\CIB

2008-12-25 15:57 . 2008-12-25 15:57 <DIR> d-------- c:\documents and settings\PC\Dados de aplicativos\Foxit

2008-12-25 15:56 . 2008-12-25 15:56 <DIR> d-------- c:\arquivos de programas\Foxit Software

2008-12-20 22:29 . 2008-12-20 22:29 110,592 --a------ c:\windows\system32\gameguard.dis

2008-12-15 09:46 . 2009-01-11 18:00 <DIR> d-------- c:\arquivos de programas\Norton Security Scan

2008-12-15 09:46 . 2009-01-09 18:01 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Symantec Shared

2008-12-15 06:45 . 2009-01-02 17:59 <DIR> d-------- c:\windows\system32\Adobe

2008-12-14 10:15 . 2008-12-14 10:15 268 --ah----- C:\sqmdata04.sqm

2008-12-14 10:15 . 2008-12-14 10:15 244 --ah----- C:\sqmnoopt04.sqm

2008-12-13 19:11 . 2008-12-13 19:11 268 --ah----- C:\sqmdata03.sqm

2008-12-13 19:11 . 2008-12-13 19:11 244 --ah----- C:\sqmnoopt03.sqm

2008-12-12 23:07 . 2008-12-12 23:07 244 --ah----- C:\sqmnoopt02.sqm

2008-12-12 23:07 . 2008-12-12 23:07 232 --ah----- C:\sqmdata02.sqm

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-12 15:22 181,760 --sh--r C:\x2tpc.cmd

2009-01-12 04:23 --------- d-----w c:\arquivos de programas\Google

2009-01-10 16:00 --------- d-----w c:\arquivos de programas\CCleaner

2009-01-10 02:38 --------- d-----w c:\documents and settings\PC\Dados de aplicativos\LimeWire

2009-01-07 22:45 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2009-01-04 23:01 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help

2008-12-24 00:49 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2008-12-02 00:27 --------- d---a-w c:\documents and settings\All Users\Dados de aplicativos\TEMP

2008-12-01 23:59 --------- d-----w c:\documents and settings\PC\Dados de aplicativos\DivX

2008-11-30 13:14 --------- d-----w c:\documents and settings\PC\Dados de aplicativos\Trans Wait

2008-11-30 13:09 --------- d-----w c:\arquivos de programas\Alwil Software

2008-11-29 23:26 --------- d-----w c:\arquivos de programas\Kaspersky Lab

2008-11-29 21:52 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Avg7

2008-11-28 21:17 --------- d-----w c:\arquivos de programas\Arquivos comuns\snpstd3

2008-11-28 21:16 --------- d-----w c:\documents and settings\PC\Dados de aplicativos\InstallShield

2008-11-28 20:55 --------- d-----w c:\arquivos de programas\Java

2008-11-28 20:53 --------- d-----w c:\arquivos de programas\LimeWire

2008-11-28 20:44 --------- d-----w c:\arquivos de programas\Messenger Plus! Live

2008-11-28 20:44 --------- d-----w c:\arquivos de programas\Circle Developement

2008-11-28 17:56 --------- d-----w c:\arquivos de programas\Windows Live

2008-11-28 17:52 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\WLInstaller

2008-11-28 17:21 --------- dcsh--w c:\arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-11-28 17:08 --------- d-----w c:\arquivos de programas\AztDrv

2008-11-28 17:08 --------- d-----w c:\arquivos de programas\Arquivos comuns\InstallShield

2008-11-28 17:04 --------- d-----w c:\arquivos de programas\ATI Technologies

2008-11-28 13:49 --------- d-----w c:\arquivos de programas\Windows Media Connect 2

2008-11-28 13:46 --------- d-----w c:\arquivos de programas\DivX

2008-11-27 17:40 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\CyberLink

2008-11-27 17:40 --------- d-----w c:\arquivos de programas\Arquivos comuns\Ahead

2008-11-27 17:40 --------- d-----w c:\arquivos de programas\Ahead

2008-11-27 17:39 --------- d-----w c:\arquivos de programas\CyberLink DVD Solution

2008-11-27 17:39 --------- d-----w c:\arquivos de programas\CyberLink

2008-11-27 17:17 --------- d-----w c:\arquivos de programas\MSBuild

2008-11-27 17:17 --------- d-----w c:\arquivos de programas\Microsoft Works

2008-11-27 16:52 --------- d-----w c:\arquivos de programas\microsoft frontpage

2008-11-27 16:50 --------- d-----w c:\arquivos de programas\Serviços on-line

2008-11-27 16:49 --------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

2004-10-01 17:00 40,960 ----a-w c:\arquivos de programas\Uninstall_CDS.exe

.

 

((((((((((((((((((((((((((((( snapshot@2009-01-11_20.56.10.57 )))))))))))))))))))))))))))))))))))))))))

.

- 2000-08-31 10:00:00 28,672 ----a-w c:\windows\NIRCMD.exe

+ 2000-08-31 10:00:00 29,696 ----a-w c:\windows\NIRCMD.exe

+ 2004-08-04 00:45:34 78,848 ----a-w c:\windows\system32\afmain0.dll

+ 2004-08-04 00:45:34 78,848 ----a-w c:\windows\system32\afmain1.dll

+ 2009-01-12 04:25:12 262,144 ----a-w c:\windows\system32\config\systemprofile\NtUser.dat

+ 2009-01-12 15:36:07 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_18c.dat

- 2009-01-11 22:52:16 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_580.dat

+ 2009-01-12 15:36:17 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_580.dat

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vamsoft"="c:\windows\system32\vamsoft.exe" [2009-01-12 107623]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 229376]

"ATIPTA"="c:\arquivos de programas\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 413696]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain1.dll" [2004-08-03 78848]

 

[HKLM\~\startupfolder\^NTUSER.DAT]

path=\NTUSER.DAT

backup=c:\windows\pss\NTUSER.DATCommon Startup

 

[HKLM\~\startupfolder\^ntuser.dat.LOG]

path=\ntuser.dat.LOG

backup=c:\windows\pss\ntuser.dat.LOGCommon Startup

 

[HKLM\~\startupfolder\^ntuser.ini]

path=\ntuser.ini

backup=c:\windows\pss\ntuser.iniCommon Startup

 

[HKLM\~\startupfolder\^ntuser.pol]

path=\ntuser.pol

backup=c:\windows\pss\ntuser.polCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

--a------ 2006-10-27 00:47 108840 c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

--a------ 2003-12-08 17:35 102400 c:\arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]

--a------ 2006-09-18 14:12 913408 c:\windows\vsnpstd3.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2008-11-28 18:55 312728 c:\arquivos de programas\Java\jre6\bin\jusched.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnpstd3]

--a------ 2007-03-30 17:44 331776 c:\windows\tsnpstd3.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vamsoft]

--a------ 2009-01-12 13:39 210023 c:\windows\system32\vamsoft.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"gusvc"=3 (0x3)

"Ati HotKey Poller"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"UacDisableNotify"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"c:\\Arquivos de programas\\MessengerDiscovery\\MessengerDiscovery Live.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Arquivos de programas\\No-IP\\DUC20.exe"=

"c:\\x2tpc.cmd"=

"c:\\WINDOWS\\system32\\vamsoft.exe"=

"c:\\WINDOWS\\system32\\userinit.exe"=

"c:\\Arquivos de programas\\Microsoft SQL Server\\80\\Tools\\Binn\\sqlmangr.exe"=

"c:\\Arquivos de programas\\Malwarebytes' Anti-Malware\\mbam.exe"=

"c:\\Arquivos de programas\\Alwil Software\\Avast4\\aswRunDll.exe"=

"c:\\WINDOWS\\system32\\NeroCheck.exe"=

"c:\\Arquivos de programas\\ATI Technologies\\ATI Control Panel\\atiprbxx.exe"=

"c:\\Arquivos de programas\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"44405:TCP"= 44405:TCP:44405

"44405:UDP"= 44405:UDP:44405

"55901:UDP"= 55901:UDP:55901

"8090:TCP"= 8090:TCP:8090

"8090:UDP"= 8090:UDP:8090

"55557:TCP"= 55557:TCP:55557

"55557:UDP"= 55557:UDP:55557

"55901:TCP"= 55901:TCP:55901

 

S3 XDva068;XDva068;\??\c:\windows\system32\XDva068.sys --> c:\windows\system32\XDva068.sys [?]

 

--- ---

 

*NewlyCreated* - DAC970NT

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{919dd25e-bffb-11dd-b95a-0011d8b109b8}]

\SheLl\AutOPlay\cOmmaND - D:\hjljr.pif

\SheLl\AutoRun\command - D:\hjljr.pif

\SheLl\exPlore\CommaNd - D:\hjljr.pif

\SheLl\open\CoMMand - D:\hjljr.pif

.

Conteúdo da pasta 'Tarefas Agendadas'

 

2009-01-11 c:\windows\Tasks\Norton Security Scan for PC.job

- c:\arquivos de programas\Norton Security Scan\Nss.exe [2008-09-19 04:18]

.

- - - - ORFÃOS REMOVIDOS - - - -

 

HKU-Default-Run-CTFMON.EXE - c:\windows\system32\CTFMON.EXE

MSConfigStartUp-CTFMON - c:\windows\system32\ctfmon.exe

 

 

.

------- Scan Suplementar -------

.

uStart Page = about:blank

mStart Page = about:blank

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {90874C93-6A16-435F-95E2-6D180A860267} = 10.1.1.1

FF - ProfilePath - c:\documents and settings\PC\Dados de aplicativos\Mozilla\Firefox\Profiles\fbhdepd1.default\

FF - prefs.js: browser.startup.homepage - www.orkut.com

FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=pt-br&FORM=MIMWA1&q=

FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

 

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

.

------- Associação de arquivos/ficheiros -------

.

txtfile=Notepad.exe "%1"

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-12 13:36:16

Windows 5.1.2600 Service Pack 2 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

 

- - - - - - - > 'winlogon.exe'(544)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\arquiv~1\MI6841~1\MSSQL\Binn\sqlservr.exe

c:\docume~1\PC\CONFIG~1\temp\wintwce.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-01-12 13:40:19 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-01-12 15:40:17

ComboFix2.txt 2009-01-12 04:58:19

 

Pré-execução: 13 pasta(s) 58.740.760.576 bytes disponíveis

Pós execução: 13 pasta(s) 58,633,285,632 bytes disponíveis

 

290

[Mário Monteiro 179]

Tópico Movido

 

Origem: Artigos, Tutoriais e Matérias (Segurança & Malwares) :seta: Destino: Segurança & Malwares

[DigRam 144]

Bom Dia! Kened

 

Insira sua(s) unidade(s) removíveis,caso às possua,na entrada USB. ( pendrive,mp3,mp4,iPods,etc... )

<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.

<@> Salve-o,no Desktop,com o nome: CFScript.txt

 

File::

c:\docume~1\PC\CONFIG~1\temp\wintwce.exe

c:\windows\system32\ciuytr0.dll

c:\windows\system32\vamsoft.exe

c:\windows\system32\ciuytr2.dll

c:\windows\system32\ciuytr1.dll

c:\windows\system32\afmain0.dll

c:\windows\system32\afmain1.dll

C:\xcisvxl.com

C:\x2tpc.cmd

C:\sqmdata07.sqm

C:\sqmnoopt07.sqm

C:\sqmnoopt06.sqm

C:\sqmdata06.sqm

C:\sqmdata05.sqm

C:\sqmnoopt05.sqm

C:\sqmdata04.sqm

C:\sqmnoopt04.sqm

C:\sqmdata03.sqm

C:\sqmnoopt03.sqm

C:\sqmnoopt02.sqm

C:\sqmdata02.sqm

D:\hjljr.pif

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{919dd25e-bffb-11dd-b95a-0011d8b109b8}]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vamsoft]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vamsoft"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000000

"FirewallOverride"=dword:00000000

"UacDisableNotify"=dword:00000000

"AntiVirusDisableNotify"=dword:00000000

"UpdatesDisableNotify"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000000

"AntiVirusDisableNotify"=dword:00000000

"FirewallDisableNotify"=dword:00000000

"FirewallOverride"=dword:00000000

"UpdatesDisableNotify"=dword:00000000

"UacDisableNotify"=dword:00000000

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 1 (0x0)

Dirlook::

c:\windows\system32\GroupPolicy

Folder::

C:\!KillBox

Driver::

"dac970nt"

<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.

<@> Veja a demonstração!

 

 

<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.

<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

 

Abraços!

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.