almenes 0 Denunciar post Postado Janeiro 23, 2009 OLÁ, MEU EXPLORER FICA REINICIANDO O TEMPO TODO. CONSEGUI REMOVER UM ARQUIVO, QUE, SEGUNDO A PESQUISA QUE FIZ, PODERIA ESTAR CAUSANDO O PROBLEMA. PORÉM, MESMO APÓS REMOVÊ-LO O PROBLEMA CONTINUA. O PROGRAMA QUE REMOVI FOI SFDHOST.EXE. REMOVI O ARQUIVO DA PASTA SYSTEM32 E ALGUMAS ENTRADAS RELACIONADAS AO ARQUIVO NO REGISTRO. SEGUE MEU LOG PARA VERIFICAÇÃO. AGRADEÇO A COLABORAÇÃO. ABRAÇO A TODOS. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:55:11, on 23/1/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Arquivos comuns\ArcSoft\Connection Service\Bin\ACService.exe C:\Arquivos de programas\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Arquivos de programas\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Arquivos de programas\Raxco\PerfectDisk\PDAgent.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\RealVNC\VNC4\WinVNC4.exe C:\Arquivos de programas\Eset\nod32kui.exe C:\Arquivos de programas\Raxco\PerfectDisk\PDEngine.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\rundll32.exe C:\HiJack\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\WINDOWS\7SP_Files\Styler\TB\StylerTB.dll O4 - HKLM\..\Run: [nod32kui] "C:\Arquivos de programas\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{73715C78-1C25-4144-9A65-CDE4BD8BAA95}: NameServer = 192.168.254.254 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\Skype4COM.dll O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Arquivos de programas\Arquivos comuns\ArcSoft\Connection Service\Bin\ACService.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Arquivos de programas\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDAgent - Raxco Software, Inc. - C:\Arquivos de programas\Raxco\PerfectDisk\PDAgent.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Arquivos de programas\Raxco\PerfectDisk\PDEngine.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Arquivos de programas\RealVNC\VNC4\WinVNC4.exe -- End of file - 6332 bytes Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Janeiro 24, 2009 Opa almenes, Baixe o ComboFix em: ComboFix 1) Desabilite o seu anti-vírus temporariamente; 2) Dê um duplo-clique no combofix.exe e aguarde (o processo total demora cerca de 10 minutos); 3) A janela de “NEGAÇÃO DE GARANTIA DO SOFTWARE” abrir-se-á. Leia atentamente o texto contido nesta janela e clique sobre “SIM” para continuar. PS.: Caso não concorde com os termos clique sobre “NÃO” para sair do software, cabendo lembrar que o processo de desinfecção não será possível sem a continuidade do ComboFix. 4) Outra janela irá abrir, caso a sua máquina não possua o CONSOLE DE RECUPERAÇÃO DO WINDOWS. É recomendável executar a instalação do console ante de dar continuidade ao processo, pois tal ação proporcionará a garantia de que o sistema poderá ser recuperado em caso de problemas durante a varredura. Clique sobre “SIM” e aguarde, pois o processo de instalação do console dar-se-á automaticamente através do próprio ComboFix. Ele poderá demorar alguns minutos (dependerá da velocidade de sua conexão), portanto seja paciente. Quando a janela “INSTALANDO O CONSOLE DE RECUPERAÇÃO” aparecer clique em “OK”, depois clique sobre “SIM” para aceitar a licença EULA. Ao término da instalação do console de recuperação abrir-se-á uma janela avisando que “O CONSOLE DE RECUPERAÇÃO FOI INSTALADA COM SUCESSO”. Clique sobre “SIM” para continuar a varredura. 5) O ComboFix iniciará o AUTOSCAN (aguarde). ATENÇÃO: Não clique na janela do ComboFix, nem termine o processo abruptamente enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco). Ao término do processo a máquina será reiniciada para a emissão do relatório. 6) Ao reiniciar a máquina o ComboFix irá executar o FIND3M para a criação do relatório final da varredura. O log ficará alocado em C:\ComboFix.txt. 7) Reabilite o seu anti-vírus; 8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta. OBS.1: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Em último caso, tente utilizar o ComboFix em MODO SEGURO. OBS.2: Caso haja um clique sobre a janela do ComboFix em execução, ela irá MAXIMIZAR, sobrepondo-se sobre as demais. Para minimizá-la novamente basta utilizar a combinação ALT + TAB. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
almenes 0 Denunciar post Postado Janeiro 31, 2009 ComboFix 09-01-21.04 - Allan 2009-01-31 0:53:42.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.511.145 [GMT -2:00] Executando de: c:\documents and settings\Allan\Desktop\KomboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090130-0] *On-access scanning disabled* (Updated) * Criado um novo ponto de restauro . - MODO DE FUNCIONALIDADE REDUZIDA - . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013 c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini c:\windows\msvrc20.dll c:\windows\system32\Cache . (((((((((((((((( Arquivos/Ficheiros criados de 2008-12-28 to 2009-01-31 )))))))))))))))))))))))))))) . 2009-01-31 00:50 . 2009-01-31 00:50 <DIR> d-------- C:\32788R22FWJFW 2009-01-28 16:55 . 2009-01-28 16:55 <DIR> d-------- c:\arquivos de programas\AnalogX 2009-01-27 16:50 . 2009-01-27 16:50 <DIR> d-------- C:\Wanted 2009-01-27 16:33 . 2009-01-27 16:33 <DIR> d-------- C:\O Senhor dos ladrões 2009-01-27 16:19 . 2009-01-27 16:19 <DIR> d-------- C:\Resident Evil - Extinction 2009-01-27 08:47 . 2009-01-27 08:47 <DIR> d-------- c:\arquivos de programas\Ares 2009-01-24 23:02 . 2009-01-24 23:02 <DIR> d-------- c:\arquivos de programas\Alwil Software 2009-01-23 14:57 . 2009-01-23 14:57 <DIR> d-------- c:\arquivos de programas\Calibrize 2009-01-22 13:02 . 2009-01-23 13:55 <DIR> d-------- C:\HiJack 2009-01-21 13:18 . 2009-01-26 10:56 368 --ahs---- c:\windows\system32\OWaIknmp.ini2 2009-01-21 13:18 . 2009-01-26 10:56 368 --ahs---- c:\windows\system32\OWaIknmp.ini 2009-01-21 13:13 . 2009-01-21 13:13 <DIR> d-------- c:\documents and settings\Allan\Dados de aplicativos\Babylon 2009-01-21 13:13 . 2009-01-21 13:13 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Babylon 2009-01-21 11:43 . 2009-01-21 11:43 <DIR> d-------- c:\arquivos de programas\DVDVideoSoft 2009-01-21 11:43 . 2009-01-21 11:43 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\DVDVideoSoft 2009-01-19 08:03 . 2009-01-27 23:27 0 --a------ C:\dump_dvd.vob 2009-01-18 20:41 . 2009-01-18 20:41 <DIR> d-------- c:\documents and settings\Allan\Dados de aplicativos\Styler 2009-01-18 16:46 . 2006-11-03 00:21 8,269,824 --a------ c:\windows\system32\wmploc.backup 2009-01-18 16:42 . 2008-04-14 00:20 1,710,592 --a------ c:\windows\system32\netshell.backup 2009-01-18 16:41 . 2008-04-14 00:21 1,219,072 --a------ c:\windows\system32\ntbackup.backup 2009-01-18 16:40 . 2008-08-14 11:24 2,193,408 --a------ c:\windows\system32\ntoskrnl.backup 2009-01-18 16:39 . 2008-04-14 00:20 1,287,168 --a------ c:\windows\system32\ole32.backup 2009-01-18 16:38 . 2008-04-14 00:20 1,876,992 --a------ c:\windows\system32\mmcndmgr.backup 2009-01-18 16:37 . 2008-04-14 00:20 617,472 --a------ c:\windows\system32\comctl32.backup 2009-01-18 16:31 . 2009-01-18 16:46 <DIR> d-------- c:\windows\7SP_Files 2009-01-16 19:45 . 2008-04-14 00:20 159,232 --a------ c:\windows\system32\ptpusd.dll 2009-01-16 19:45 . 2001-09-05 23:50 5,632 --a------ c:\windows\system32\ptpusb.dll 2009-01-16 11:32 . 2009-01-23 12:48 <DIR> d-a------ c:\documents and settings\All Users\Dados de aplicativos\TEMP 2009-01-16 11:32 . 2009-01-16 11:32 240,240 --a------ c:\windows\system32\wpcap.dll 2009-01-16 11:32 . 2009-01-16 11:32 88,704 --a------ c:\windows\system32\packet.dll 2009-01-16 11:32 . 2009-01-16 11:32 42,512 --a------ c:\windows\system32\drivers\npf.sys 2009-01-14 07:59 . 2007-10-12 15:14 3,734,536 --a------ c:\windows\system32\d3dx9_36.dll 2009-01-14 07:59 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll 2009-01-14 07:59 . 2007-05-16 16:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll 2009-01-14 07:59 . 2007-07-19 18:14 1,358,192 --a------ c:\windows\system32\D3DCompiler_35.dll 2009-01-14 07:59 . 2007-05-16 16:45 1,124,720 --a------ c:\windows\system32\D3DCompiler_34.dll 2009-01-14 07:59 . 2007-07-19 18:14 444,776 --a------ c:\windows\system32\d3dx10_35.dll 2009-01-14 07:59 . 2007-05-16 16:45 443,752 --a------ c:\windows\system32\d3dx10_34.dll 2009-01-14 07:59 . 2007-07-20 00:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll 2009-01-14 07:59 . 2007-06-20 20:46 266,088 --a------ c:\windows\system32\xactengine2_8.dll 2009-01-14 07:59 . 2007-04-04 18:55 261,480 --a------ c:\windows\system32\xactengine2_7.dll 2009-01-14 07:59 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll 2009-01-14 07:59 . 2007-10-22 03:37 17,928 --a------ c:\windows\system32\X3DAudio1_2.dll 2009-01-14 07:57 . 2009-01-14 07:57 <DIR> d-------- c:\windows\Logs 2009-01-14 07:56 . 2009-01-14 08:01 <DIR> d-------- c:\arquivos de programas\Euro Truck Simulator 2009-01-12 09:49 . 2009-01-12 09:50 <DIR> d-------- c:\windows\speech 2009-01-12 09:49 . 2009-01-12 12:21 <DIR> d-------- c:\windows\Lhsp 2009-01-12 09:48 . 2009-01-12 09:50 <DIR> d-------- C:\falador 2009-01-11 13:46 . 2009-01-21 17:36 5,120 --ahs---- c:\windows\Thumbs.db 2009-01-09 07:26 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll 2009-01-09 07:26 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll 2009-01-09 07:26 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui 2009-01-08 19:41 . 2009-01-08 19:41 <DIR> d-------- c:\arquivos de programas\Microsoft Office Outlook Connector 2009-01-08 19:39 . 2009-01-08 19:39 <DIR> d-------- c:\arquivos de programas\Microsoft Sync Framework 2009-01-08 19:37 . 2009-01-08 19:37 <DIR> d-------- c:\arquivos de programas\Microsoft SQL Server Compact Edition 2009-01-08 19:37 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll 2009-01-08 19:35 . 2009-01-08 19:41 <DIR> d-------- c:\arquivos de programas\Microsoft 2009-01-08 19:34 . 2009-01-08 19:34 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive 2009-01-06 12:11 . 2009-01-06 12:11 <DIR> d-------- c:\documents and settings\Allan\Dados de aplicativos\ID3 renamer 2009-01-06 12:11 . 2009-01-06 12:11 <DIR> d-------- c:\arquivos de programas\ID3 renamer 2009-01-06 12:07 . 2009-01-06 12:19 <DIR> d-------- c:\arquivos de programas\Organizer Mp3 2009-01-06 11:12 . 2000-12-06 00:00 209,608 --a------ c:\windows\system32\TabCtl32.ocx 2008-12-30 12:54 . 2008-12-30 12:54 <DIR> d--h----- c:\windows\system32\GroupPolicy 2008-12-30 10:56 . 2008-05-09 08:55 512,000 -----c--- c:\windows\system32\dllcache\jscript.dll 2008-12-30 10:56 . 2008-05-09 08:55 430,080 -----c--- c:\windows\system32\dllcache\vbscript.dll 2008-12-30 10:56 . 2008-05-09 08:55 180,224 -----c--- c:\windows\system32\dllcache\scrobj.dll 2008-12-30 10:56 . 2008-05-09 08:55 172,032 -----c--- c:\windows\system32\dllcache\scrrun.dll 2008-12-30 10:56 . 2008-05-08 09:24 155,648 -----c--- c:\windows\system32\dllcache\wscript.exe 2008-12-30 10:56 . 2008-05-09 06:45 135,168 -----c--- c:\windows\system32\dllcache\cscript.exe 2008-12-30 10:56 . 2008-05-09 08:55 90,112 -----c--- c:\windows\system32\dllcache\wshext.dll 2008-12-29 14:46 . 2008-12-29 14:46 38 --a------ c:\windows\avisplitter.INI 2008-12-28 23:27 . 2008-12-28 23:27 <DIR> d-------- c:\arquivos de programas\Microsoft Games 2008-12-25 16:45 . 2008-12-25 16:45 <DIR> d-------- c:\arquivos de programas\Smart Projects 2008-12-25 12:52 . 2008-05-10 14:43 316,973,608 --a------ c:\windows\system32\WindowsXP-KB936929-SP3-x86-PTB.exe 2008-12-25 12:40 . 2009-01-21 17:37 <DIR> d-------- C:\Win 2008-12-24 21:56 . 2008-12-24 21:56 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\NVIDIA 2008-12-24 01:09 . 2008-10-16 18:23 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-12-24 01:09 . 2007-04-17 07:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-12-24 01:09 . 2007-03-08 03:12 1,024,000 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-12-24 01:09 . 2008-10-16 18:23 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-12-24 01:09 . 2008-10-16 18:23 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-12-24 01:09 . 2008-10-16 18:23 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-12-24 01:09 . 2008-10-16 18:23 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-12-24 01:09 . 2008-10-16 18:23 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-12-24 01:09 . 2008-10-16 11:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-12-24 00:05 . 2008-09-09 23:15 1,307,648 -----c--- c:\windows\system32\dllcache\msxml6.dll 2008-12-24 00:05 . 2007-06-26 04:00 457,607 -----c--- c:\windows\system32\dllcache\mdlib.wmv 2008-12-24 00:05 . 2007-06-26 04:00 375,519 -----c--- c:\windows\system32\dllcache\nuskin.wmv 2008-12-24 00:05 . 2008-04-14 00:18 294,912 -----c--- c:\windows\system32\dllcache\msaud32.acm 2008-12-24 00:05 . 2008-04-14 00:18 290,816 -----c--- c:\windows\system32\dllcache\l3codeca.acm 2008-12-24 00:05 . 2007-06-26 03:59 97,117 -----c--- c:\windows\system32\dllcache\mplayer2.hlp 2008-12-24 00:05 . 2008-04-13 18:58 86,016 -----c--- c:\windows\system32\dllcache\msxml6r.dll 2008-12-24 00:05 . 2004-08-04 01:41 36,690 -----c--- c:\windows\system32\dllcache\mplayer2.inf 2008-12-24 00:05 . 2001-09-06 07:00 22,060 -----c--- c:\windows\system32\dllcache\npds.zip 2008-12-24 00:05 . 2007-06-25 23:00 2,778 -----c--- c:\windows\system32\dllcache\mplogoh.gif 2008-12-24 00:05 . 2007-06-25 23:00 2,545 -----c--- c:\windows\system32\dllcache\mplogo.gif 2008-12-24 00:05 . 2007-06-26 03:59 1,885 -----c--- c:\windows\system32\dllcache\mplayer2.cnt 2008-12-24 00:05 . 2001-09-06 07:00 403 -----c--- c:\windows\system32\dllcache\npdrmv2.zip 2008-12-24 00:04 . 2008-04-13 19:20 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe 2008-12-24 00:04 . 2008-04-14 00:19 102,912 -----c--- c:\windows\system32\dllcache\dpcdll.dll 2008-12-24 00:04 . 2008-04-14 00:18 24,064 -----c--- c:\windows\system32\dllcache\pidgen.dll 2008-12-24 00:04 . 2006-12-28 17:01 19,569 --a------ c:\windows\003305_.tmp 2008-12-24 00:04 . 2007-06-25 23:00 5,971 -----c--- c:\windows\system32\dllcache\events.js 2008-12-24 00:03 . 2007-06-26 04:00 381,425 -----c--- c:\windows\system32\dllcache\copycd.wmv 2008-12-24 00:03 . 2004-07-17 09:35 184,126 -----c--- c:\windows\system32\dllcache\compact.wmz 2008-12-24 00:03 . 2007-06-25 23:00 9,585 -----c--- c:\windows\system32\dllcache\controls.css 2008-12-24 00:03 . 2007-06-26 04:00 8,298 -----c--- c:\windows\system32\dllcache\contents.htm 2008-12-24 00:03 . 2007-06-26 04:00 6,878 -----c--- c:\windows\system32\dllcache\controls.js 2008-12-24 00:03 . 2007-06-25 23:00 999 -----c--- c:\windows\system32\dllcache\bktrh.gif 2008-12-24 00:03 . 2007-06-25 23:00 773 -----c--- c:\windows\system32\dllcache\cnth.gif 2008-12-24 00:03 . 2007-06-25 23:00 773 -----c--- c:\windows\system32\dllcache\cnt.gif 2008-12-24 00:03 . 2007-06-25 23:00 772 -----c--- c:\windows\system32\dllcache\cntd.gif 2008-12-24 00:03 . 2007-06-25 23:00 760 -----c--- c:\windows\system32\dllcache\cloapph.gif 2008-12-24 00:03 . 2007-06-25 23:00 717 -----c--- c:\windows\system32\dllcache\cloapp.gif 2008-12-23 02:40 . 2009-01-17 21:09 230,454 --a------ C:\StiImg.dat 2008-12-22 19:12 . 2008-12-22 19:12 <DIR> d-------- c:\arquivos de programas\DVD Decrypter 2008-12-22 15:00 . 2009-01-21 17:37 <DIR> d-------- C:\Downloads 2008-12-21 14:15 . 2008-08-14 08:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys 2008-12-21 14:14 . 2008-06-14 15:34 272,384 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-12-21 14:12 . 2008-12-11 08:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys 2008-12-21 14:11 . 2008-09-15 13:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-12-21 14:10 . 2008-11-08 19:23 2,312,832 --a--c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-12-21 14:10 . 2008-08-14 11:24 2,149,376 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-12-21 14:10 . 2008-08-14 11:24 2,070,272 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-12-21 14:10 . 2008-08-14 11:24 2,028,032 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-31 02:25 --------- d-----w c:\arquivos de programas\eMule 2009-01-27 18:49 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\DVD Shrink 2009-01-25 02:15 --------- d-----w c:\arquivos de programas\ESET 2009-01-19 01:52 --------- d-----w c:\arquivos de programas\CCleaner 2009-01-18 01:17 --------- d-----w c:\documents and settings\Allan\Dados de aplicativos\Skype 2009-01-11 13:19 --------- d-----w c:\arquivos de programas\Microsoft Works 2009-01-08 21:39 --------- d-----w c:\arquivos de programas\Windows Live 2008-12-22 18:05 --------- d-----w c:\documents and settings\Allan\Dados de aplicativos\skypePM 2008-12-21 16:06 --------- d-----w c:\arquivos de programas\PowerISO 2008-12-21 12:37 --------- d-----w c:\arquivos de programas\Nero 2008-12-21 12:37 --------- d-----w c:\arquivos de programas\Marcos Velasco Security 2008-12-21 12:28 --------- d-----w c:\arquivos de programas\Windows Media Connect 2 2008-12-16 16:18 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information 2008-12-14 17:25 --------- d-----w c:\arquivos de programas\VIA 2008-12-11 17:40 --------- d-----w c:\arquivos de programas\IObit 2008-12-11 17:35 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-05 10:39 --------- d-----w c:\arquivos de programas\Unlocker 2008-12-04 02:40 --------- d-----w c:\documents and settings\Allan\Dados de aplicativos\Ahead 2008-11-30 15:10 --------- d-----w c:\arquivos de programas\WorldUnlock Codes Calculator 2008-11-28 15:44 --------- d-----w c:\documents and settings\Allan\Dados de aplicativos\HP 2008-11-28 15:44 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\HP 2008-11-28 15:43 --------- d-----w c:\arquivos de programas\HP 2008-11-28 15:43 --------- d-----w c:\arquivos de programas\Arquivos comuns\HP 2008-11-28 15:41 --------- d-----w c:\arquivos de programas\Hewlett-Packard 2008-11-28 15:40 --------- d-----w c:\arquivos de programas\Arquivos comuns\Hewlett-Packard 2008-11-16 00:55 6,192,128 ----a-w c:\windows\system32\logonui.exe 2008-11-08 21:23 2,312,832 ----a-w c:\windows\system32\ntoskrnl.exe 2008-11-07 22:12 298,104 ----a-w c:\windows\system32\imon.dll 2008-10-23 12:37 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:23 927,744 ----a-w c:\windows\system32\wininet.dll 2008-10-16 16:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 16:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 16:12 498,200 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 16:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 16:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 16:09 77,336 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 16:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 16:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll . ------- Sigcheck ------- 2004-08-04 01:45 577536 e0ff28447d1038de106d1f2fdf851647 c:\windows\$NtServicePackUninstall$\user32.dll 2008-04-14 00:20 649728 96e31dc5fdaa9495eaad177e4a319ce7 c:\windows\7SP_Files\user32.dll 2008-04-14 00:20 579072 54907db28872a7a6d3ee2b4747a23828 c:\windows\7SP_Files\backup\user32.dll 2008-04-14 00:20 649728 96e31dc5fdaa9495eaad177e4a319ce7 c:\windows\ServicePackFiles\i386\user32.dll 2008-04-14 00:20 649728 96e31dc5fdaa9495eaad177e4a319ce7 c:\windows\system32\user32.dll 2008-08-26 07:10 827904 cc9cd001ae0ff30d0e16a172bf39576a c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll 2008-10-16 08:23 669696 abec7b8444b02d494c7780bc8bcdf44b c:\windows\$hf_mig$\KB958215\SP2QFE\wininet.dll 2008-10-15 23:02 668160 5ed4af2ad048b1afb5a92e0e9ef42011 c:\windows\$hf_mig$\KB958215\SP3GDR\wininet.dll 2008-10-15 23:04 669184 a6506d61159aae4bc72406aae4779538 c:\windows\$hf_mig$\KB958215\SP3QFE\wininet.dll 2008-10-16 17:33 827904 4bcd45d77bd42a5e9c2dd2e847a5467e c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll 2008-10-16 18:23 927744 a0b2a86e353212ac75aefa0fc4cae186 c:\windows\7SP_Files\wininet.dll 2008-10-16 18:23 826368 779479e6f38bc77831f26bd9aae3fad3 c:\windows\7SP_Files\backup\wininet.dll 2008-10-16 08:39 661504 28faee723326e23de40278c99e635ff4 c:\windows\ie7\wininet.dll 2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 c:\windows\ie7updates\KB956390-IE7\wininet.dll 2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 c:\windows\ie7updates\KB958215-IE7\wininet.dll 2008-10-16 18:23 927744 a0b2a86e353212ac75aefa0fc4cae186 c:\windows\ServicePackFiles\i386\wininet.dll 2008-08-20 03:09 668160 89360a12db77d411b2873e130923f6b9 c:\windows\SoftwareDistribution\Download\8a2922b12b3175a3d641a503fd891792\sp3gdr\wininet.dll 2008-08-20 03:07 668672 6c73c1a54e445c5687ad6b721ee27ebc c:\windows\SoftwareDistribution\Download\8a2922b12b3175a3d641a503fd891792\sp3qfe\wininet.dll 2008-10-16 18:23 927744 a0b2a86e353212ac75aefa0fc4cae186 c:\windows\system32\wininet.dll 2008-10-16 18:23 927744 a0b2a86e353212ac75aefa0fc4cae186 c:\windows\system32\dllcache\wininet.dll 2008-08-14 11:39 2190208 b72a025a758683552c4fec7eabcb0661 c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe 2008-08-14 11:24 2193408 04ba43b0d2a13bd6b06d707299243cfc c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe 2008-08-14 19:26 2193408 a42cc3cfc02a7b2baec7b0d45808b257 c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe 2008-08-14 11:45 2184576 837fcf2a885b4cf3f28475d8376b4fd2 c:\windows\$NtServicePackUninstall$\ntoskrnl.exe 2008-11-08 19:23 2312832 c77b5dacde435b4fbbdc01d2df82e63b c:\windows\7SP_Files\ntoskrnl.exe 2008-08-14 11:24 2193408 04ba43b0d2a13bd6b06d707299243cfc c:\windows\7SP_Files\backup\ntoskrnl.exe 2008-11-08 19:23 2312832 c77b5dacde435b4fbbdc01d2df82e63b c:\windows\Driver Cache\i386\ntoskrnl.exe 2008-11-08 19:23 2312832 c77b5dacde435b4fbbdc01d2df82e63b c:\windows\ServicePackFiles\i386\ntoskrnl.exe 2008-11-08 19:23 2312832 c77b5dacde435b4fbbdc01d2df82e63b c:\windows\system32\ntoskrnl.exe 2008-11-08 19:23 2312832 c77b5dacde435b4fbbdc01d2df82e63b c:\windows\system32\dllcache\ntoskrnl.exe 2008-04-14 00:20 1514496 06151c4b4c7c2d47c349189c6dd5f577 c:\windows\explorer.exe 2004-08-04 01:45 1034240 fa61a19050ae14bec1a26de82390dd65 c:\windows\$NtServicePackUninstall$\explorer.exe 2008-04-14 00:20 1514496 06151c4b4c7c2d47c349189c6dd5f577 c:\windows\7SP_Files\explorer.exe 2008-04-14 00:20 1035776 064ec7ff5f58b928c3e119402977fa6d c:\windows\7SP_Files\backup\explorer.exe 2008-04-14 00:20 1514496 06151c4b4c7c2d47c349189c6dd5f577 c:\windows\ServicePackFiles\i386\explorer.exe 2008-10-16 14:09 77336 fc861eb38777c5752867c554009d5ee5 c:\windows\7SP_Files\wuauclt.exe 2008-10-16 14:09 51224 e654b78d2f1d791b30d0ed9a8195ec22 c:\windows\7SP_Files\backup\wuauclt.exe 2008-10-16 14:09 77336 fc861eb38777c5752867c554009d5ee5 c:\windows\ServicePackFiles\i386\wuauclt.exe 2008-10-16 14:09 77336 fc861eb38777c5752867c554009d5ee5 c:\windows\system32\wuauclt.exe 2008-10-16 14:09 77336 fc861eb38777c5752867c554009d5ee5 c:\windows\system32\dllcache\wuauclt.exe . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "CGFLoader"="c:\arquivos de programas\Calibrize\CalibrizeLoader.exe" [2007-11-26 1961984] "CalibrizeResume"="c:\arquivos de programas\Calibrize\CalibrizeResume.exe" [2007-11-26 413696] "eMuleAutoStart"="c:\arquivos de programas\eMule\eMule.exe" [2008-08-01 5480448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560] "avast!"="c:\arquivos de programas\Alwil Software\Avast4\ashDisp.exe" [2008-11-26 81000] "QuickTime Task"="c:\arquivos de programas\QuickTime\qttask.exe" [2008-09-06 413696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544] "nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "HideRunAsVerb"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk * [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\pmnkIaWO [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-14 00:20 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2007-04-09 10:23 200704 c:\arquivos de programas\PowerISO\PWRISOVM.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"= "c:\\Arquivos de programas\\eMule\\emule.exe"= "c:\\Arquivos de programas\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"= "c:\\Arquivos de programas\\RealVNC\\VNC4\\winvnc4.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Arquivos de programas\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "c:\\Arquivos de programas\\MotoGP2\\motogp2.exe"= "c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"= "c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"= "c:\\Arquivos de programas\\Internet Explorer\\iexplore.exe"= "c:\\Arquivos de programas\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Arquivos de programas\\Ares\\Ares.exe"= "c:\\Arquivos de programas\\AnalogX\\Proxy\\proxy.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-24 111184] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-24 20560] R4 SeaPort;SeaPort;c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640] S3 NPF;Netgroup Packet Filter;c:\windows\system32\drivers\npf.sys [2009-01-16 42512] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\setup.exe . Conteúdo da pasta 'Tarefas Agendadas' 2009-01-31 c:\windows\Tasks\wcfgoqei.job - c:\windows\system32\opnlIyXn.dll [] . - - - - ORFÃOS REMOVIDOS - - - - Notify-nnnlmNHx - nnnlmNHx.dll . ------- Scan Suplementar ------- . uStart Page = hxxp://www.google.com.br/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 192.168.10.2:6588 IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {73715C78-1C25-4144-9A65-CDE4BD8BAA95} = 192.168.254.254 FF - ProfilePath - c:\documents and settings\Allan\Dados de aplicativos\Mozilla\Firefox\Profiles\jq8tfqar.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - prefs.js: browser.search.selectedEngine - Live Search FF - prefs.js: browser.startup.homepage - www.google.com.br FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - component: c:\arquivos de programas\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npdsplay.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npfdm.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\NPOFFICE.DLL FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin2.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin3.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin4.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin5.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin6.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npqtplugin7.dll FF - plugin: c:\arquivos de programas\Opera 10 Preview\program\plugins\npwmsdrm.dll FF - plugin: c:\arquivos de programas\Windows Live\Photo Gallery\NPWLPG.dll ---- FIREFOX POLICIES ---- c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-31 00:54:03 Windows 5.1.2600 Service Pack 3 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*] "6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- - - - - - - - > 'winlogon.exe'(736) c:\windows\system32\sxs.dll c:\windows\system32\cscui.dll c:\windows\system32\COMRes.dll . Tempo para conclusão: 2009-01-31 0:56:08 ComboFix-quarantined-files.txt 2009-01-31 02:56:04 Pré-execução: 20 pasta(s) 19.826.569.216 bytes disponíveis Pós execução: 20 pasta(s) 19,843,424,256 bytes disponíveis WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 388 --- E O F --- 2009-01-16 10:43:55 Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Fevereiro 1, 2009 Opa almenes, Siga as instruções: 1. Abra o Bloco de Notas -> Copie (Control + C) e Cole (Control + V) todo o texto incluído no "Quote": File::c:\windows\system32\OWaIknmp.ini c:\windows\system32\OWaIknmp.ini2 c:\windows\Tasks\wcfgoqei.job c:\windows\system32\opnlIyXn.dll c:\windows\Thumbs.db c:\windows\003305_.tmp C:\dump_dvd.vob F:\setup.exe Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] [-HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*] ATENÇÃO: O script acima foi elaborado especificamente para a infecção contida neste computador. Utilizá-lo em outra máquina poderá originar graves problemas ao usuário. 2. Salve o arquivo como CFScript.txt; 3. Tal como exemplificado na foto abaixo, arraste o arquivo CFScript.txt para o ComboFix.exe. 4. Ao término do processo a ferramenta irá gerar um log. Poste-o (C:\ComboFix.txt) em sua próxima resposta, juntamente com um novo log do HijackThis. Abraços. PS.: Execute a ação com o seu pendrive conectado ao PC. Compartilhar este post Link para o post Compartilhar em outros sites
Mário Monteiro 179 Denunciar post Postado Março 2, 2009 Tópico Arquivado Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
