[Arquivado] Olhem meu Log do Combofix, Malwarebytes e etc.. Já fi

[Batman-x 0]

Pessoal vou postar aqui o resultado obtido nos softwares de segurança que rodei e depois vou relatar meu problema que já dura quase uma semana. OK!

 

PRIMEIRO Hijack :

 

Logfile of HijackThis v1.99.1

Scan saved at 02:41:10, on 5/2/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\DOCUME~1\Higo\CONFIG~1\Temp\tdikex.exe

C:\DOCUME~1\Higo\CONFIG~1\Temp\idvg.exe

C:\DOCUME~1\Higo\CONFIG~1\Temp\winhdvj.exe

C:\Documents and Settings\Higo\Desktop\CHijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.254/

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1233681256304

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1233681800007

O17 - HKLM\System\CCS\Services\Tcpip\..\{F5628D1B-DFB7-49D8-BABB-83B731A12849}: NameServer = 201.10.128.3 201.10.120.3

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

 

--------------------________________-------------------------------________________

 

SEGUNDO ComboFix:

 

ComboFix 09-02-02.04 - Higo 2009-02-04 13:27:14.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.767.589 [GMT -2:00]

Executando de: c:\documents and settings\Higo\desktop\combofix.exe

AV: ESET NOD32 sistema antivírus 2.70 *On-access scanning enabled* (Outdated)

* Resident AV is active

 

 

ATENÇAO - ESTA MAQUINA não TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

 

(((((((((((((((( Arquivos/Ficheiros criados de 2009-01-04 to 2009-02-04 ))))))))))))))))))))))))))))

.

 

2009-02-04 13:19 . 2004-08-03 23:15 82,944 --a------ c:\windows\system32\drivers\wdmaud.sys

2009-02-04 13:19 . 2004-08-03 23:15 82,944 --a--c--- c:\windows\system32\dllcache\wdmaud.sys

2009-02-04 13:19 . 2001-08-17 22:00 54,272 --a------ c:\windows\system32\drivers\swmidi.sys

2009-02-04 13:19 . 2001-08-17 22:00 54,272 --a--c--- c:\windows\system32\dllcache\swmidi.sys

2009-02-04 13:19 . 2004-08-03 23:07 52,864 --a------ c:\windows\system32\drivers\DMusic.sys

2009-02-04 13:19 . 2004-08-03 23:07 52,864 --a--c--- c:\windows\system32\dllcache\dmusic.sys

2009-02-04 13:19 . 2004-08-03 23:07 6,400 --a------ c:\windows\system32\drivers\splitter.sys

2009-02-04 13:19 . 2004-08-03 23:07 6,400 --a--c--- c:\windows\system32\dllcache\splitter.sys

2009-02-04 13:17 . 2009-02-04 13:21 25 --a------ c:\windows\mixerdef.ini

2009-02-04 13:15 . 2009-02-04 13:15 69 --a------ c:\windows\NeroDigital.ini

2009-02-03 21:12 . 2009-02-03 21:12 <DIR> d-------- c:\arquivos de programas\MSN Messenger

2009-02-03 21:05 . 2009-02-04 13:11 <DIR> d-------- c:\windows\SxsCaPendDel

2009-02-03 20:00 . 2009-02-03 20:00 <DIR> d-------- c:\documents and settings\Higo\Contacts

2009-02-03 19:59 . 2009-02-03 19:59 <DIR> d----c--- c:\windows\system32\DRVSTORE

2009-02-03 19:51 . 2009-02-03 19:58 <DIR> d--hsc--- c:\arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2009-02-03 19:50 . 2009-02-03 20:56 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\WLInstaller

2009-02-03 19:18 . 2004-07-26 17:16 1,568,768 --------- c:\windows\system32\ImagX7.dll

2009-02-03 19:18 . 2004-07-26 17:16 476,320 --------- c:\windows\system32\ImagXpr7.dll

2009-02-03 19:18 . 2004-07-26 17:16 471,040 --------- c:\windows\system32\ImagXRA7.dll

2009-02-03 19:18 . 2004-07-26 17:16 262,144 --------- c:\windows\system32\ImagXR7.dll

2009-02-03 19:18 . 2000-06-26 11:45 106,496 --a------ c:\windows\system32\TwnLib20.dll

2009-02-03 19:17 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe

2009-02-03 19:15 . 2009-02-03 19:15 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Ahead

2009-02-03 19:15 . 2009-02-03 19:18 <DIR> d-------- c:\arquivos de programas\Ahead

2009-02-03 17:23 . 2009-02-03 17:23 <DIR> d-------- c:\documents and settings\Higo\Dados de aplicativos\Malwarebytes

2009-02-03 17:23 . 2009-02-03 17:23 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-02-03 17:23 . 2009-02-03 17:23 <DIR> d-------- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-02-03 17:23 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-03 17:23 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-03 17:05 . 2009-02-03 17:05 0 --a------ c:\windows\nsreg.dat

2009-02-03 15:44 . 2009-02-03 15:44 <DIR> d--h----- c:\windows\$hf_mig$

2009-02-03 15:16 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll

2009-02-03 15:16 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui

2009-02-03 15:16 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuaucpl.cpl.mui

2009-02-03 15:16 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui

2009-02-03 15:16 . 2008-10-16 14:07 18,968 --a------ c:\windows\system32\wuaueng.dll.mui

2009-02-03 14:53 . 2009-02-03 14:53 <DIR> d-------- c:\documents and settings\Higo\Dados de aplicativos\ImgBurn

2009-02-03 14:50 . 2009-02-03 14:50 <DIR> d-------- c:\arquivos de programas\ImgBurn

2009-02-03 14:27 . 2009-02-03 14:27 <DIR> d---s---- c:\documents and settings\Higo\UserData

2009-02-03 14:06 . 2009-02-03 14:06 <DIR> d-------- c:\arquivos de programas\MSBuild

2009-02-03 14:01 . 2009-02-03 14:01 <DIR> d-------- c:\windows\system32\XPSViewer

2009-02-03 14:00 . 2009-02-03 14:00 <DIR> d-------- c:\arquivos de programas\Reference Assemblies

2009-02-03 13:59 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll

2009-02-03 13:55 . 2006-10-16 16:10 23,856 --a------ c:\windows\system32\spupdsvc.exe

2009-02-03 13:35 . 2009-02-03 13:33 512,096 --a------ c:\windows\system32\drivers\amon.sys

2009-02-03 13:35 . 2009-02-03 13:33 298,104 --a------ c:\windows\system32\imon.dll

2009-02-03 13:35 . 2009-02-03 13:33 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys

2009-02-03 13:33 . 2009-02-03 16:56 <DIR> d-------- c:\arquivos de programas\ESET

2009-02-02 16:42 . 2009-02-02 16:42 <DIR> d--h----- c:\windows\system32\GroupPolicy

2009-02-02 16:36 . 2003-09-04 00:37 41,984 -ra------ c:\windows\system32\drivers\fetnd5b.sys

2009-02-02 16:33 . 2003-06-12 08:31 75,904 -ra------ c:\windows\system32\drivers\viasraid.sys

2009-02-02 16:31 . 2003-05-15 08:09 43,136 -ra------ c:\windows\system32\drivers\bcm4sbxp.sys

2009-02-02 16:28 . 2003-07-02 04:42 27,904 --a------ c:\windows\system32\drivers\VIAAGP1.SYS

2009-02-02 16:27 . 2009-02-02 16:27 <DIR> d-------- c:\documents and settings\Higo\WINDOWS

2009-02-02 16:27 . 2003-06-18 16:48 306,688 --a------ c:\windows\IsUninst.exe

2009-02-02 16:24 . 2009-02-02 15:33 <DIR> d--h----- c:\documents and settings\Higo\Modelos

2009-02-02 16:24 . 2009-02-03 21:05 <DIR> dr------- c:\documents and settings\Higo\Meus documentos

2009-02-02 16:24 . 2009-02-02 13:23 <DIR> dr------- c:\documents and settings\Higo\Menu Iniciar

2009-02-02 16:24 . 2009-02-03 16:41 <DIR> dr------- c:\documents and settings\Higo\Favoritos

2009-02-02 16:24 . 2009-02-03 17:23 <DIR> dr-h----- c:\documents and settings\Higo\Dados de aplicativos

2009-02-02 16:24 . 2009-02-04 13:28 <DIR> d--h----- c:\documents and settings\Higo\Configurações locais

2009-02-02 16:24 . 2009-02-02 13:23 <DIR> d--h----- c:\documents and settings\Higo\Ambiente de rede

2009-02-02 16:24 . 2009-02-02 13:23 <DIR> d--h----- c:\documents and settings\Higo\Ambiente de impressão

2009-02-02 16:24 . 2009-02-03 20:00 <DIR> d-------- c:\documents and settings\Higo

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-02 17:39 --------- d-----w c:\arquivos de programas\microsoft frontpage

2009-02-02 17:37 --------- d-----w c:\arquivos de programas\Serviços on-line

2009-02-02 17:36 --------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

.

 

((((((((((((((((((((((((((((( snapshot@2009-02-03_16.58.17,17 )))))))))))))))))))))))))))))))))))))))))

.

+ 2002-07-16 22:33:46 20,333 ----a-w c:\windows\cmaudio.dat

+ 2009-02-04 15:25:34 36,932 ----a-w c:\windows\cmijack.dat

+ 2002-07-11 14:13:26 135,168 ----a-w c:\windows\cmuninst.dat

+ 2002-07-11 13:24:50 139,264 ----a-w c:\windows\cmuninst.exe

+ 2009-02-03 23:12:38 29,926 ----a-r c:\windows\Installer\{37FD253D-5064-4034-8CEC-CC3995F823A4}\MsblIco.Exe

+ 2009-02-03 21:58:22 29,926 ----a-r c:\windows\Installer\{8EADB73B-026D-4978-A8F0-1EEF5E1ECEC7}\MsblIco.Exe

+ 2002-07-12 18:33:12 1,658,880 ----a-w c:\windows\mixer.exe

+ 2000-10-20 20:28:00 765,952 ----a-w c:\windows\system\crlds3d.dll

+ 2001-11-23 14:08:20 712,704 ----a-w c:\windows\system32\a3d.dll

+ 2001-11-23 14:08:20 712,704 ----a-w c:\windows\system32\Audio3D.dll

+ 2002-03-29 16:52:46 32,768 ----a-w c:\windows\system32\cmnprop.dll

+ 2001-11-23 14:08:20 712,704 -c--a-w c:\windows\system32\dllcache\a3d.dll

+ 2004-08-04 00:39:38 142,464 -c--a-w c:\windows\system32\dllcache\aec.sys

+ 2004-08-04 01:08:00 60,288 -c--a-w c:\windows\system32\dllcache\drmk.sys

+ 2004-08-04 01:07:58 2,944 -c--a-w c:\windows\system32\dllcache\drmkaud.sys

+ 2004-08-04 01:08:22 10,624 -c--a-w c:\windows\system32\dllcache\gameenum.sys

+ 2004-08-04 01:07:50 171,776 -c--a-w c:\windows\system32\dllcache\kmixer.sys

+ 2004-08-04 01:15:22 140,928 -c--a-w c:\windows\system32\dllcache\ks.sys

+ 2004-08-04 02:45:24 4,096 -c--a-w c:\windows\system32\dllcache\ksuser.dll

- 2004-08-04 03:45:24 2,804,224 -c--a-w c:\windows\system32\dllcache\msi.dll

+ 2005-05-04 16:45:32 2,890,240 -c--a-w c:\windows\system32\dllcache\msi.dll

- 2004-08-04 03:45:40 77,312 -c--a-w c:\windows\system32\dllcache\msiexec.exe

+ 2005-05-04 16:45:36 78,848 -c--a-w c:\windows\system32\dllcache\msiexec.exe

- 2004-08-04 03:45:24 331,264 -c--a-w c:\windows\system32\dllcache\msihnd.dll

+ 2005-05-04 16:45:36 271,360 -c--a-w c:\windows\system32\dllcache\msihnd.dll

- 2004-08-04 03:44:38 884,736 -c--a-w c:\windows\system32\dllcache\msimsg.dll

+ 2005-05-04 16:45:36 884,736 -c--a-w c:\windows\system32\dllcache\msimsg.dll

- 2004-08-04 03:45:24 44,032 -c--a-w c:\windows\system32\dllcache\msisip.dll

+ 2005-05-04 16:45:36 15,360 -c--a-w c:\windows\system32\dllcache\msisip.dll

+ 2004-08-04 00:58:42 7,552 -c--a-w c:\windows\system32\dllcache\mskssrv.sys

+ 2004-08-04 00:58:40 5,376 -c--a-w c:\windows\system32\dllcache\mspclock.sys

+ 2004-08-04 00:58:42 4,992 -c--a-w c:\windows\system32\dllcache\mspqm.sys

+ 2004-08-04 01:15:50 145,792 -c--a-w c:\windows\system32\dllcache\portcls.sys

+ 2004-08-04 01:08:04 48,640 -c--a-w c:\windows\system32\dllcache\stream.sys

+ 2004-08-04 01:15:56 60,800 -c--a-w c:\windows\system32\dllcache\sysaudio.sys

+ 2004-08-04 02:45:48 23,552 -c--a-w c:\windows\system32\dllcache\wdmaud.drv

- 2004-08-04 03:45:30 431,616 -c--a-w c:\windows\system32\dllcache\wuapi.dll

+ 2008-10-16 16:12:20 561,688 -c--a-w c:\windows\system32\dllcache\wuapi.dll

- 2004-08-04 03:45:30 36,864 -c--a-w c:\windows\system32\dllcache\wups.dll

+ 2008-10-16 16:08:58 34,328 -c--a-w c:\windows\system32\dllcache\wups.dll

+ 2004-08-04 00:39:38 142,464 ----a-w c:\windows\system32\drivers\aec.sys

+ 2002-07-16 12:58:12 379,726 ----a-w c:\windows\system32\drivers\cmaudio.sys

+ 2004-08-04 01:08:00 60,288 ----a-w c:\windows\system32\drivers\drmk.sys

+ 2004-08-04 01:07:58 2,944 ----a-w c:\windows\system32\drivers\drmkaud.sys

+ 2004-08-04 01:08:22 10,624 ----a-w c:\windows\system32\drivers\gameenum.sys

+ 2004-08-04 01:07:50 171,776 ----a-w c:\windows\system32\drivers\kmixer.sys

- 2004-08-04 03:55:42 140,928 ----a-w c:\windows\system32\drivers\ks.sys

+ 2004-08-04 01:15:22 140,928 ----a-w c:\windows\system32\drivers\ks.sys

+ 2004-08-04 00:58:42 7,552 ----a-w c:\windows\system32\drivers\MSKSSRV.sys

+ 2004-08-04 00:58:40 5,376 ----a-w c:\windows\system32\drivers\MSPCLOCK.sys

+ 2004-08-04 00:58:42 4,992 ----a-w c:\windows\system32\drivers\MSPQM.sys

+ 2004-08-04 01:15:50 145,792 ----a-w c:\windows\system32\drivers\portcls.sys

- 2004-08-04 03:55:42 48,640 ----a-w c:\windows\system32\drivers\stream.sys

+ 2004-08-04 01:08:04 48,640 ----a-w c:\windows\system32\drivers\stream.sys

+ 2004-08-04 01:15:56 60,800 ----a-w c:\windows\system32\drivers\sysaudio.sys

- 2009-02-02 17:43:44 91,088 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2009-02-03 19:07:28 94,272 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2004-08-04 02:45:24 4,096 ----a-w c:\windows\system32\ksuser.dll

- 2004-08-04 03:45:24 2,804,224 ----a-w c:\windows\system32\msi.dll

+ 2005-05-04 16:45:32 2,890,240 ----a-w c:\windows\system32\msi.dll

- 2004-08-04 03:45:40 77,312 ----a-w c:\windows\system32\msiexec.exe

+ 2005-05-04 16:45:36 78,848 ----a-w c:\windows\system32\msiexec.exe

- 2004-08-04 03:45:24 331,264 ----a-w c:\windows\system32\msihnd.dll

+ 2005-05-04 16:45:36 271,360 ----a-w c:\windows\system32\msihnd.dll

- 2004-08-04 03:44:38 884,736 ----a-w c:\windows\system32\msimsg.dll

+ 2005-05-04 16:45:36 884,736 ----a-w c:\windows\system32\msimsg.dll

- 2004-08-04 03:45:24 44,032 ----a-w c:\windows\system32\msisip.dll

+ 2005-05-04 16:45:36 15,360 ----a-w c:\windows\system32\msisip.dll

+ 2007-01-19 14:53:04 51,056 ----a-w c:\windows\system32\sirenacm.dll

- 2004-08-04 03:55:42 23,552 ----a-w c:\windows\system32\wdmaud.drv

+ 2004-08-04 02:45:48 23,552 ----a-w c:\windows\system32\wdmaud.drv

- 2004-08-04 03:45:30 431,616 ----a-w c:\windows\system32\wuapi.dll

+ 2008-10-16 16:12:20 561,688 ----a-w c:\windows\system32\wuapi.dll

- 2004-08-04 03:45:30 36,864 ----a-w c:\windows\system32\wups.dll

+ 2008-10-16 16:08:58 34,328 ----a-w c:\windows\system32\wups.dll

+ 2006-06-05 16:14:28 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll

+ 2006-06-05 16:14:28 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll

+ 2006-06-05 16:14:28 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll

.

-- Snapshot resetado para data atual --

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"nod32kui"="c:\arquivos de programas\Eset\nod32kui.exe" [2009-02-03 949376]

"C-Media Mixer"="Mixer.exe" [2002-07-12 c:\windows\mixer.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-08-04 00:56 1667584 c:\arquivos de programas\Messenger\msmsgs.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-01-19 12:54 5674352 c:\arquivos de programas\MSN Messenger\msnmsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"UacDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"d:\\Higo\\Programas\\SpeedTouch 510 v6\\SetupWizard\\stInstall.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"i:\\MIXER.EXE"=

"c:\\WINDOWS\\Mixer.exe"=

 

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2009-02-02 75904]

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-02-03 15424]

R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\iisnsn.sys --> c:\windows\system32\drivers\iisnsn.sys [?]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.bol.com.br/

uInternet Connection Wizard,ShellNext = hxxp://192.168.1.254/

LSP: c:\windows\system32\imon.dll

FF - ProfilePath - c:\documents and settings\Higo\Dados de aplicativos\Mozilla\Firefox\Profiles\apcvn07h.default\

 

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-04 13:28:33

Windows 5.1.2600 Service Pack 2 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

 

- - - - - - - > 'lsass.exe'(696)

c:\windows\system32\imon.dll

c:\arquivos de programas\Eset\pr_imon.dll

.

Tempo para conclusão: 2009-02-04 13:30:20

ComboFix-quarantined-files.txt 2009-02-04 15:30:18

ComboFix2.txt 2009-02-03 18:58:55

 

Pré-execução: 6.455.795.712 bytes disponíveis

Pós execução: 6,424,170,496 bytes disponíveis

 

241

 

----------------------__________---------------------------_____________-------------

 

TERCEIRO Malwarebytes:

 

Malwarebytes' Anti-Malware 1.33

Versão do banco de dados: 1721

Windows 5.1.2600 Service Pack 2

 

4/2/2009 13:47:15

mbam-log-2009-02-04 (13-47-12).txt

 

Tipo de Verificação: Rápida

Objetos verificados: 43491

Tempo decorrido: 2 minute(s), 16 second(s)

 

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 2

Pastas infectadas: 0

Arquivos infectados: 0

 

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

 

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

 

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

 

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

 

Ítens do Registro infectados:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

 

Pastas infectadas:

(Nenhum ítem malicioso foi detectado)

 

Arquivos infectados:

(Nenhum ítem malicioso foi detectado)

 

 

----------------------------_________________-------------------------______________

 

Gente aqui eu posso postar fotos?

É que tirei várias screen para vocês poderem verem os vírus, span que estou no PC.

 

O que aconteceu foi o seguinte, estava com problema que nem em modo de segurança eu podia entrar, aí quando fui rodar o Combofix no desktop no modo normal ele resetava.

Os anti vírus que instalava ficavam execundando e forma oculta.

Tinha arquivos que depois de usar uma vez não dava para usar uma segunda vez.

Tinha que baixar os mesmos novamente caso quisesse fazer isso.

 

O Gerenciador não abre.

Fala que o Administrador desabilitou.

O mesmo com alguns comandos no campo executar(como o regedit)

 

Aí fui obrigado a formatar a máquina.

O problema foi que depis de formatada eu executei um arquivo e peguei o mesmo problema.

Só que antes deu ter instalado esse arquivo(o que me me trouxe o problema novamente) eu havia rodado o Nod 32 Versão 2.7 atualizado e alguns malware e nenhum achou nada(arquivos)infectados na minha máquina.

 

E agora como eu vou descobrir quais arquivos foram contaminados?

 

Agora formatei novamente e executei outro arquivo(um porgrama)e peguei o vírus de novo e rodei esses softwares.

Antes não conseguia executar o Combofix porque tinha mais "sujeiras" no meu PC.

 

 

Espero contar com à ajuda de vocês. Tá Bom!

 

Desde já agradeço e fico no aguardo. Valeu!!

[DigRam 144]

Boa Tarde! Batman-x

 

<!> Vá à pasta de backups do HijackThis,e restaure tudo o que está lá.

<!> Não dê fixes,aleatoriamente,isso é perigoso e,com o KillBox,pode dar até prisão perpétua. rsrsrs..

--------------------------------

<@> Baixe: < FixPolicies >

<@> Salve-o no Desktop!

<@> Execute o arquivo FixPolicies.exe,com um duplo-clique.

<@> Clique em Install.

<@> Abra a pasta FixPolicies --> Clique em Fix_policies.cmd

<@> Dê permissão ao reparo,caso seja negada por programas de proteção.

<@> Aguarde o término da verificação!

--------------------------------

<@> Baixe: < OTMoveIt3 >

<@> Salve-o no desktop e,execute-o aí mesmo!

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

:Processes

explorer.exe

:Services

abp470n

:Files

C:\DOCUME~1\Higo\CONFIG~1\Temp\tdikex.exe

C:\DOCUME~1\Higo\CONFIG~1\Temp\idvg.exe

C:\DOCUME~1\Higo\CONFIG~1\Temp\winhdvj.exe

:Commands

[purity]

[emptytemp]

[start explorer]

[Reboot]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

<@> Copie e cole estas informações,entre os XXXXX...,para o campo ( clipboard ),da ferramenta.

<@> Ps: Área abaixo de "Paste Instructions for Items to be Moved".

<@> Clique em MoveIt.

<@> Na solicitação de reboot,confirme!

<@> Terminando,verifique o conteúdo texto da pasta: C:\_OTMoveIt\MovedFiles

<@> Copie e poste,seu relatório mais recente: C:\_OTMoveIt\MovedFiles\xxxx2009_xxxxxx.log <--

<@> Ps: Como a ferramenta não sobreescreve seus relatórios,há que observar o que foi gerado após sua execução.

<@> Poste,também,HijackThis atualizado e... completo! <--

 

Abraços!

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.