[Resolvido!] Found Registry

carolpower · Fevereiro 26, 2009

ComboFix 09-02-25.02 - Carolina 2009-02-27 10:49:40.4 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.223.60 [GMT -3:00]

Executando de: c:\documents and settings\Carolina\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090225-1] *On-access scanning disabled* (Updated)

* Criado um novo ponto de restauro

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-01-27 to 2009-02-27 ))))))))))))))))))))))))))))

.

2009-02-19 23:23 . 2009-02-19 23:23 <DIR> d-------- c:\arquivos de programas\a-squared Free

2009-02-19 23:22 . 2009-02-19 23:22 46,388,854 --a------ c:\arquivos de programas\a2FreeSetup.exe

2009-02-19 18:47 . 2009-02-19 18:47 718 --a------ C:\reda‡Æo.LNK

2009-02-19 18:47 . 2009-02-19 18:47 598 --a------ C:\Meus documentos.LNK

2009-02-19 18:44 . 2009-02-19 18:46 358 --a------ C:\capa.LNK

2009-02-19 18:42 . 2009-02-19 18:44 1,348 --a------ C:\parecer_do_professor_pr tica_pedag¢gicas_ii[1].LNK

2009-02-19 18:38 . 2009-02-19 18:38 1,188 --a------ C:\c[1]._fic..[1].LNK

2009-02-19 18:38 . 2009-02-19 18:38 1,043 --a------ C:\H4BWVDHM.LNK

2009-02-19 18:38 . 2009-02-19 18:44 1,043 --a------ C:\EWI9O90W.LNK

2009-02-19 18:36 . 2009-02-19 18:38 1,223 --a------ C:\a[1]._abertura__ok[1].LNK

2009-02-19 18:36 . 2009-02-19 18:36 1,043 --a------ C:\BDFVOLW1.LNK

2009-02-19 13:31 . 2009-02-19 13:31 792 --a------ C:\EUROTOOL.LNK

2009-02-19 13:31 . 2009-02-19 13:31 677 --a------ C:\Bibliote.LNK

2009-02-19 13:31 . 2009-02-19 13:31 382 --a------ C:\view_log.LNK

2009-02-19 13:31 . 2009-02-19 18:46 267 --a------ C:\Desktop.LNK

2009-02-18 23:06 . 2009-02-18 23:06 <DIR> d-------- c:\arquivos de programas\avz4

2009-02-18 23:05 . 2009-02-18 23:05 4,626,422 --a------ c:\arquivos de programas\avz4.zip

2009-02-17 06:41 . 2009-02-17 06:41 <DIR> d--hs---- c:\documents and settings\Usuario\PrivacIE

2009-02-17 06:41 . 2009-02-17 06:41 <DIR> d--hs---- c:\documents and settings\Usuario\IETldCache

2009-02-16 17:50 . 2009-02-16 17:50 <DIR> d-------- c:\documents and settings\Carolina\Dados de aplicativos\DivX

2009-02-16 17:25 . 2009-02-16 17:25 <DIR> d-------- c:\arquivos de programas\Gabest

2009-02-16 17:08 . 2005-08-25 22:10 9,804 --a------ c:\windows\system\vdremote.dll

2009-02-16 17:08 . 2005-08-25 22:09 7,244 --a------ c:\windows\system\vdsvrlnk.dll

2009-02-16 16:54 . 2008-11-06 13:37 129,784 --------- c:\windows\system32\pxafs.dll

2009-02-16 16:53 . 2009-02-16 16:53 <DIR> d-------- c:\arquivos de programas\DivX

2009-02-14 14:31 . 2009-02-14 14:31 <DIR> d-------- c:\arquivos de programas\RelevantKnowledge

2009-02-13 12:49 . 2009-02-13 12:49 <DIR> d--hs---- c:\documents and settings\Carolina\IECompatCache

2009-02-13 12:48 . 2009-02-13 12:48 <DIR> d--hs---- c:\documents and settings\Carolina\PrivacIE

2009-02-13 12:47 . 2009-02-13 12:47 <DIR> d--hs---- c:\documents and settings\Carolina\IETldCache

2009-02-13 11:32 . 2009-02-13 11:32 <DIR> d-------- c:\windows\system32\pt-BR

2009-02-13 11:32 . 2009-02-13 11:32 <DIR> d--h----- c:\windows\ie8

2009-02-13 11:11 . 2009-02-13 11:11 <DIR> d-------- c:\arquivos de programas\BitComet

2009-02-07 13:54 . 2009-02-07 13:54 <DIR> d--hs---- C:\FOUND.034

2009-02-04 18:14 . 2009-02-04 18:14 <DIR> d-------- c:\windows\WinAVI Video Converter 9.0

2009-02-04 18:14 . 2009-02-04 18:14 <DIR> d-------- c:\arquivos de programas\WinAVI Video Converter 9.0

2009-02-04 17:06 . 2009-02-04 17:06 <DIR> d-------- c:\documents and settings\Carolina\Dados de aplicativos\NCH Software

2009-02-04 17:03 . 2009-02-04 17:04 <DIR> d-------- c:\arquivos de programas\NCH Software

2009-02-03 22:00 . 2009-02-03 22:00 <DIR> d-------- c:\documents and settings\Carolina\Dados de aplicativos\Any Video Converter

2009-02-03 22:00 . 2009-02-03 22:00 <DIR> d-------- c:\arquivos de programas\Any Video Converter

2009-01-28 11:28 . 2009-01-28 11:28 <DIR> d--hs---- C:\FOUND.033

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-04 20:52 2,572 ----a-w c:\windows\WINDVDBOOTRECDOE.sys

2009-01-16 01:30 47,360 ----a-w c:\documents and settings\Carolina\Dados de aplicativos\pcouffin.sys

2009-01-16 01:00 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys

2009-01-16 01:00 --------- d-----w c:\documents and settings\Carolina\Dados de aplicativos\Vso

2009-01-16 00:58 --------- d-----w c:\arquivos de programas\VSO

2009-01-15 05:17 636,264 ------w c:\windows\system32\dllcache\iexplore.exe

2009-01-15 05:17 392,040 ------w c:\windows\system32\dllcache\iedkcs32.dll

2009-01-15 05:13 5,888,512 ------w c:\windows\system32\dllcache\mshtml.dll

2009-01-15 05:06 236,544 ------w c:\windows\system32\dllcache\webcheck.dll

2009-01-15 05:06 105,984 ------w c:\windows\system32\dllcache\url.dll

2009-01-15 05:06 1,182,720 ------w c:\windows\system32\dllcache\urlmon.dll

2009-01-15 05:05 911,872 ----a-w c:\windows\system32\wininet.dll

2009-01-15 05:05 911,872 ------w c:\windows\system32\dllcache\wininet.dll

2009-01-15 05:05 43,008 ----a-w c:\windows\system32\licmgr10.dll

2009-01-15 05:05 43,008 ------w c:\windows\system32\dllcache\licmgr10.dll

2009-01-15 05:05 193,536 ------w c:\windows\system32\dllcache\msrating.dll

2009-01-15 05:05 109,056 ------w c:\windows\system32\dllcache\occache.dll

2009-01-15 05:04 755,200 ------w c:\windows\system32\dllcache\VGX.dll

2009-01-15 05:04 25,600 ------w c:\windows\system32\dllcache\jsproxy.dll

2009-01-15 05:04 18,944 ----a-w c:\windows\system32\corpol.dll

2009-01-15 05:04 18,944 ------w c:\windows\system32\dllcache\corpol.dll

2009-01-15 05:02 611,840 ------w c:\windows\system32\dllcache\mstime.dll

2009-01-15 05:01 66,560 ------w c:\windows\system32\dllcache\mshtmled.dll

2009-01-15 05:01 46,592 ------w c:\windows\system32\dllcache\pngfilt.dll

2009-01-15 05:01 348,160 ------w c:\windows\system32\dllcache\dxtmsft.dll

2009-01-15 05:01 34,304 ----a-w c:\windows\system32\imgutil.dll

2009-01-15 05:01 34,304 ------w c:\windows\system32\dllcache\imgutil.dll

2009-01-15 05:01 216,064 ------w c:\windows\system32\dllcache\dxtrans.dll

2009-01-15 05:01 183,808 ------w c:\windows\system32\dllcache\iepeers.dll

2009-01-15 05:00 48,128 ----a-w c:\windows\system32\mshtmler.dll

2009-01-15 05:00 48,128 ------w c:\windows\system32\dllcache\mshtmler.dll

2009-01-15 05:00 45,568 ----a-w c:\windows\system32\mshta.exe

2009-01-15 05:00 45,568 ------w c:\windows\system32\dllcache\mshta.exe

2009-01-15 04:53 68,608 ------w c:\windows\system32\dllcache\hmmapi.dll

2009-01-15 04:50 156,160 ----a-w c:\windows\system32\msls31.dll

2009-01-15 04:50 156,160 ----a-w c:\windows\system32\dllcache\msls31.dll

2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll

2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll

2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll

2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll

2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll

2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll

2008-09-11 13:05 92,064 ----a-w c:\documents and settings\Carolina\mqdmmdm.sys

2008-09-11 13:05 9,232 ----a-w c:\documents and settings\Carolina\mqdmmdfl.sys

2008-09-11 13:05 79,328 ----a-w c:\documents and settings\Carolina\mqdmserd.sys

2008-09-11 13:05 66,656 ----a-w c:\documents and settings\Carolina\mqdmbus.sys

2008-09-11 13:05 6,208 ----a-w c:\documents and settings\Carolina\mqdmcmnt.sys

2008-09-11 13:05 5,936 ----a-w c:\documents and settings\Carolina\mqdmwhnt.sys

2008-09-11 13:05 4,048 ----a-w c:\documents and settings\Carolina\mqdmcr.sys

2008-09-11 13:05 25,600 ----a-w c:\documents and settings\Carolina\usbsermptxp.sys

2008-09-11 13:05 22,768 ----a-w c:\documents and settings\Carolina\usbsermpt.sys

2007-10-20 19:34 24,192 ----a-w c:\documents and settings\Usuario\usbsermptxp.sys

2007-10-20 19:34 22,768 ----a-w c:\documents and settings\Usuario\usbsermpt.sys

2007-03-17 00:57 1,126,017 ----a-w c:\arquivos de programas\wrar361br.exe

.

------- Sigcheck -------

2004-08-04 00:45 14336 5de3e7b6f7624552f2f06664f110820d c:\windows\system32\svchost.exe

2001-10-28 15:07 12800 979f27f95f9a60ad6292b803aee12de5 c:\windows\$NtServicePackUninstall$\svchost.exe

2004-08-04 00:45 14336 5de3e7b6f7624552f2f06664f110820d c:\windows\ServicePackFiles\i386\svchost.exe

2004-08-04 00:45 577536 e0ff28447d1038de106d1f2fdf851647 c:\windows\system32\user32.dll

2002-09-09 17:08 560640 d58adf4a1298bf0068ef0566e2081bbb c:\windows\$NtServicePackUninstall$\user32.dll

2004-08-04 00:45 577536 e0ff28447d1038de106d1f2fdf851647 c:\windows\ServicePackFiles\i386\user32.dll

2004-08-04 00:45 82944 a5163442377d3c305bbff612f80047d7 c:\windows\system32\ws2_32.dll

2001-10-28 15:07 75264 4a95e7320199ec0e3a695494f140c69f c:\windows\$NtServicePackUninstall$\ws2_32.dll

2004-08-04 00:45 82944 a5163442377d3c305bbff612f80047d7 c:\windows\ServicePackFiles\i386\ws2_32.dll

2009-01-15 02:05 911872 203c05a174a45270a30cdd593092d91e c:\windows\system32\wininet.dll

2009-01-15 02:05 911872 203c05a174a45270a30cdd593092d91e c:\windows\system32\dllcache\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 c:\windows\ie8\wininet.dll

2002-09-09 17:08 601088 76622142331e51dd2749efa8e778ac65 c:\windows\$NtServicePackUninstall$\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 c:\windows\ServicePackFiles\i386\wininet.dll

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\system32\drivers\tcpip.sys

2002-08-29 04:58 332928 244a2f9816bc9b593957281ef577d976 c:\windows\$NtServicePackUninstall$\tcpip.sys

2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\ServicePackFiles\i386\tcpip.sys

2004-08-04 00:45 504320 6f7bde7a1126debf0cc359a54953efc1 c:\windows\system32\winlogon.exe

2002-09-09 17:08 518656 3fad976292fb63de9891e31d8fe46ed9 c:\windows\$NtServicePackUninstall$\winlogon.exe

2004-08-04 00:45 504320 6f7bde7a1126debf0cc359a54953efc1 c:\windows\ServicePackFiles\i386\winlogon.exe

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys

2002-08-29 05:09 167552 3b350e5a2a5e951453f3993275a4523a c:\windows\$NtServicePackUninstall$\ndis.sys

2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\ServicePackFiles\i386\ndis.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys

2004-08-03 23:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\ServicePackFiles\i386\ip6fw.sys

2004-08-04 00:40 2061056 c9bae5544b8aa39454c50d8ff83ae5a8 c:\windows\system32\ntkrnlpa.exe

2002-09-09 17:19 1951488 a4906a5ef1dc6fa464dfe46e3a280afd c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe

2004-08-04 00:40 2061056 c9bae5544b8aa39454c50d8ff83ae5a8 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe

2004-08-04 00:40 2185216 3b72a63f230dfb276fc96a99173a81be c:\windows\system32\ntoskrnl.exe

2002-09-09 16:18 2045824 ba32ba40a940d0b8e6017fd6adc99288 c:\windows\$NtServicePackUninstall$\ntoskrnl.exe

2004-08-04 00:40 2185216 3b72a63f230dfb276fc96a99173a81be c:\windows\ServicePackFiles\i386\ntoskrnl.exe

2004-08-04 00:45 1034240 fa61a19050ae14bec1a26de82390dd65 c:\windows\explorer.exe

2002-09-09 17:08 1006080 7de395d7b1f0c5c0ba2635bb01d0f5c8 c:\windows\$NtServicePackUninstall$\explorer.exe

2004-08-04 00:45 1034240 fa61a19050ae14bec1a26de82390dd65 c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-04 00:45 108544 cc73c4430c2fc27fde16a0a4e3678148 c:\windows\system32\services.exe

2001-10-28 15:07 101888 ab1b155a5c021b4344aabe5f001b5260 c:\windows\$NtServicePackUninstall$\services.exe

2004-08-04 00:45 108544 cc73c4430c2fc27fde16a0a4e3678148 c:\windows\ServicePackFiles\i386\services.exe

2004-08-04 00:45 13312 35c6463b3c5f62d2b20c953b6e1538e9 c:\windows\system32\lsass.exe

2002-09-09 17:08 11776 50898a35b0c98440b71c75e61392233b c:\windows\$NtServicePackUninstall$\lsass.exe

2004-08-04 00:45 13312 35c6463b3c5f62d2b20c953b6e1538e9 c:\windows\ServicePackFiles\i386\lsass.exe

2004-08-04 00:45 15360 f40bc97996b8e53799eef1d63996674b c:\windows\system32\ctfmon.exe

2002-09-09 17:08 13312 2296241d47d58254658fac1918cb05d0 c:\windows\$NtServicePackUninstall$\ctfmon.exe

2004-08-04 00:45 15360 f40bc97996b8e53799eef1d63996674b c:\windows\ServicePackFiles\i386\ctfmon.exe

2004-08-04 00:45 57856 3971289fa7072812caf4d053bbc6352b c:\windows\system32\spoolsv.exe

2001-10-28 15:07 51200 9459644e947febefd4ed3041cbd608ba c:\windows\$NtServicePackUninstall$\spoolsv.exe

2004-08-04 00:45 57856 3971289fa7072812caf4d053bbc6352b c:\windows\ServicePackFiles\i386\spoolsv.exe

2007-04-16 22:45 53080 3a83a45e7dd5276315aa20245e7c32bf c:\windows\system32\wuauclt.exe

2007-04-16 22:45 53080 3a83a45e7dd5276315aa20245e7c32bf c:\windows\system32\dllcache\wuauclt.exe

2002-09-09 14:08 141824 740bf9c961fdbf445d31ff8968a001d6 c:\windows\$NtServicePackUninstall$\wuauclt.exe

2004-08-04 00:45 111616 974fa6d27fe3413adbaea63017aef1a4 c:\windows\ServicePackFiles\i386\wuauclt.exe

2004-08-04 00:45 24576 4ca695ec1ee4c7cf2144dfa00ea0e1f7 c:\windows\system32\userinit.exe

2002-09-09 17:08 22016 b04e69fc9544c66709f5bb5754e9c69d c:\windows\$NtServicePackUninstall$\userinit.exe

2004-08-04 00:45 24576 4ca695ec1ee4c7cf2144dfa00ea0e1f7 c:\windows\ServicePackFiles\i386\userinit.exe

2004-08-04 00:45 296960 23dff6daa7565cc5802e057a6b9f585e c:\windows\system32\termsrv.dll

2002-09-09 14:08 201728 f646aeb9ab9650bd45bc1f9bda29bed0 c:\windows\$NtServicePackUninstall$\termsrv.dll

2004-08-04 00:45 296960 23dff6daa7565cc5802e057a6b9f585e c:\windows\ServicePackFiles\i386\termsrv.dll

2004-08-04 00:45 1022464 ad72a244955e89ebbb8fabf02f8041c6 c:\windows\system32\kernel32.dll

2002-09-09 17:07 969216 2bfc8b56d25619a7f8836df2560f55e9 c:\windows\$NtServicePackUninstall$\kernel32.dll

2004-08-04 00:45 1022464 ad72a244955e89ebbb8fabf02f8041c6 c:\windows\ServicePackFiles\i386\kernel32.dll

2004-08-04 00:45 17408 0f81eb414de1d77dd315f4a3d324bc1e c:\windows\system32\powrprof.dll

2001-10-28 15:07 14848 717fc9520d624f9702c37525a748cb3e c:\windows\$NtServicePackUninstall$\powrprof.dll

2004-08-04 00:45 17408 0f81eb414de1d77dd315f4a3d324bc1e c:\windows\ServicePackFiles\i386\powrprof.dll

2004-08-04 00:45 110080 602b88592e0690d0dfb5e5f44a9ef820 c:\windows\system32\imm32.dll

2002-09-09 17:07 103936 8c10cccddaccb6561edf1703e0bc85f6 c:\windows\$NtServicePackUninstall$\imm32.dll

2004-08-04 00:45 110080 602b88592e0690d0dfb5e5f44a9ef820 c:\windows\ServicePackFiles\i386\imm32.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"msnmsgr"="c:\arquivos de programas\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

"Arovax AntiSpyware"="c:\arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe" [2007-07-07 1941504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2008-11-10 136600]

"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Carolina\Menu Iniciar\Programas\Inicializar\

Ferramenta de Verifica‡Æo de M¡dia do Picture Motion Browser.lnk - c:\arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-11-26 376832]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.IV41"= ir41_32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Verificador de Calendário Ulead Photo Express.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Verificador de Calendário Ulead Photo Express.lnk

backup=c:\windows\pss\Verificador de Calendário Ulead Photo Express.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2004-08-04 00:45 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-01-19 12:54 5674352 c:\arquivos de programas\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd]

--a------ 2004-06-10 13:48 286720 c:\windows\vsnpstd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]

-ra------ 2003-10-07 09:15 548864 c:\windows\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

--a------ 2004-02-26 05:53 65024 c:\windows\SOUNDMAN.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\System32\\dpvsetup.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office10\\NSREX.EXE"=

"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"c:\\arquivos de programas\\relevantknowledge\\rlvknlg.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"15689:TCP"= 15689:TCP:BitComet 15689 TCP

"15689:UDP"= 15689:UDP:BitComet 15689 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-03-30 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-03-30 20560]

S3 FXDRV;FXDRV;\??\d:\fxdrv.sys --> d:\Fxdrv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

TCP: {CA134B94-31A8-4ECC-A6D8-82586600BC37} = 200.204.0.138 200.204.0.10

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-27 10:52:31

Windows 5.1.2600 Service Pack 2 FAT NTAPI

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(516)

c:\arquivos de programas\relevantknowledge\rlls.dll

.

Tempo para conclusão: 2009-02-27 10:54:24

ComboFix-quarantined-files.txt 2009-02-27 13:54:20

PrÚ-execuþÒo: 51 pasta(s) 27.493.597.184 bytes dispon¡veis

P¾s execuþÒo: 51 pasta(s) 27,651,702,784 bytes dispon¡veis

256

carolpower · Fevereiro 26, 2009

Logfile of HijackThis v1.99.1

Scan saved at 11:11:34, on 27/2/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18372)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\a-squared Free\a2service.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\LckFldService.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe

C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\internet explorer\iexplore.exe

C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Arovax AntiSpyware] C:\Arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe /s

O4 - Startup: Ferramenta de Verificação de Mídia do Picture Motion Browser.lnk = C:\Arquivos de programas\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International

O12 - Plugin for .pdf: C:\Arquivos de programas\Internet Explorer\PLUGINS\nppdf32.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1234525245812

O17 - HKLM\System\CCS\Services\Tcpip\..\{CA134B94-31A8-4ECC-A6D8-82586600BC37}: NameServer = 200.204.0.138 200.204.0.10

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Arquivos de programas\a-squared Free\a2service.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Arquivos de programas\Java\jre6\bin\jqs.exe" -service -config "C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe

carolpower · Fevereiro 26, 2009

Bom diaa !

agora meu MSN não quer entrar e nem a página do orkut (aliás, desde ontem a noite).

Os "Found" que aparecem no AntiSpyware são:

UNKNOWN - DllName [c:\windows\system32\jedkcs32.dll

UNKNOWN - DisplayName [ @c:\windows\system32\jedkcs32.dll.mui,-3051]

UNKNOWN - DllName [c:\windows\system32\jedkcs32.dll

UNKNOWN - DisplayName [ @c:\windows\system32\jedkcs32.dll.mui,-3014]

UNKNOWN - DisplayName [ @c:\windows\system32\jedkcs32.dll.mui,-3051]

UNKNOWN - DllName [c:\windows\system32\jedkcs32.dll

DigRam · Fevereiro 26, 2009

Boa Tarde! carolpower

<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.

<@> Salve-o,no Desktop,com o nome: CFScript.txt

File::
c:\arquivos de programas\relevantknowledge\rlvknlg.exe

c:\windows\system32\jedkcs32.dll

Folder::

c:\arquivos de programas\relevantknowledge

c:\arquivos de programas\BitComet

C:\FOUND.034

C:\FOUND.033

Registry::

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"15689:TCP"=-

"15689:UDP"=-

Driver::

"FXDRV"

<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.

<@> Veja a demonstração!

<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.

<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

carolpower · Março 2, 2009

Olá !

desculpe a demora..

Meu pc mal tava ligando na sexta, ae ele foi formatado ! :)

mas, ainda encontram outros "found".

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:11:54, on 1/3/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe

C:\Arquivos de programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Ahead\InCD\InCD.exe

C:\WINDOWS\vsnpstd.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\keyhook.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Arquivos de programas\Windows Live\Messenger\wlchtc.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [HP Software Update] "C:\Arquivos de programas\Hewlett-Packard\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Arquivos de programas\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Arquivos de programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [PowerBar] "C:\Arquivos de programas\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime

O4 - HKCU\..\Run: [Arovax AntiSpyware] C:\Arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe /s

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1235853957937

O17 - HKLM\System\CCS\Services\Tcpip\..\{82D2BCF4-DB14-4AB4-8238-33DBF2D5AF68}: NameServer = 200.204.0.10 200.204.0.138

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: hpdj - HP - C:\DOCUME~1\Carol\CONFIG~1\Temp\hpdj.exe

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

--

End of file - 6408 bytes

DigRam · Março 2, 2009

Bom Dia! carolpower

<!> Baixe: ComboFix.exe --> Execute-o! --> Poste o relatório. ( ComboFix.txt )

Abraços!

carolpower · Março 2, 2009

Boa tarde ! :)

ComboFix 09-03-01.01 - Carol 2009-03-02 13:08:11.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.223.64 [GMT -3:00]

Executando de: c:\documents and settings\Carol\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090301-0] *On-access scanning disabled* (Updated)

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\instFunc.dll

c:\windows\system32\pthreadGC2.dll

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-02-02 to 2009-03-02 ))))))))))))))))))))))))))))

.

2009-03-01 21:12 . 2009-03-01 21:13 <DIR> d-------- C:\HijackThis

2009-03-01 21:11 . 2009-03-01 21:11 318,369 --a------ C:\HiJackThis.zip

2009-03-01 19:17 . 2008-05-09 07:55 512,000 -----c--- c:\windows\system32\dllcache\jscript.dll

2009-03-01 19:17 . 2008-05-09 07:55 430,080 -----c--- c:\windows\system32\dllcache\vbscript.dll

2009-03-01 19:17 . 2008-05-09 07:55 180,224 -----c--- c:\windows\system32\dllcache\scrobj.dll

2009-03-01 19:17 . 2008-05-09 07:55 172,032 -----c--- c:\windows\system32\dllcache\scrrun.dll

2009-03-01 19:17 . 2008-05-08 08:24 155,648 -----c--- c:\windows\system32\dllcache\wscript.exe

2009-03-01 19:17 . 2008-05-09 05:45 135,168 -----c--- c:\windows\system32\dllcache\cscript.exe

2009-03-01 19:17 . 2008-05-09 07:55 90,112 -----c--- c:\windows\system32\dllcache\wshext.dll

2009-03-01 19:16 . 2008-12-20 19:46 6,066,688 -----c--- c:\windows\system32\dllcache\ieframe.dll

2009-03-01 19:16 . 2007-04-17 06:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat

2009-03-01 19:16 . 2007-03-08 02:12 1,024,000 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui

2009-03-01 19:16 . 2008-12-20 19:46 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll

2009-03-01 19:16 . 2008-12-20 19:46 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll

2009-03-01 19:16 . 2008-12-20 19:46 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll

2009-03-01 19:16 . 2008-12-20 19:46 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll

2009-03-01 19:16 . 2008-12-20 19:46 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll

2009-03-01 19:16 . 2008-12-19 06:10 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe

2009-03-01 18:29 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll

2009-03-01 18:29 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll

2009-03-01 18:29 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui

2009-03-01 04:21 . 2009-03-02 06:52 <DIR> d-------- c:\documents and settings\Camila\Tracing

2009-03-01 04:12 . 2009-03-01 04:12 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Arovax

2009-03-01 04:12 . 2009-03-02 13:18 <DIR> d-------- c:\arquivos de programas\Arovax AntiSpyware

2009-03-01 04:11 . 2009-03-01 04:11 <DIR> d-------- c:\arquivos de programas\CCleaner

2009-03-01 04:07 . 2009-03-01 04:07 <DIR> d-------- c:\windows\WinAVI Video Converter 9.0

2009-03-01 04:07 . 2009-03-01 04:07 <DIR> d-------- c:\arquivos de programas\WinAVI Video Converter 9.0

2009-03-01 04:06 . 2009-03-01 04:07 <DIR> d-------- c:\arquivos de programas\K-Lite Codec Pack

2009-03-01 03:56 . 2009-03-01 03:56 <DIR> d-------- c:\arquivos de programas\PhotoFiltre

2009-03-01 03:01 . 2009-03-02 11:49 <DIR> d-------- c:\documents and settings\Carol\Tracing

2009-03-01 03:00 . 2009-03-01 03:00 <DIR> d-------- c:\arquivos de programas\Microsoft

2009-03-01 02:59 . 2009-03-01 02:59 <DIR> d-------- c:\arquivos de programas\Windows Live SkyDrive

2009-03-01 02:31 . 2009-03-01 02:31 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-03-01 02:09 . 2009-03-01 02:09 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-02-28 20:27 . 2009-03-01 02:10 <DIR> d-------- c:\documents and settings\Carol\Contacts

2009-02-28 20:25 . 2009-02-28 20:26 <DIR> d-------- c:\arquivos de programas\Messenger Plus! Live

2009-02-28 20:20 . 2009-02-28 20:20 <DIR> d----c--- c:\windows\system32\DRVSTORE

2009-02-28 20:18 . 2009-02-28 20:18 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\WLInstaller

2009-02-28 20:18 . 2009-03-01 02:51 <DIR> d-------- c:\arquivos de programas\Windows Live

2009-02-28 20:18 . 2009-02-28 20:19 <DIR> d--hsc--- c:\arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2009-02-28 19:55 . 2009-02-28 19:55 <DIR> d-------- c:\windows\system32\bits

2009-02-28 19:55 . 2009-02-28 19:55 <DIR> d-------- c:\windows\l2schemas

2009-02-28 19:50 . 2009-02-28 19:56 <DIR> d-------- c:\windows\ServicePackFiles

2009-02-28 18:47 . 2009-03-01 23:43 <DIR> d-------- c:\windows\system32\pt-br

2009-02-28 18:38 . 2009-02-28 18:38 <DIR> d-------- c:\arquivos de programas\MSXML 4.0

2009-02-28 18:27 . 2004-08-04 00:36 701,440 --------- c:\windows\system32\drivers\ati2mtag.sys

2009-02-28 18:12 . 2008-06-14 14:34 272,384 --------- c:\windows\system32\drivers\bthport.sys

2009-02-28 18:12 . 2008-06-14 14:34 272,384 -----c--- c:\windows\system32\dllcache\bthport.sys

2009-02-28 18:08 . 2008-09-15 12:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys

2009-02-28 18:07 . 2008-08-14 10:24 2,193,408 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

2009-02-28 18:07 . 2008-08-14 10:24 2,149,376 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-02-28 18:07 . 2008-08-14 10:24 2,070,272 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-02-28 18:07 . 2008-08-14 10:24 2,028,032 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

2009-02-28 18:07 . 2008-10-24 08:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

2009-02-28 18:07 . 2008-12-11 07:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys

2009-02-28 18:07 . 2008-05-08 11:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys

2009-02-28 18:06 . 2008-04-11 16:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll

2009-02-28 17:56 . 2008-10-15 13:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

2009-02-28 17:55 . 2009-03-01 23:52 <DIR> d--h----- c:\windows\$hf_mig$

2009-02-28 17:55 . 2007-08-10 08:12 26,488 --a------ c:\windows\system32\spupdsvc.exe

2009-02-28 17:47 . 2009-02-28 17:47 <DIR> d-------- c:\arquivos de programas\Alwil Software

2009-02-28 17:45 . 2009-02-28 17:45 <DIR> d--hs---- c:\documents and settings\Carol\UserData

2009-02-28 17:27 . 2009-02-28 17:32 69 --a------ c:\windows\NeroDigital.ini

2009-02-28 17:25 . 2009-02-28 16:15 <DIR> d--h----- c:\documents and settings\Camila\Modelos

2009-02-28 17:25 . 2009-03-02 09:32 <DIR> dr------- c:\documents and settings\Camila\Meus documentos

2009-02-28 17:25 . 2009-02-28 13:07 <DIR> dr------- c:\documents and settings\Camila\Menu Iniciar

2009-02-28 17:25 . 2009-03-01 04:15 <DIR> dr------- c:\documents and settings\Camila\Favoritos

2009-02-28 17:25 . 2009-03-01 18:34 <DIR> dr-h----- c:\documents and settings\Camila\Dados de aplicativos

2009-02-28 17:25 . 2009-03-02 13:09 <DIR> d--h----- c:\documents and settings\Camila\Configurações locais

2009-02-28 17:25 . 2009-02-28 13:07 <DIR> d--h----- c:\documents and settings\Camila\Ambiente de rede

2009-02-28 17:25 . 2009-02-28 13:07 <DIR> d--h----- c:\documents and settings\Camila\Ambiente de impressão

2009-02-28 17:25 . 2009-03-01 04:21 <DIR> d-------- c:\documents and settings\Camila

2009-02-28 17:24 . 2009-02-28 17:38 <DIR> d-------- c:\documents and settings\Carol\WINDOWS

2009-02-28 17:24 . 2002-07-12 07:15 106,496 --a------ c:\windows\SiSUSBrg.exe

2009-02-28 17:24 . 2003-07-17 22:58 36,992 -ra------ c:\windows\system32\drivers\SISAGPX.SYS

2009-02-28 17:24 . 2002-01-02 04:40 32,768 --a------ c:\windows\SIS_LIB.DLL

2009-02-28 17:24 . 2001-12-06 23:11 3,583 --a------ c:\windows\SiSport.sys

2009-02-28 17:23 . 2009-02-28 17:24 <DIR> d-------- c:\arquivos de programas\SiS VGA Utilities V3.59

2009-02-28 17:22 . 2009-02-28 17:23 <DIR> d-------- c:\windows\system32\trayres

2009-02-28 17:22 . 2009-02-28 17:24 103,037 --a------ c:\windows\system32\VGAunistlog.ini

2009-02-28 17:21 . 2009-02-28 17:21 <DIR> d-------- c:\arquivos de programas\Realtek Sound Manager

2009-02-28 17:21 . 2009-02-28 17:21 <DIR> d-------- c:\arquivos de programas\AvRack

2009-02-28 17:11 . 2009-02-28 17:11 230,424 --a------ C:\img1-001.raw

2009-02-28 17:11 . 2008-04-13 15:46 15,232 --a------ c:\windows\system32\drivers\streamip.sys

2009-02-28 17:11 . 2008-04-13 15:46 10,880 --a------ c:\windows\system32\drivers\ndisip.sys

2009-02-28 17:11 . 2008-04-13 15:39 5,504 --a------ c:\windows\system32\drivers\mstee.sys

2009-02-28 17:11 . 2009-02-28 17:11 664 --a------ c:\windows\system32\d3d9caps.dat

2009-02-28 17:06 . 2009-02-28 17:06 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\snpstd

2009-02-28 17:06 . 2004-11-19 18:46 367,488 --a------ c:\windows\system32\drivers\snpstd.sys

2009-02-28 17:06 . 2004-06-10 13:48 286,720 --a------ c:\windows\vsnpstd.exe

2009-02-28 17:06 . 2003-04-15 18:20 219,136 --a------ c:\windows\system32\unicows.dll

2009-02-28 17:06 . 2004-10-27 16:22 61,440 --a------ c:\windows\system32\rsnpstd.dll

2009-02-28 17:06 . 2004-02-16 13:59 61,440 --a------ c:\windows\system32\csnpstd.dll

2009-02-28 17:06 . 2004-05-06 11:22 53,248 --a------ c:\windows\system32\dsnpstd.dll

2009-02-28 17:06 . 2002-07-03 11:44 53,248 --a------ c:\windows\amcap.exe

2009-02-28 17:06 . 2004-09-24 10:58 36,864 --a------ c:\windows\system32\vsnpstd.dll

2009-02-28 17:06 . 2004-09-24 10:42 36,864 --a------ c:\windows\system32\dsnpstd.ax

2009-02-28 17:06 . 2004-11-01 17:29 20,480 --a------ c:\windows\usnpstd.exe

2009-02-28 17:06 . 2003-01-17 17:34 15,541 --a------ c:\windows\snpstd.ini

2009-02-28 17:06 . 2003-01-17 17:35 13,023 --a------ c:\windows\snpstd.src

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-02 02:47 --------- d-----w c:\arquivos de programas\Microsoft Works

2009-02-28 20:23 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2009-02-28 20:04 --------- d-----w c:\arquivos de programas\Arquivos comuns\InstallShield

2009-02-28 19:58 --------- d-----w c:\arquivos de programas\Arquivos comuns\Ahead

2009-02-28 19:58 --------- d-----w c:\arquivos de programas\Ahead

2009-02-28 19:56 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\CyberLink

2009-02-28 19:56 --------- d-----w c:\arquivos de programas\CyberLink DVD Solution

2009-02-28 19:56 --------- d-----w c:\arquivos de programas\CyberLink

2009-02-28 19:53 --------- d-----w c:\documents and settings\Carol\Dados de aplicativos\AdobeUM

2009-02-28 19:53 --------- d-----w c:\arquivos de programas\Arquivos comuns\Adobe

2009-02-28 19:50 --------- d-----w c:\arquivos de programas\HP

2009-02-28 19:50 --------- d-----w c:\arquivos de programas\Hewlett-Packard

2009-02-28 19:37 --------- d-----w c:\arquivos de programas\Microsoft.NET

2009-02-28 19:21 --------- d-----w c:\arquivos de programas\microsoft frontpage

2009-02-28 19:18 --------- d-----w c:\arquivos de programas\Serviços on-line

2009-02-28 19:17 --------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll

2009-02-06 21:52 49,504 ----a-w c:\windows\system32\sirenacm.dll

2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll

2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll

2008-12-07 18:08 795,648 ----a-w c:\windows\system32\xvidcore.dll

2008-12-07 18:08 130,048 ----a-w c:\windows\system32\xvidvfw.dll

2004-03-11 16:27 40,960 ----a-w c:\arquivos de programas\Uninstall_CDS.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"MsnMsgr"="c:\arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]

"PowerBar"="c:\arquivos de programas\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" [2004-04-21 86016]

"Arovax AntiSpyware"="c:\arquivos de programas\Arovax AntiSpyware\arovaxantispyware.exe" [2007-09-21 1966080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Software Update"="c:\arquivos de programas\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]

"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-09-01 176128]

"HP Component Manager"="c:\arquivos de programas\HP\hpcoretech\hpcmpmgr.exe" [2003-04-11 212992]

"DeviceDiscovery"="c:\arquivos de programas\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]

"RemoteControl"="c:\arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768]

"InCD"="c:\arquivos de programas\Ahead\InCD\InCD.exe" [2004-09-07 1400944]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]

"SiS Windows KeyHook"="c:\windows\system32\keyhook.exe" [2004-05-12 249856]

"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]

"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

R3 FXDRV;FXDRV; [x]

S1 aswSP;avast! Self Protection; [x]

S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]

--- ---

*Deregistered* - Aavmker4

*Deregistered* - AFD

*Deregistered* - ALG

*Deregistered* - aswFsBlk

*Deregistered* - aswMon2

*Deregistered* - aswRdr

*Deregistered* - aswSP

*Deregistered* - aswTdi

*Deregistered* - aswUpdSv

*Deregistered* - AudioSrv

*Deregistered* - audstub

*Deregistered* - avast! Antivirus

*Deregistered* - avast! Mail Scanner

*Deregistered* - avast! Web Scanner

*Deregistered* - Beep

*Deregistered* - Browser

*Deregistered* - Cdfs

*Deregistered* - CryptSvc

*Deregistered* - DcomLaunch

*Deregistered* - Dhcp

*Deregistered* - dmio

*Deregistered* - dmload

*Deregistered* - dmserver

*Deregistered* - Dnscache

*Deregistered* - ERSvc

*Deregistered* - EventSystem

*Deregistered* - FastUserSwitchingCompatibility

*Deregistered* - Fips

*Deregistered* - FltMgr

*Deregistered* - Ftdisk

*Deregistered* - Gpc

*Deregistered* - helpsvc

*Deregistered* - HTTP

*Deregistered* - ImapiService

*Deregistered* - InCDfs

*Deregistered* - InCDsrv

*Deregistered* - IpNat

*Deregistered* - IPSec

*Deregistered* - KSecDD

*Deregistered* - lanmanserver

*Deregistered* - lanmanworkstation

*Deregistered* - LmHosts

*Deregistered* - MDM

*Deregistered* - mnmdd

*Deregistered* - MountMgr

*Deregistered* - MRxDAV

*Deregistered* - MRxSmb

*Deregistered* - Msfs

*Deregistered* - mssmbios

*Deregistered* - Mup

*Deregistered* - NDIS

*Deregistered* - NdisTapi

*Deregistered* - Ndisuio

*Deregistered* - NdisWan

*Deregistered* - NDProxy

*Deregistered* - NetBIOS

*Deregistered* - NetBT

*Deregistered* - Netman

*Deregistered* - Nla

*Deregistered* - Npfs

*Deregistered* - Ntfs

*Deregistered* - Null

*Deregistered* - PartMgr

*Deregistered* - ParVdm

*Deregistered* - PolicyAgent

*Deregistered* - PptpMiniport

*Deregistered* - ProtectedStorage

*Deregistered* - PSched

*Deregistered* - RasAcd

*Deregistered* - Rasl2tp

*Deregistered* - RasMan

*Deregistered* - RasPppoe

*Deregistered* - Raspti

*Deregistered* - Rdbss

*Deregistered* - RDPCDD

*Deregistered* - rdpdr

*Deregistered* - RemoteRegistry

*Deregistered* - RpcSs

*Deregistered* - SamSs

*Deregistered* - Schedule

*Deregistered* - seclogon

*Deregistered* - SENS

*Deregistered* - SharedAccess

*Deregistered* - ShellHWDetection

*Deregistered* - Spooler

*Deregistered* - sr

*Deregistered* - srservice

*Deregistered* - Srv

*Deregistered* - SSDPSRV

*Deregistered* - stisvc

*Deregistered* - swenum

*Deregistered* - TapiSrv

*Deregistered* - Tcpip

*Deregistered* - TermDD

*Deregistered* - TermService

*Deregistered* - Themes

*Deregistered* - TrkWks

*Deregistered* - uagp35

*Deregistered* - Update

*Deregistered* - VgaSave

*Deregistered* - VolSnap

*Deregistered* - W32Time

*Deregistered* - Wanarp

*Deregistered* - WebClient

*Deregistered* - winmgmt

*Deregistered* - wscsvc

*Deregistered* - wuauserv

*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{879bd950-05d8-11de-a789-00016c3bb9b7}]

\Shell\AutoRun\command - wscript.exe .vbs

\Shell\open\command - wscript.exe .vbs

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.uol.com.br/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-02 13:14:16

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

------------------------ Outros Processos em Execução ------------------------

.

c:\arquivos de programas\Ahead\InCD\InCDsrv.exe

c:\arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

c:\arquivos de programas\Alwil Software\Avast4\ashServ.exe

c:\windows\system32\WgaTray.exe

c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

c:\arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-03-02 13:32:48 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-03-02 16:32:31

Pré-execução: 12 pasta(s) 30.662.643.712 bytes disponíveis

Pós execução: 12 pasta(s) 30,894,264,320 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

329 --- E O F --- 2009-03-02 02:52:31

DigRam · Março 2, 2009

Boa Tarde! carolpower

Insira sua(s) unidade(s) removíveis,caso às possua,na entrada USB. ( pendrive,mp3,mp4,iPods,etc... )

<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.

<@> Salve-o,no Desktop,com o nome: CFScript.txt

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{879bd950-05d8-11de-a789-00016c3bb9b7}]

Reglock::

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]

Driver::

"FXDRV"

<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.

<@> Veja a demonstração!

<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.

<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

carolpower · Março 4, 2009

Oiii !!

ComboFix 09-03-03.01 - Carol 2009-03-04 17:20:29.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.223.67 [GMT -3:00]

Executando de: c:\documents and settings\Carol\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Carol\Desktop\CFScript.txt

AV: avast! antivirus 4.8.1335 [VPS 090303-2] *On-access scanning disabled* (Updated)

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

E:\autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_FXDRV

-------\Service_FXDRV

(((((((((((((((( Arquivos/Ficheiros criados de 2009-02-04 to 2009-03-04 ))))))))))))))))))))))))))))