[Arquivado] Socket error # 11004

Raytek · Abril 9, 2009

PLIX ME AJUDEM, TD HORA DA ESSE ERROR NO PC..

JA PROCUREI NO GOOGLE E TALX, UNICA COISA Q ACHEI E Q TM Q FAZE UM TAL DE LOG PELO PROGRAMA HIJACKTHIS,,,OLHA O MEU AE \/.. UQ DEVO FAZE AGORA??

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:24:56, on 9/4/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\VM_STI.EXE

C:\Windows\System\ctfmon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\WINDOWS\system32\algsrv.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\MSN Messenger\livecall.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Arquivos de programas\styler\TB\StylerTB.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

O4 - HKLM\..\Run: [inCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe "

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE A4 Tech USB PC Camera

O4 - HKLM\..\Run: [ASocksrv] SocksA.exe

O4 - HKLM\..\Run: [ctfmon] C:\Windows\System\ctfmon.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [bSserver] FileKan.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: VisualTaskTips.lnk = C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Arquivos de programas\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Arquivos de programas\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{575D515D-2125-4FFC-AC9D-1E4EE49EA8FF}: NameServer = 201.10.128.3,201.10.120.3

O17 - HKLM\System\CS1\Services\Tcpip\..\{575D515D-2125-4FFC-AC9D-1E4EE49EA8FF}: NameServer = 201.10.128.3,201.10.120.3

O17 - HKLM\System\CS2\Services\Tcpip\..\{575D515D-2125-4FFC-AC9D-1E4EE49EA8FF}: NameServer = 201.10.128.3,201.10.120.3

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 6942 bytes

DigRam · Abril 9, 2009

Bom Dia! Raytek

<@> Baixe: < > ( ...by sUBs )

<@> Salve-o no desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança. <-- Link!

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!

<!> Ps: Para evitar problemas,siga todas as recomendações propostas.

<!> Ps: O ComboFix é uma ferramenta que pode danificar o sistema. Utilize-o,somente,sob supervisão profissional.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

<><><><><><><><><><><><>

<@> Terminando,poste os relatórios: C:\ComboFix\ComboFix.txt + HijackThis,atualizado.

Abraços!

Raytek · Abril 9, 2009

Log Do ComboFix:

ComboFix 09-04-04.01 - Charles 2009-04-09 13:18:25.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1023.692 [GMT -3:00]

Executando de: c:\documents and settings\Charles\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

C:\tel.xls.exe

c:\windows\system\ctfmon.exe

c:\windows\system32\algsrv.exe

c:\windows\system32\filekan.exe

c:\windows\system32\socksa.exe

c:\windows\system32\vcmgcd32.dl_

c:\windows\system32\vcmgcd32.dll

c:\windows\ufdata2000.log

E:\Autorun.inf

E:\tel.xls.exe

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-03-09 to 2009-04-09 ))))))))))))))))))))))))))))

.

2009-04-08 23:16 . 2009-04-08 23:16 <DIR> d-------- c:\documents and settings\Charles\Dados de aplicativos\SUPERAntiSpyware.com

2009-04-08 23:16 . 2009-04-08 23:16 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com

2009-04-08 23:16 . 2009-04-08 23:16 <DIR> d-------- c:\arquivos de programas\SUPERAntiSpyware

2009-04-08 23:16 . 2009-04-08 23:16 <DIR> d-------- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard

2009-04-08 23:03 . 2009-04-08 23:03 4,507 --a------ c:\windows\imsins.BAK

2009-04-08 22:34 . 2009-04-09 02:24 <DIR> d-------- C:\HiJackThis

2009-04-08 15:22 . 2009-04-08 18:52 <DIR> d-------- c:\arquivos de programas\CCleaner

2009-04-03 21:21 . 2009-04-08 21:45 <DIR> d-------- C:\Tibia

2009-04-03 14:55 . 2009-04-09 02:19 <DIR> d-a------ c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-04-03 14:55 . 2009-04-09 01:34 <DIR> d-------- c:\arquivos de programas\TibiaBot NG

2009-03-27 17:16 . 2009-03-27 17:16 <DIR> d-------- c:\windows\system32\LogFiles

2009-03-20 17:24 . 2009-03-20 17:24 <DIR> d-------- c:\documents and settings\Charles\Dados de aplicativos\Toribash

2009-03-19 15:53 . 2009-03-19 15:53 <DIR> d-------- c:\documents and settings\Charles\Dados de aplicativos\Ahead

2009-03-18 21:31 . 2009-03-18 21:31 <DIR> d-------- c:\arquivos de programas\TVUPlayer

2009-03-18 21:31 . 2009-03-18 21:31 <DIR> d-------- c:\arquivos de programas\SopCast

2009-03-11 20:26 . 2009-04-08 15:10 95 --a------ c:\windows\system32\tcfg.ini

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-08 18:25 --------- d-----w c:\arquivos de programas\Norton Security Scan

2009-04-04 20:39 --------- d-----w c:\arquivos de programas\Tibia

2009-03-08 16:10 --------- d-----w c:\arquivos de programas\No-IP

2009-02-26 05:58 --------- d-----w c:\arquivos de programas\TibiaCam TV Lite

2009-02-22 20:09 --------- d-----w c:\arquivos de programas\Arquivos comuns\Symantec Shared

2009-02-21 07:44 --------- d-----w c:\arquivos de programas\KAIZEN Games

2009-02-18 23:21 93,696 ----a-w c:\windows\ST6UNST.EXE

2009-02-18 23:21 113,664 ------w c:\windows\Setup1.exe

2009-02-18 17:53 --------- d-----w c:\documents and settings\Charles\Dados de aplicativos\Remere's Map Editor

2009-02-18 14:33 --------- d-----w c:\arquivos de programas\Asprate

2009-02-18 12:08 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2009-02-18 12:08 --------- d-----w c:\arquivos de programas\Vimicro

2009-02-17 17:37 --------- d-----w c:\arquivos de programas\CyberLink

2009-02-17 17:34 --------- d-----w c:\arquivos de programas\Arquivos comuns\InstallShield

2009-02-17 17:24 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Ahead

2009-02-17 17:24 --------- d-----w c:\arquivos de programas\Arquivos comuns\Ahead

2009-02-17 17:21 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Nero

2009-02-17 17:21 --------- d-----w c:\arquivos de programas\Nero

2009-02-17 17:18 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys

2009-02-17 17:16 --------- d-----w c:\documents and settings\Charles\Dados de aplicativos\Corel

2009-02-17 17:15 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\InstallShield

2009-02-17 17:14 --------- d-----w c:\arquivos de programas\Corel

2009-02-17 17:14 --------- d-----w c:\arquivos de programas\Arquivos comuns\Corel

2009-02-17 17:09 --------- d-----w c:\arquivos de programas\Positivo

2009-02-17 17:09 --------- d-----w c:\arquivos de programas\Microsoft Encarta

2009-02-17 16:13 219,648 ----a-w c:\windows\system32\uxtheme.dll

2009-02-17 16:13 --------- d-----w c:\arquivos de programas\VisualTaskTips

2009-02-17 16:13 --------- d-----w c:\arquivos de programas\styler

2009-02-17 14:10 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help

2009-02-17 14:08 --------- d-----w c:\arquivos de programas\MSBuild

2009-02-17 14:08 --------- d-----w c:\arquivos de programas\Microsoft Works

2009-02-17 14:02 --------- d-----w c:\arquivos de programas\LHSP

2009-02-17 14:01 --------- d-----w c:\arquivos de programas\MSN Messenger

2009-02-17 13:58 --------- d-----w c:\arquivos de programas\AVG

2009-02-17 13:56 --------- d-----w c:\arquivos de programas\Arquivos comuns\Adobe

2009-02-17 13:29 --------- d-----w c:\arquivos de programas\Analog Devices

2009-02-17 13:03 --------- d-----w c:\arquivos de programas\microsoft frontpage

2009-02-17 13:01 --------- d-----w c:\arquivos de programas\Serviços on-line

2009-02-17 13:00 --------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

.

------- Sigcheck -------

2004-08-04 00:45 803328 048367ef3e654f8fb83e4dbb1e26b81d c:\windows\system32\wininet.dll

2004-08-04 00:45 803328 048367ef3e654f8fb83e4dbb1e26b81d c:\windows\system32\dllcache\wininet.dll

2004-08-04 00:45 658432 398a619ce60090303042d1f8cc68f712 c:\windows\VistaMizer\old\wininet.dll

2004-08-04 00:45 543744 3550bfe59972a67ac2f7781041d28ea7 c:\windows\system32\winlogon.exe

2004-08-04 00:45 543744 3550bfe59972a67ac2f7781041d28ea7 c:\windows\system32\dllcache\winlogon.exe

2004-08-04 00:45 504320 38a59b1ae10fc82493fa50b526a9b148 c:\windows\VistaMizer\old\winlogon.exe

2004-08-04 00:55 2223616 4adb97fe3598ab0f18671f12e3fc53b3 c:\windows\system32\ntkrnlpa.exe

2004-08-04 00:55 2081536 25493c5420ad0c078b33664808e454dc c:\windows\VistaMizer\old\ntkrnlpa.exe

2004-08-04 00:40 2347776 0d53687c4975263f103d58367714a8eb c:\windows\system32\ntoskrnl.exe

2004-08-04 00:40 2205696 4e121fc717dffe253369bec22228f565 c:\windows\VistaMizer\old\ntoskrnl.exe

2004-08-04 00:45 1552896 9da14fe20c421e7f45dbe3d04b4c4fc9 c:\windows\explorer.exe

2004-08-04 00:45 1552896 9da14fe20c421e7f45dbe3d04b4c4fc9 c:\windows\system32\dllcache\explorer.exe

2004-08-04 00:45 1054720 f933ac93d7f2c10363c111ff8bff3359 c:\windows\VistaMizer\old\explorer.exe

2004-08-04 00:45 25088 a3f0971dbba9657034c303b39464ea5b c:\windows\system32\ctfmon.exe

2004-08-04 00:45 25088 a3f0971dbba9657034c303b39464ea5b c:\windows\system32\dllcache\ctfmon.exe

2004-08-04 00:45 35840 526f5e303d249b4eb2f22ab6318ea290 c:\windows\VistaMizer\old\ctfmon.exe

2004-08-04 00:45 111616 b57815961da2ed53183fbce17ae159b1 c:\windows\system32\wuauclt.exe

2004-08-04 00:45 111616 b57815961da2ed53183fbce17ae159b1 c:\windows\system32\dllcache\wuauclt.exe

2004-08-04 00:45 132096 d270b7035a91092ff7920adb7983e6c4 c:\windows\VistaMizer\old\wuauclt.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 25088]

"MsnMsgr"="c:\arquivos de programas\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"MSMSGS"="c:\arquivos de programas\Messenger\msmsgs.exe" [2004-08-04 1799168]

"SUPERAntiSpyware"="c:\arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 1368064]

"GrooveMonitor"="c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"ISUSPM Startup"="c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\isuspm.exe" [2005-08-11 270336]

"ISUSScheduler"="c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"SecurDisc"="c:\arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe" [2007-11-26 1629480]

"InCD"="c:\arquivos de programas\Nero\Nero 7\InCD\InCD.exe" [2007-11-26 1057064]

"RemoteControl"="c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]

"LanguageShortcut"="c:\arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 69632]

"BigDogPath"="c:\windows\VM_STI.EXE" [2004-02-24 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 25088]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - c:\arquivos de programas\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

Adobe Reader Synchronizer.lnk - c:\arquivos de programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

VisualTaskTips.lnk - c:\arquivos de programas\VisualTaskTips\VisualTaskTips.exe [2006-07-31 36864]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\arquivos de programas\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 12:05 356352 c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\CyberLink\\PowerDVD\\PowerDVD.exe"=

R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]

R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]

R3 ip100xp;ENCORE 10/100Mbps Fast Ethernet PCI Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [2005-04-15 26752]

R3 SASENUM;SASENUM;c:\arquivos de programas\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]

S3 XDva235;XDva235;\??\c:\windows\system32\XDva235.sys --> c:\windows\system32\XDva235.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0b6b578-fcf4-11dd-a80d-addf7845c851}]

\Shell\Auto\command - auto.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

\Shell\explore\Command - iqe68o.bat

\Shell\open\Command - iqe68o.bat

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-04-08 c:\windows\Tasks\Norton Security Scan for Charles.job

- c:\arquivos de programas\Norton Security Scan\Nss.exe [2009-03-11 20:20]

.

- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-ctfmon - c:\windows\System\ctfmon.exe

.

------- Scan Suplementar -------

.

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {575D515D-2125-4FFC-AC9D-1E4EE49EA8FF} = 201.10.128.3,201.10.120.3

Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\arquivos de programas\Arquivos comuns\Microsoft Shared\Information Retrieval\itss51.dll

FF - ProfilePath -

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-09 13:21:45

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(556)

c:\windows\system32\sfc_os.dll

c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\cscui.dll

c:\windows\system32\COMRes.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

c:\arquivos de programas\CyberLink\Shared Files\RichVideo.exe

c:\arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\wbem\wmiadap.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-04-09 13:23:36 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-04-09 16:23:33

Pré-execução: 15 pasta(s) 66.565.074.944 bytes disponíveis

Pós execução: 14 pasta(s) 66,611,961,856 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

209

-----------------------------------------------------------------------------------------------------------------------------------------

Log do Hijackthis Atualizado:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:28:45, on 9/4/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\VM_STI.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\VisualTaskTips\VisualTaskTips.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896