[Resolvido!] Análise de Log - ComboFix

D-Patrick · Junho 9, 2009

Pessoal da uma olhada aí fazendo favor:

ComboFix 09-06-08.05 - Dener 09/06/2009 11:13.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.2029.1548 [GMT -3:00]

Running from: c:\documents and settings\Dener\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090608-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\._xat-image-optimizer-5-10i.exe

c:\documents and settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://www.hhdsoftware.com

.

((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))

.

2009-06-08 22:07 . 2009-06-08 22:07 3371383 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-06-08 22:01 . 2008-12-11 11:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2009-06-08 22:01 . 2009-04-03 14:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-06-08 22:01 . 2008-12-18 15:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2009-06-08 22:01 . 2009-06-08 22:01 -------- d-----w- c:\arquivos de programas\Arquivos comuns\PC Tools

2009-06-08 22:01 . 2008-12-10 14:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2009-06-08 22:01 . 2009-06-08 22:01 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\PC Tools

2009-06-08 22:01 . 2009-06-08 22:01 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools

2009-06-08 22:01 . 2009-06-08 22:01 -------- d-----w- c:\arquivos de programas\Spyware Doctor

2009-06-08 20:42 . 2009-06-08 20:42 -------- d-----w- C:\Fraps

2009-06-08 20:30 . 2007-12-25 12:42 2372574 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\{3A7FD077-F0B4-4276-BE42-175DEF23CA39}\BB FlashBack.exe

2009-06-08 20:30 . 2009-06-08 20:30 -------- d-----w- c:\arquivos de programas\Blueberry Software

2009-06-08 20:30 . 2009-06-08 20:30 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Blueberry Software

2009-06-08 20:30 . 2009-06-08 20:30 -------- d--h--w- c:\documents and settings\All Users\Dados de aplicativos\{3A7FD077-F0B4-4276-BE42-175DEF23CA39}

2009-06-08 19:13 . 2009-06-08 19:13 -------- d-----w- c:\arquivos de programas\Metin2_UK

2009-06-08 17:08 . 2009-06-08 17:08 -------- d-----w- c:\arquivos de programas\HHD Software

2009-06-08 02:56 . 2009-06-08 02:56 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\Datarescue

2009-06-08 02:54 . 2009-06-08 02:54 -------- d-----w- c:\arquivos de programas\GB Research

2009-06-04 13:19 . 2009-06-04 13:19 -------- d-sh--w- C:\FOUND.004

2009-05-24 00:44 . 2009-05-24 00:44 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-05-24 00:44 . 2009-05-24 00:44 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\skypePM

2009-05-24 00:41 . 2009-05-24 00:41 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\Skype

2009-05-24 00:41 . 2009-05-24 00:41 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Skype

2009-05-24 00:41 . 2009-05-24 00:41 -------- d-----r- c:\arquivos de programas\Skype

2009-05-24 00:41 . 2009-05-24 00:41 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Skype

2009-05-23 01:00 . 2009-05-23 01:00 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\Audacity

2009-05-23 00:59 . 2009-05-23 00:59 -------- d-----w- c:\arquivos de programas\Audacity 1.3 Beta (Unicode)

2009-05-12 00:18 . 2009-05-12 00:18 -------- d-----w- C:\DVD_01_1

2009-05-12 00:16 . 2009-05-12 00:16 -------- d-----w- c:\windows\WinAVI Video Converter 9.0

2009-05-12 00:16 . 2009-05-12 00:16 -------- d-----w- c:\arquivos de programas\WinAVI Video Converter 9.0

2009-05-11 23:58 . 2009-05-11 23:58 -------- d-----w- C:\digitalvideoconverter

2009-05-11 23:22 . 2009-05-11 23:22 -------- d-----w- c:\windows\Nero Micro 9.2.6

2009-05-11 23:18 . 2008-05-29 06:03 37176 ----a-w- c:\documents and settings\Dener\Dados de aplicativos\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-09 02:26 . 2008-08-11 02:14 836 ----a-w- c:\windows\bthservsdp.dat

2009-06-08 20:30 . 2008-11-25 12:39 4608 ----a-w- c:\windows\system32\bbchlp.dll

2009-06-08 20:30 . 2008-11-25 12:39 2944 ----a-w- c:\windows\system32\drivers\bbcap.sys

2009-06-08 20:30 . 2008-11-25 12:39 27776 ----a-w- c:\windows\system32\bbcap.dll

2009-05-26 16:20 . 2009-04-24 20:56 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-26 16:19 . 2009-04-24 20:56 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-05-18 20:18 . 2009-03-02 23:27 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys

2009-05-13 13:12 . 2001-10-28 20:07 48512 ----a-w- c:\windows\system32\perfc016.dat

2009-05-13 13:12 . 2001-10-28 20:07 344036 ----a-w- c:\windows\system32\perfh016.dat

2009-05-07 13:29 . 2009-05-07 13:29 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-05-06 18:29 . 2009-05-06 18:29 -------- d-----w- c:\arquivos de programas\Messenger Plus! Live

2009-04-30 17:06 . 2009-04-30 17:06 -------- d-----w- c:\arquivos de programas\Arquivos comuns\DVDVideoSoft

2009-04-30 16:52 . 2009-04-30 16:51 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\Any Video Converter

2009-04-30 16:51 . 2009-04-30 16:51 -------- d-----w- c:\arquivos de programas\Any Video Converter

2009-04-30 16:36 . 2009-04-30 16:36 -------- d-----w- c:\documents and settings\Dener\Dados de aplicativos\Apple Computer

2009-03-02 23:27 . 2009-03-02 23:27 8 --sh--r- c:\windows\system32\636A4C6EA0.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"Google Update"="c:\documents and settings\Dener\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2009-04-20 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apple_KbdMgr"="c:\arquivos de programas\Boot Camp\KbdMgr.exe" [2008-02-08 423216]

"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"ISUSPM Startup"="c:\arquiv~1\ARQUIV~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184]

"QuickTime Task"="c:\arquivos de programas\QuickTime\QTTask.exe" [2009-01-05 413696]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= "c:\arquivos de programas\GbPlugin\gbiehcef.dll" [2009-01-27 404032]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginCef]

2009-01-27 16:40 404032 ----a-w- c:\arquivos de programas\GbPlugin\gbiehcef.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@="Driver Group"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Documents and Settings\\All Users\\Dados de aplicativos\\NexonUS\\NGM\\NGM.exe"=

"c:\\Arquivos de programas\\FlashFXP\\FlashFXP.exe"=

"c:\\Arquivos de programas\\ONGAME\\Metin2\\metin2.bin"=

"c:\\AppServ\\Apache2.2\\bin\\httpd.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Metin2_Portugal2\\metin2.bin"=

"c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

"c:\\Arquivos de programas\\Metin2_UK\\metin2.bin"=

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [3/3/2009 13:33 31296]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [8/6/2009 19:01 130936]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18/11/2008 15:04 114768]

R1 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [25/11/2008 09:39 2944]

R2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [17/1/2008 15:37 24635]

R2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [8/2/2008 11:14 132400]

R2 AppleTimeSrv;Serviço de Tempo da Apple;c:\windows\system32\AppleTimeSrv.exe [8/2/2008 11:14 99632]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18/11/2008 15:04 20560]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [3/3/2009 13:33 52808]

R2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [8/2/2008 10:56 5504]

R2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [8/2/2008 10:55 6528]

R3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\drivers\IRFilter.sys [10/8/2008 23:12 16512]

R3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\drivers\KeyMagic.sys [10/8/2008 23:13 18944]

S3 sdAuxService;PC Tools Auxiliary Service;c:\arquivos de programas\Spyware Doctor\pctsAuxs.exe [8/6/2009 19:01 348752]

.

Contents of the 'Scheduled Tasks' folder

2009-06-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\arquivos de programas\Apple Software Update\SoftwareUpdate.exe [2008-07-30 15:34]

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dufpy.com

uInternet Settings,ProxyOverride = *.local

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Sothink SWF Catcher - c:\arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://imagem.caixa.gov.br/cab/gbpdist.cab

FF - ProfilePath - c:\documents and settings\Dener\Dados de aplicativos\Mozilla\Firefox\Profiles\102uvvwv.default\

FF - component: c:\arquivos de programas\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-09 11:16

Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mysql]

"ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)

c:\arquivos de programas\GbPlugin\gbiehcef.dll

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-06-09 11:17

ComboFix-quarantined-files.txt 2009-06-09 14:17

Pre-Run: 4.642.258.944 bytes disponíveis

Post-Run: 7.016.349.696 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

177 --- E O F --- 2009-05-14 12:22

Power Max · Junho 9, 2009

:thumbsup: Olá D-Patrick!

Alguns problemas foram removidos pelo Combofix.

_____________________________________________________________

Vi que você tem o Malwarebytes instalado em seu PC.

:seta: Sugiro que você salve ou imprima essas instruções abaixo, pois em alguns momentos você poderá precisar usar o computador sem o acesso à internet:

*Abra o Malwarebytes > clique na aba Atualização > Verificar Atualizações > aguarde até que a atualização seja concluída.

*Reinicie o PC em Modo de Segurança (apertando a tecla F8 (ou a tecla F5 em alguns computadores) repetidas vezes quando o computador estiver reiniciando e escolhendo a opção Modo Seguro ou Modo de Segurança).

* Se não possível executar o computador em Modo Seguro, faça o escaneamento no modo normal

*Execute o programa MalwareBytes'Anti-Malware e clique na aba: "Verificação", selecione a opção "Verificação completa"

*Clique no botão: "Verificar"

* Marque todas as partes do computador que você deseja escanear e clique no botão: “Iniciar verificação”

*Ao término do scan, clique em "OK" > "Mostrar Resultados"

*Selecione todas as entradas e clique em "Remover Selecionados"

*Após a remoção poderá ser interrogado se deseja remover objetos da memória. Clique "SIM"

*Um log será apresentado com o resultado das ações

*Alguns malwares são rebeldes e necessitam de uma reinicialização para a remoção. Caso isto seja solicitado, clique para reiniciar o PC.

*Ao término do processo, reinicie o PC em Modo Normal.

* Depois de alguns dias, se o seu computador estiver funcionando normalmente sem estes arquivos que foram excluidos pelo Malwarebytes Anti-malware, abra (execute) o Malwarebytes Anti-malware, clique na aba: Quarentena e clique no botão: Remover tudo.

*Execute novamente o programa Malwarebytes Anti-malware e clique na aba “Logs”, dê um duplo clique com o mouse sobre o log mais recente, selecione o log completo e copie-o.

Poste este log gerado pelo Malwarebytes Anti-Malware juntamente com um log do programa Hijackthis na sua próxima resposta e nos diga como está o seu computador depois de seguir este procedimento acima.

Ficamos no aguardo de sua resposta.

Obs: Para postar o log do Hijackthis é só seguir as dicas deste tópico:

http://forum.imasters.com.br/index.php?showtopic=165906

D-Patrick · Junho 16, 2009

Obrigado pela atenção segue o log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:34:34, on 16/6/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\Boot Camp\KbdMgr.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Dener\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Antiy Labs\Alive\ALiveCenter_.exe

C:\WINDOWS\system32\spoolsv.exe

C:\AppServ\Apache2.2\bin\httpd.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\AppleOSSMgr.exe

C:\WINDOWS\system32\AppleTimeSrv.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\AppServ\MySQL\bin\mysqld-nt.exe

C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

C:\AppServ\Apache2.2\bin\httpd.exe

C:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Dener\Desktop\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\ARQUIV~1\FlashFXP\IEFlash.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [Apple_KbdMgr] C:\Arquivos de programas\Boot Camp\KbdMgr.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [iSUSPM Startup] c:\ARQUIV~1\ARQUIV~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Antiy Auto Update] C:\Arquivos de programas\Antiy Labs\Alive\ALiveCenter.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dener\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Sothink SWF Catcher - C:\Arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Arquivos de programas\Arquivos comuns\SourceTec\SWF Catcher\InternetExplorer.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.4.1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://imagem.caixa.gov.br/cab/gbpdist.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehcef.dll

O23 - Service: Apache2.2 - Apache Software Foundation - C:\AppServ\Apache2.2\bin\httpd.exe

O23 - Service: Dispositivo Celular da Apple (Apple Mobile Device) - Apple Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Apple OS Switch Manager (AppleOSSMgr) - Unknown owner - C:\WINDOWS\system32\AppleOSSMgr.exe

O23 - Service: Serviço de Tempo da Apple (AppleTimeSrv) - Apple Inc. - C:\WINDOWS\system32\AppleTimeSrv.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PSIService.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

--

End of file - 9379 bytes

------------

Malwarebytes' Anti-Malware 1.37

Versão do banco de dados: 2287

Windows 5.1.2600 Service Pack 3

16/6/2009 12:24:47

mbam-log-2009-06-16 (12-24-47).txt

Tipo de Verificação: Completa (C:\|)

Objetos verificados: 217912

Tempo decorrido: 48 minute(s), 44 second(s)

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 0

Arquivos infectados: 0

Processos da Memória infectados: