[Arquivado] Analisem meu log

igfmachado · Julho 18, 2009

As vezes aparecem uns processos meio estranhos, e como eu tive graves problemas com virus, eu fico mei paranoico.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:03:57, on 18/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\csrcs.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\Dropbox\Dropbox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

D:\Igor\Programas\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [sMSERIAL] C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Startup: Dropbox.lnk = C:\Arquivos de programas\Dropbox\Dropbox.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1243795157010

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab

O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

--

End of file - 5650 bytes

PedroN · Julho 18, 2009

Faça o download do ComboFix de um destes locais:

Link 1.

Link 2.

Link 3.

Importante!

Você não deve usar Combofix a menos que você tenha sido instruído a fazê-lo por um análista de segurança.

Destina-se pelo seu criador para ser utilizado sob orientação e supervisão de um especialista, e não para uso privado.

Utilizando esta ferramenta incorreto poderia levar a desastrosa problemas com o seu sistema operacional.

Certifique-se de que você salvou ComboFix.exe para o seu desktop.

• Desabilite o seu Antivírus e AntiSpyware , geralmente através de um clique direito sobre o ícone da bandeja do sistema. Eles podem interferir na execução da ferramenta.

• Dê um duplo clique no ComboFix.exe & siga as instruções.

• Como parte de seu processo, ComboFix irá verificar se o Microsoft Windows Recovery Console está instalado. Como as infecções de malware são hoje, é fortemente recomendado que esteja pré-instalado em sua máquina antes de fazer qualquer remoção de malware. Ela permitirá que você arrancar em especial uma recuperação / reparação modo a permitir-nos-á mais fácil ajudá-lo a seu computador deve ter um problema após uma tentativa de remoção de malware.

• Siga as instruções para permitir ComboFix para baixar e instalar o Microsoft Windows Recovery Console e, quando for solicitado, concordar com o End-User License Agreement para instalar o Microsoft Windows Recovery Console.

-- Atenção: Se a consola de recuperação do Microsoft Windows já estiver instalado, ComboFix irá continuar a sua remoção malware procedimentos.

Uma vez que o Microsoft Windows Recovery Console é instalado usando o ComboFix, você deverá ver a seguinte mensagem:

Clique em Sim, para continuar a varredura de malware.

Quando terminar, ela deve produzir um log para você. Poste o relatorio do combofix que estar em C: \ ComboFix.txt junto com um log do hijackthis.

PedroN · Julho 18, 2009

Desculpe por essa segunda resposta, problemas no navegador

igfmachado · Julho 18, 2009

ComboFix 09-07-14.08 - Igor Filipe 18/07/2009 19:10.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.893.548 [GMT -3:00]

Executando de: c:\documents and settings\Igor Filipe\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\AutoRun.inf

c:\windows\system32\csrcs.exe

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-06-18 to 2009-07-18 ))))))))))))))))))))))))))))

.

2009-07-18 22:13 . 2009-07-18 22:13 53248 ----a-w- c:\temp\catchme.dll

2009-07-18 22:11 . 2009-07-18 22:11 -------- d-----w- c:\temp\WPDNSE

2009-07-05 12:32 . 2004-08-04 02:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2009-07-05 12:32 . 2004-08-04 02:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2009-07-03 18:55 . 2009-07-03 18:55 -------- d-----w- c:\arquivos de programas\Green Land Studios

2009-07-01 21:34 . 2009-07-01 21:36 -------- d-----w- c:\temp\IXP000.TMP

2009-07-01 04:06 . 2009-07-18 22:13 -------- d-----w- c:\temp\WLZ3E49.tmp

2009-06-25 02:14 . 2009-06-25 02:14 -------- d-----w- c:\arquivos de programas\Stranded II

2009-06-24 00:44 . 2009-07-10 18:31 27240 ----a-w- c:\windows\system32\drivers\GbpKm.sys

2009-06-24 00:44 . 2009-07-18 20:01 -------- d-----w- c:\arquivos de programas\GbPlugin

2009-06-22 18:28 . 2009-07-16 02:18 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\gtk-2.0

2009-06-22 18:28 . 2009-06-22 18:28 -------- d-----w- c:\documents and settings\Igor Filipe\.thumbnails

2009-06-22 18:27 . 2009-06-22 18:27 -------- d-----w- c:\temp\fontconfig

2009-06-22 18:26 . 2009-07-16 02:19 -------- d-----w- c:\documents and settings\Igor Filipe\.gimp-2.6

2009-06-22 18:26 . 2009-06-22 18:26 -------- d-----w- c:\documents and settings\Igor Filipe\.gegl-0.0

2009-06-22 18:26 . 2009-06-22 18:26 -------- d-----w- c:\arquivos de programas\GIMP-2.0

2009-06-21 19:37 . 2009-06-21 19:37 -------- d-----w- c:\arquivos de programas\TP

2009-06-21 19:37 . 1999-03-23 12:12 299520 ----a-w- c:\windows\uninst.exe

2009-06-21 19:36 . 2009-06-21 19:36 -------- d-----w- c:\documents and settings\Igor Filipe\WINDOWS

2009-06-21 02:33 . 2009-06-21 02:33 -------- d-----w- c:\arquivos de programas\Opera

2009-06-21 02:33 . 2009-06-21 02:34 -------- d-----w- c:\temp\7zS312.tmp

2009-06-20 03:08 . 2009-07-18 20:37 -------- d-----w- c:\arquivos de programas\Garena

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-18 21:50 . 2009-06-05 23:13 -------- d-----w- c:\arquivos de programas\Warcraft III

2009-07-18 20:16 . 2009-05-31 20:36 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\Dropbox

2009-07-18 20:01 . 2009-06-01 22:05 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\GbPlugin

2009-07-18 14:59 . 2009-05-31 15:27 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\uTorrent

2009-07-17 23:25 . 2009-06-02 01:34 -------- d-----w- c:\arquivos de programas\Arquivos comuns\DVDVideoSoft

2009-07-17 23:25 . 2009-06-02 01:34 -------- d-----w- c:\arquivos de programas\DVDVideoSoft

2009-07-16 01:44 . 2009-06-03 23:53 2516 --sha-w- c:\documents and settings\All Users\Dados de aplicativos\KGyGaAvL.sys

2009-07-09 21:02 . 2009-06-01 20:46 -------- d-----w- c:\arquivos de programas\Tales of Pirates Online

2009-06-18 19:59 . 2001-10-28 12:07 83186 ----a-w- c:\windows\system32\perfc016.dat

2009-06-18 19:59 . 2001-10-28 12:07 477468 ----a-w- c:\windows\system32\perfh016.dat

2009-06-18 19:59 . 2009-06-18 19:59 -------- d-----w- c:\arquivos de programas\MSBuild

2009-06-18 19:58 . 2009-06-18 19:58 -------- d-----w- c:\arquivos de programas\Reference Assemblies

2009-06-18 19:56 . 2009-06-18 19:56 -------- d-----w- c:\arquivos de programas\MSXML 6.0

2009-06-16 15:26 . 2009-06-16 15:26 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\DFX

2009-06-16 15:26 . 2009-06-16 15:26 -------- d-----w- c:\arquivos de programas\DFX

2009-06-16 15:26 . 2009-06-02 02:00 -------- d-----w- c:\arquivos de programas\Winamp

2009-06-16 15:26 . 2009-06-16 15:26 -------- d-----w- c:\arquivos de programas\Arquivos comuns\DFX

2009-06-05 23:19 . 2009-06-05 23:14 86732 ----a-w- c:\windows\War3Unin.dat

2009-06-05 23:17 . 2009-06-05 23:14 2829 ----a-w- c:\windows\War3Unin.pif

2009-06-05 23:17 . 2009-06-05 23:14 139264 ----a-w- c:\windows\War3Unin.exe

2009-06-05 23:07 . 2009-06-05 23:07 -------- d-----w- c:\arquivos de programas\PowerISO

2009-06-05 02:41 . 2009-06-05 02:41 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Avira

2009-06-05 02:41 . 2009-06-05 02:41 -------- d-----w- c:\arquivos de programas\Avira

2009-06-04 01:14 . 2009-06-04 01:14 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\Nero

2009-06-04 01:13 . 2009-06-04 01:13 -------- d-----w- c:\arquivos de programas\Nero

2009-06-04 01:13 . 2009-06-04 01:13 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Nero

2009-06-04 01:13 . 2009-06-04 01:13 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Nero

2009-06-03 23:53 . 2009-06-03 23:53 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\Corel

2009-06-03 23:53 . 2009-06-03 23:53 8 --sh--r- c:\documents and settings\All Users\Dados de aplicativos\932B69D969.sys

2009-06-03 23:52 . 2009-06-03 23:52 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Corel

2009-06-03 23:52 . 2009-06-03 23:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Protexis

2009-06-03 23:51 . 2009-06-03 23:51 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Corel

2009-06-03 23:50 . 2009-06-03 23:50 -------- d-----w- c:\arquivos de programas\Corel

2009-06-03 14:45 . 2009-06-03 14:45 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\Media Player Classic

2009-06-03 14:45 . 2009-06-02 02:15 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2009-06-02 11:26 . 2009-05-31 05:26 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-06-02 02:02 . 2009-06-02 02:00 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\Winamp

2009-06-01 14:01 . 2009-06-01 14:01 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-06-01 03:24 . 2009-06-01 02:37 -------- d-----w- c:\arquivos de programas\Shutter

2009-06-01 01:38 . 2009-06-01 01:38 -------- d-----w- c:\arquivos de programas\Messenger Plus! Live

2009-06-01 01:37 . 2009-06-01 01:37 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\Foxit

2009-06-01 01:37 . 2009-06-01 01:37 -------- d-----w- c:\arquivos de programas\Foxit Software

2009-06-01 01:26 . 2009-05-31 18:48 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2009-05-31 20:36 . 2009-05-31 20:36 -------- d-----w- c:\arquivos de programas\Dropbox

2009-05-31 19:22 . 2009-05-31 19:22 0 ----a-w- c:\windows\nsreg.dat

2009-05-31 19:21 . 2009-05-31 18:40 -------- d-----w- c:\arquivos de programas\Windows Live

2009-05-31 19:20 . 2009-05-31 18:41 -------- dcsh--w- c:\arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2009-05-31 19:20 . 2009-05-31 15:27 -------- d-----w- c:\arquivos de programas\uTorrent

2009-05-31 19:16 . 2009-05-31 18:48 -------- d-----w- c:\arquivos de programas\Spybot - Search & Destroy

2009-05-31 18:40 . 2009-05-31 18:40 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\WLInstaller

2009-05-31 14:32 . 2009-05-31 14:29 -------- d-----w- c:\arquivos de programas\Velox

2009-05-31 14:03 . 2009-05-31 13:27 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-05-31 14:02 . 2009-05-31 14:01 -------- d-----w- c:\arquivos de programas\REALTEK USB Wireless LAN Driver

2009-05-31 14:01 . 2009-05-31 14:01 -------- d-----w- c:\documents and settings\Igor Filipe\Dados de aplicativos\InstallShield

2009-05-31 13:51 . 2009-05-31 13:51 -------- d-----w- c:\arquivos de programas\Motorola

2009-05-31 13:49 . 2009-05-31 13:49 -------- d-----w- c:\arquivos de programas\Realtek

2009-05-31 13:49 . 2009-05-31 13:49 315392 ----a-w- c:\windows\HideWin.exe

2009-05-31 13:27 . 2009-05-31 13:25 -------- d-----w- c:\arquivos de programas\SiS VGA Utilities V3.81

2009-05-31 13:27 . 2009-05-31 13:27 -------- d-----w- c:\arquivos de programas\sisagp

2009-05-31 13:25 . 2009-05-31 13:25 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-05-31 05:53 . 2009-05-31 05:53 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2009-05-31 05:52 . 2009-05-31 05:52 -------- d-----w- c:\arquivos de programas\Microsoft Works

2009-05-31 05:52 . 2009-05-31 05:52 -------- d-----w- c:\arquivos de programas\Microsoft.NET

2009-05-31 05:50 . 2009-05-31 05:50 -------- d-----w- c:\arquivos de programas\Editpad

2009-05-31 05:50 . 2009-05-31 05:50 -------- d-----w- c:\arquivos de programas\Foxit

2009-05-31 05:50 . 2009-05-31 05:50 -------- d-----w- c:\arquivos de programas\Java

2009-05-31 05:50 . 2009-05-31 05:50 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Java

2009-05-31 05:25 . 2009-05-31 05:25 -------- d-----w- c:\arquivos de programas\Serviços on-line

2009-05-31 05:24 . 2009-05-31 05:24 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2009-05-31 05:23 . 2009-05-31 05:23 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-06-24 18:03 . 2009-05-31 19:22 137208 ----a-w- c:\arquivos de programas\mozilla firefox\components\brwsrcmp.dll

.

------- Sigcheck -------

[-] 2006-11-26 15:19 1548288 0F5D2469220112219572903CC3ED1341 c:\windows\system32\sfcfiles.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2009-04-01 08:14 1163264 ----a-w- c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2009-04-01 08:14 1163264 ----a-w- c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2009-04-01 08:14 1163264 ----a-w- c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"SpybotSD TeaTimer"="c:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SMSERIAL"="c:\arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-29 638976]

"avgnt"="c:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2007-06-25 53248]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-12-20 16860672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Igor Filipe\Menu Iniciar\Programas\Inicializar\

Dropbox.lnk - c:\arquivos de programas\Dropbox\Dropbox.exe [2009-4-8 25598505]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-5-31 262144]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn]

2009-07-10 18:31 296872 ----a-w- c:\arquiv~1\GbPlugin\gbiehAbn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\GbpKm.sys [23/6/2009 21:44 27240]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [4/6/2009 23:41 108289]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [23/6/2009 21:44 53736]

R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\drivers\RMSPPPOE.SYS [10/6/2002 00:09 31232]

S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [31/5/2009 11:02 238976]

.

Conteúdo da pasta 'Tarefas Agendadas'

.

- - - - ORFÃOS REMOVIDOS - - - -

HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll

HKLM-Explorer_Run-csrcs - c:\windows\system32\csrcs.exe

.

------- Scan Suplementar -------

.

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

TCP: {8B7B8147-4A24-4D6A-8B84-FB4874AEBD8B} = 200.165.132.155 200.149.55.142

FF - ProfilePath - c:\documents and settings\Igor Filipe\Dados de aplicativos\Mozilla\Firefox\Profiles\yhu8lvqh.default\

FF - component: c:\documents and settings\Igor Filipe\Dados de aplicativos\Mozilla\Firefox\Profiles\yhu8lvqh.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}\components\GbMzhAbn.dll

FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-18 19:13

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(860)

c:\arquiv~1\GbPlugin\gbiehAbn.dll

.

Tempo para conclusão: 2009-07-18 19:15

ComboFix-quarantined-files.txt 2009-07-18 22:15

Pré-execução: 5 pasta(s) 10.288.689.152 bytes disponíveis

Pós execução: 5 pasta(s) 10.383.351.808 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

254

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:19:47, on 18/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe