[Resolvido!] Análise de Log

latos · Agosto 9, 2009

Ola, gostaria se possivel que vcs fizessem a analise deste log.

Eu burramente abri as fotos de uma "festa" de uma amiga minha e um virus se instalou em meu pc. Logo em seguida percebi que o firewall havia sido desativado e a conexao da internet tambem. Reativei o firewall e refiz a minha conexao. A velocidade do meu pc segue a mesma e a internet voltou ao normal, a unica coisa que reparei de estranho é q as vezes o firewall esta desativado qdo entro no pc (agora que o troquei nao sei se vai melhorar) e a coisa mais estranha é que sempre que inicio o computador uma caixa branca com umas letras estranhas aparecem e só clicando em ok ou esperando mto tempo consigo seguir para a area de trabalho.

Segue aqui o Log gerado pelo HiJackThis, desde ja agradeço pela atenção.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:18:08, on 9/8/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Symantec\Norton Ghost 2003\GhostStartService.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Microsoft LifeCam\MSCamS32.exe

d:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

C:\ARQUIV~1\AVG\AVG8\avgam.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe

D:\Arquivos de programas\TVersity\Media Server\MediaServer.exe

C:\Arquivos de programas\Windows Media Player\WMPNetwk.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Spyware Doctor\pctsTray.exe

C:\Arquivos de programas\Windows Defender\MSASCui.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\vVX1000.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE

D:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

D:\Arquivos de programas\SlySoft\CloneCD\CloneCDTray.exe

C:\WINDOWS\system32\ctfmon.exe

D:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\Arquivos de programas\Windows Media Player\WMPNSCFG.exe

C:\Arquivos de programas\VIA\RAID\raid_tool.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\HiJackThis\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\ARQUIV~2\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] "C:\Arquivos de programas\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe

O4 - HKLM\..\Run: [LifeCam] "C:\Arquivos de programas\Microsoft LifeCam\LifeExp.exe"

O4 - HKLM\..\Run: [\\quarto\EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P32 "\\quarto\EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"

O4 - HKLM\..\Run: [Auto EPSON Stylus C67 Series em quarto] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P38 "Auto EPSON Stylus C67 Series em quarto" /O14 "\\QUARTO\EPSON" /M "Stylus C67"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "D:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [CloneCDTray] "D:\Arquivos de programas\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [iSTray] "C:\Arquivos de programas\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Arquivos de programas\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup

O4 - HKLM\..\Run: [OutpostMonitor] C:\ARQUIV~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] D:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Arquivos de programas\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: VIA RAID TOOL.lnk = C:\Arquivos de programas\VIA\RAID\raid_tool.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\ARQUIV~2\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\ARQUIV~2\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1212518391921

O17 - HKLM\System\CCS\Services\Tcpip\..\{C2E9EDA1-AA1C-4201-BEE6-7EA229DCD9B5}: NameServer = 201.6.0.113,192.168.0.1

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: c:\arquiv~1\agnitum\outpos~1\wl_hook.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\ARQUIV~1\Agnitum\OUTPOS~1\acs.exe

O23 - Service: Dispositivo Celular da Apple (Apple Mobile Device) - Apple Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Arquivos de programas\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: GhostStartService - Symantec Corporation - C:\Arquivos de programas\Symantec\Norton Ghost 2003\GhostStartService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Arquivos de programas\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: NMSAccessU - Unknown owner - d:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

O23 - Service: TVersityMediaServer - Unknown owner - D:\Arquivos de programas\TVersity\Media Server\MediaServer.exe

--

End of file - 11363 bytes

jgarcia · Agosto 9, 2009

Opa latos,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e aguarde (o processo total demora cerca de 10 minutos);

3) A janela de “NEGAÇÃO DE GARANTIA DO SOFTWARE” abrir-se-á. Leia atentamente o texto contido nesta janela e clique sobre “SIM” para continuar.

PS.: Caso não concorde com os termos clique sobre “NÃO” para sair do software, cabendo lembrar que o processo de desinfecção não será possível sem a continuidade do ComboFix.

4) Outra janela irá abrir, caso a sua máquina não possua o CONSOLE DE RECUPERAÇÃO DO WINDOWS. É recomendável executar a instalação do console ante de dar continuidade ao processo, pois tal ação proporcionará a garantia de que o sistema poderá ser recuperado em caso de problemas durante a varredura.

Clique sobre “SIM” e aguarde, pois o processo de instalação do console dar-se-á automaticamente através do próprio ComboFix. Ele poderá demorar alguns minutos (dependerá da velocidade de sua conexão), portanto seja paciente.

Quando a janela “INSTALANDO O CONSOLE DE RECUPERAÇÃO” aparecer clique em “OK”, depois clique sobre “SIM” para aceitar a licença EULA.

Ao término da instalação do console de recuperação abrir-se-á uma janela avisando que “O CONSOLE DE RECUPERAÇÃO FOI INSTALADA COM SUCESSO”.

Clique sobre “SIM” para continuar a varredura.

5) O ComboFix iniciará o AUTOSCAN (aguarde).

ATENÇÃO: Não clique na janela do ComboFix, nem termine o processo abruptamente enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco).

Ao término do processo a máquina será reiniciada para a emissão do relatório.

6) Ao reiniciar a máquina o ComboFix irá executar o FIND3M para a criação do relatório final da varredura. O log ficará alocado em C:\ComboFix.txt.

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

OBS.1: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Em último caso, tente utilizar o ComboFix em MODO SEGURO.

OBS.2: Caso haja um clique sobre a janela do ComboFix em execução, ela irá MAXIMIZAR, sobrepondo-se sobre as demais. Para minimizá-la novamente basta utilizar a combinação ALT + TAB.

Abraços.

latos · Agosto 10, 2009

Opa, mto obrigado cara. Aqui segue o conteudo do ComboFix

ComboFix 09-08-09.04 - Rodrigo 10/08/2009 14:11.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.130 [GMT -3:00]

Executando de: d:\arquivos de programas\Arquivos de Sistema Usuario\Desktop\ComboFix.exe

AV: AVG Anti-Virus SBS Edition *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Installer\ea6267.msi

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-07-10 to 2009-08-10 ))))))))))))))))))))))))))))

.

2009-08-09 14:53 . 2009-08-09 15:18 -------- d-----w- C:\HiJackThis

2009-08-07 23:27 . 2009-08-08 15:01 3508256 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-08-07 22:41 . 2009-04-06 14:37 704384 ----a-w- c:\windows\system32\drivers\SandBox.sys

2009-08-07 22:40 . 2009-02-10 19:15 257432 ----a-w- c:\windows\system32\drivers\afwcore.sys

2009-08-07 22:38 . 2009-02-18 20:30 31128 ----a-w- c:\windows\system32\drivers\afw.sys

2009-08-07 22:38 . 2009-08-07 22:38 -------- d-----w- c:\arquivos de programas\Agnitum

2009-08-07 22:38 . 2009-08-07 22:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Agnitum

2009-08-07 21:54 . 2008-12-11 11:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2009-08-07 21:53 . 2009-04-03 14:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-08-07 21:53 . 2008-12-18 15:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2009-08-07 21:53 . 2009-08-07 21:56 -------- d-----w- c:\arquivos de programas\Arquivos comuns\PC Tools

2009-08-07 21:53 . 2008-12-10 14:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2009-08-07 21:53 . 2009-08-10 10:45 -------- d-----w- c:\arquivos de programas\Spyware Doctor

2009-08-07 21:53 . 2009-08-07 21:53 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\PC Tools

2009-08-07 21:53 . 2009-08-07 21:53 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools

2009-08-07 21:21 . 2009-08-07 21:21 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com

2009-08-07 21:20 . 2009-08-08 00:37 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\SUPERAntiSpyware.com

2009-08-07 21:20 . 2009-08-08 00:37 -------- d-----w- c:\arquivos de programas\SUPERAntiSpyware

2009-08-07 20:58 . 2009-08-07 20:58 579072 -c--a-w- c:\windows\system32\dllcache\user32.dll

2009-08-07 20:57 . 2009-08-07 20:57 -------- d-----w- c:\windows\ERUNT

2009-08-07 20:56 . 2009-08-07 20:56 -------- d-----w- C:\LinhaDefensiva

2009-08-07 20:34 . 2009-08-07 20:34 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\Malwarebytes

2009-08-07 20:34 . 2009-08-07 20:34 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-08-07 16:38 . 2009-08-07 16:47 -------- d-----w- c:\documents and settings\Rodrigo\DoctorWeb

2009-08-05 17:58 . 2009-08-05 17:58 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-08-05 17:58 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe

2009-08-05 16:08 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys

2009-08-05 16:04 . 2009-08-05 16:04 -------- dc-h--w- c:\documents and settings\All Users\Dados de aplicativos\{EF63305C-BAD7-4144-9208-D65528260864}

2009-08-05 16:04 . 2009-07-08 17:28 2920112 -c--a-w- c:\documents and settings\All Users\Dados de aplicativos\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe

2009-08-05 16:03 . 2009-08-05 16:08 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Lavasoft

2009-08-05 16:03 . 2009-08-05 16:03 -------- d-----w- c:\arquivos de programas\Lavasoft

2009-08-04 22:25 . 2009-08-07 16:47 -------- d-s---w- C:\winnt_

2009-08-04 16:40 . 2009-08-04 16:40 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\Uniblue

2009-07-30 18:01 . 2009-07-17 22:01 335752 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgldx86.sys

2009-07-30 18:01 . 2009-07-17 22:01 2053912 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgcorex.dll

2009-07-30 18:01 . 2009-07-17 22:01 1111320 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgssie.dll

2009-07-30 18:01 . 2009-07-17 22:01 493336 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgtbapi.dll

2009-07-30 18:01 . 2009-07-17 22:01 2312984 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgdiagex.exe

2009-07-30 18:01 . 2009-07-17 22:01 2301720 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avguiadv.dll

2009-07-30 18:01 . 2009-07-17 22:01 3403032 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgui.exe

2009-07-30 18:01 . 2009-07-17 22:01 1206040 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgabout.dll

2009-07-30 18:01 . 2009-07-17 22:01 353048 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgxch32.dll

2009-07-30 18:00 . 2009-07-17 22:01 3298584 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\setup.exe

2009-07-30 18:00 . 2009-07-17 22:01 337176 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avglogx.dll

2009-07-30 18:00 . 2009-07-17 22:01 836888 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgcfgx.dll

2009-07-30 17:56 . 2009-07-17 22:00 1086744 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgupd.exe

2009-07-30 17:56 . 2009-07-17 22:00 1471768 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgupd.dll

2009-07-28 13:58 . 2009-07-28 13:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\SlySoft

2009-07-27 02:01 . 2007-11-29 15:52 60273 ----a-w- c:\windows\system32\pthreadGC2.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-10 16:58 . 2008-06-06 14:30 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\uTorrent

2009-08-10 16:56 . 2009-02-08 18:38 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-08-08 15:01 . 2009-08-07 23:27 44276 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-08-08 00:37 . 2008-06-03 18:03 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard

2009-08-07 03:37 . 2009-05-27 05:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2009-07-30 17:58 . 2009-04-21 19:52 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-07-30 17:58 . 2009-04-21 19:52 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-07-30 17:58 . 2009-04-21 19:52 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-07-25 16:50 . 2009-04-30 16:57 -------- d-----w- c:\arquivos de programas\abgx360

2009-07-03 16:59 . 2004-08-04 03:45 915456 ----a-w- c:\windows\system32\wininet.dll

2009-06-24 00:28 . 2009-06-24 00:28 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\Hamachi

2009-06-24 00:27 . 2009-06-24 00:27 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys

2009-06-23 05:22 . 2008-06-12 02:58 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\LimeWire

2009-06-16 14:39 . 2004-08-04 03:45 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:39 . 2001-10-28 12:06 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-03 19:10 . 2004-08-04 03:45 1295872 ----a-w- c:\windows\system32\quartz.dll

2009-06-02 16:38 . 2009-06-10 20:02 1004800 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\AVG Security Toolbar\IEToolbar.dll

2009-05-30 07:08 . 2009-05-30 07:07 120 ----a-w- C:\drmHeader.bin

2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\arquivos de programas\mozilla firefox\plugins\libdivx.dll

2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\arquivos de programas\mozilla firefox\plugins\ssldivx.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-02 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-06-02 16:38 1004800 ----a-w- c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-02 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-02 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="d:\arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"WMPNSCFG"="c:\arquivos de programas\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\arquivos de programas\Windows Defender\MSASCui.exe" [2006-11-03 866584]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"RemoteControl"="c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]

"LanguageShortcut"="c:\arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]

"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]

"LifeCam"="c:\arquivos de programas\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]

"\\quarto\EPSON Stylus C67 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE" [2005-01-25 98304]

"Auto EPSON Stylus C67 Series em quarto"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE" [2005-01-25 98304]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"QuickTime Task"="c:\arquivos de programas\QuickTime\qttask.exe" [2009-01-05 413696]

"iTunesHelper"="d:\arquivos de programas\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2009-07-30 2000152]

"CloneCDTray"="d:\arquivos de programas\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]

"OutpostFeedBack"="c:\arquivos de programas\Agnitum\Outpost Firewall\feedback.exe" [2009-04-28 428032]

"OutpostMonitor"="c:\arquiv~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

VIA RAID TOOL.lnk - c:\arquivos de programas\VIA\RAID\raid_tool.exe [2008-6-3 565248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-07-30 17:58 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"d:\\Arquivos de programas\\eMule\\emule.exe"=

"d:\\Arquivos de programas\\Utorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=

"d:\\Arquivos de programas\\The 7 Deadly Sins\\mirc.exe"=

"d:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"d:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"c:\\Arquivos de programas\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Arquivos de programas\\Java\\jre6\\bin\\java.exe"=

"d:\\Arquivos de programas\\Championship Manager 01-02\\cm0102.exe"=

"d:\\Arquivos de programas\\TVersity\\Media Server\\MediaServer.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgam.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgdiag.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgdiagex.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"32459:TCP"= 32459:TCP:Utorrent

"863:UDP"= 863:UDP:msnmsgr

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [21/4/2009 16:52 12552]

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/8/2009 13:08 64160]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [7/8/2009 18:53 130936]

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [3/6/2008 14:17 77312]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [21/4/2009 16:52 335240]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [21/4/2009 16:52 108552]

R1 GhPciScan;GhostPciScanner;c:\arquivos de programas\Symantec\Norton Ghost 2003\GhPciScan.sys [17/12/2003 15:41 5632]

R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [7/8/2009 19:41 704384]

R2 avg8wd;AVG8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [21/4/2009 16:51 297752]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\arquivos de programas\Lavasoft\Ad-Aware\AAWService.exe [3/7/2009 11:49 1029456]

R2 WinDefend;Windows Defender;c:\arquivos de programas\Windows Defender\MsMpEng.exe [3/11/2006 19:19 13592]

R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [7/8/2009 19:38 31128]

R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [7/8/2009 19:40 257432]

R3 yukonx86;NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter;c:\windows\system32\drivers\yukonx86.sys [3/6/2008 14:16 176256]

S2 acssrv;Agnitum Client Security Service;c:\arquiv~1\Agnitum\OUTPOS~1\acs.exe [7/8/2009 19:38 1195008]

S3 getPlus® Helper;getPlus® Helper;c:\arquivos de programas\NOS\bin\getPlus_HelperSvc.exe [8/7/2008 17:24 31592]

S3 sdAuxService;PC Tools Auxiliary Service;c:\arquivos de programas\Spyware Doctor\pctsAuxs.exe [7/8/2009 18:53 348752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-08-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\arquivos de programas\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]

2008-06-06 c:\windows\Tasks\Microsoft_Hardware_Launch_LifeExp_exe.job

- c:\arquivos de programas\Microsoft LifeCam\LifeExp.exe [2007-05-17 21:45]

2009-08-10 c:\windows\Tasks\MP Scheduled Scan.job

- c:\arquivos de programas\Windows Defender\MpCmdRun.exe [2006-11-03 22:20]

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.uol.com.br/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {C2E9EDA1-AA1C-4201-BEE6-7EA229DCD9B5} = 201.6.0.113,192.168.0.1

FF - ProfilePath - c:\documents and settings\Rodrigo\Dados de aplicativos\Mozilla\Firefox\Profiles\49kicd7x.default\

FF - prefs.js: browser.startup.homepage - www.uol.com.br

FF - prefs.js: keyword.URL - hxxp://br.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_br&p=

FF - component: c:\arquivos de programas\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\arquivos de programas\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll

FF - component: c:\arquivos de programas\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll

FF - component: c:\arquivos de programas\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll

FF - component: c:\arquivos de programas\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

FF - component: c:\documents and settings\Rodrigo\Dados de aplicativos\Mozilla\Firefox\Profiles\49kicd7x.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}\components\GbMzhAbn.dll

FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\arquivos de programas\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: c:\arquivos de programas\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: d:\arquivos de programas\iTunes\Mozilla Plugins\npitunes.dll

FF - plugin: d:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: d:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-10 14:22

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'explorer.exe'(3624)

c:\windows\system32\WININET.dll

d:\arquivos de programas\iTunes\iTunesMiniPlayer.dll

d:\arquivos de programas\iTunes\iTunesMiniPlayer.Resources\pt.lproj\iTunesMiniPlayerLocalized.dll

d:\arquivos de programas\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\arquivos de programas\Symantec\Norton Ghost 2003\GhostStartService.exe

c:\arquivos de programas\Java\jre6\bin\jqs.exe

c:\arquivos de programas\Microsoft LifeCam\MSCamS32.exe

d:\arquivos de programas\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\nvsvc32.exe

c:\arquivos de programas\CyberLink\Shared Files\RichVideo.exe

c:\arquiv~1\AVG\AVG8\avgam.exe

c:\arquivos de programas\AVG\AVG8\avgrsx.exe

c:\arquiv~1\AVG\AVG8\avgnsx.exe

c:\arquivos de programas\Windows Media Player\wmpnetwk.exe

c:\windows\system32\wbem\unsecapp.exe

c:\arquivos de programas\iPod\bin\iPodService.exe

c:\arquivos de programas\Lavasoft\Ad-Aware\AAWTray.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-08-10 14:31 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-08-10 17:31

Pré-execução: 7 pasta(s) 15.943.434.240 bytes disponíveis

Pós execução: 7 pasta(s) 15.957.856.256 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

317 --- E O F --- 2009-08-08 06:00

jgarcia · Agosto 24, 2009

Opa latos,

Desculpe a imensa demora... :(

Bem, poste um novo log do ComboFix, a fim de que eu possa analisar se ainda há problemas em seu PC.

Abraços.

latos · Setembro 2, 2009

Tranquilo cara eu sei como deve ser apertado o tempo de vcs e ainda assim vcs ajudam a galera aqui, vlw mesmo

Segue aqui o segundo log gerado pelo ComboFix, vlw abraço

ComboFix 09-09-01.04 - Rodrigo 02/09/2009 4:51.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.224 [GMT -3:00]

Executando de: d:\arquivos de programas\Arquivos de Sistema Usuario\Desktop\ComboFix.exe

AV: AVG Anti-Virus SBS Edition *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

PEV Error: AppFile

(((((((((((((((( Arquivos/Ficheiros criados de 2009-08-02 to 2009-09-02 ))))))))))))))))))))))))))))

.

2009-08-19 03:49 . 2009-08-19 03:51 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\Vso

2009-08-19 03:49 . 2009-08-19 03:49 87608 ----a-w- c:\documents and settings\Rodrigo\Dados de aplicativos\inst.exe

2009-08-19 03:49 . 2009-08-19 03:49 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys

2009-08-19 03:49 . 2009-08-19 03:49 47360 ----a-w- c:\documents and settings\Rodrigo\Dados de aplicativos\pcouffin.sys

2009-08-19 03:49 . 2007-03-19 00:37 65602 ----a-w- c:\windows\system32\cook3260.dll

2009-08-19 03:49 . 2006-09-29 16:26 176165 ----a-w- c:\windows\system32\drv23260.dll

2009-08-19 03:49 . 2006-09-29 16:25 208935 ----a-w- c:\windows\system32\drv33260.dll

2009-08-19 03:49 . 2006-09-29 16:24 217127 ----a-w- c:\windows\system32\drv43260.dll

2009-08-19 03:49 . 2002-12-10 06:20 102439 ----a-w- c:\windows\system32\sipr3260.dll

2009-08-19 03:49 . 2006-05-20 20:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll

2009-08-19 03:49 . 2006-05-11 23:21 626688 ----a-w- c:\windows\system32\vp7vfw.dll

2009-08-19 03:49 . 2009-08-19 03:49 -------- d-----w- c:\arquivos de programas\VSO

2009-08-16 23:22 . 2008-12-11 11:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2009-08-16 23:21 . 2009-04-03 14:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-08-16 23:21 . 2008-12-18 15:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2009-08-16 23:21 . 2009-08-16 23:23 -------- d-----w- c:\arquivos de programas\Arquivos comuns\PC Tools

2009-08-16 23:21 . 2008-12-10 14:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2009-08-16 23:21 . 2009-09-01 14:55 -------- d-----w- c:\arquivos de programas\Spyware Doctor

2009-08-16 23:21 . 2009-08-16 23:21 -------- d-----w- c:\documents and settings\Rodrigo\Dados de aplicativos\PC Tools

2009-08-16 23:21 . 2009-08-16 23:21 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools

2009-08-16 23:11 . 2009-08-03 16:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-16 23:11 . 2009-08-16 23:11 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-08-16 23:11 . 2009-08-03 16:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-13 20:57 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll