[Arquivado] Vírus

MagaiverSlz · Agosto 29, 2009

Boa Trade

Meu computador está com um virus, no disco C do nada apareceu um instalador com o nome dlwin.exe e no processador de tarefas apareceu net.exe, depois que apareceu isso meu computador ficou lento, a internet fico muito lenta, nenhuma pagina carregada,só as vezes Obs.raramente. Então baixei o AVG e scanniei , e meu pc estava com uns 200 cavalos de tróia, e nesse dlwin.exe tambem tinha cavalo de troia, entao eu excluia tudo depois de scannear, mas sempre dps q eu reiniciava o computador esse dlwin.exe aparecia dinovo e os cavalos de troia tudinho, aí não dava nem 10segundos e a internet ficava super lenta dinovo, alguem sabe como tirar isso? obrigado

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:12:33, on 29/8/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\Arquivos de programas\Prevx\prevx.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\Arquivos de programas\Prevx\prevx.exe

C:\WINDOWS\system32\csrcs.exe

C:\ARQUIV~1\AVG\AVG8\avgtray.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Sonia\Meus documentos\Downloads\avira_antivir_personal_en.exe

C:\DOCUME~1\Sonia\CONFIG~1\Temp\RarSFX0\basic\presetup.exe

C:\WINDOWS\system32\msiexec.exe

C:\DOCUME~1\Sonia\CONFIG~1\Temp\RarSFX0\basic\setup.exe

C:\DOCUME~1\Sonia\CONFIG~1\Temp\RarSFX0\basic\fact.exe

C:\Documents and Settings\Sonia\Meus documentos\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com'>http://search.live.com"]http://search.live.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.condui...&ctid=CT2233703'>http://search.conduit.com?SearchSource=10&ctid=CT2233703"]http://search.condui...&ctid=CT2233703

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx'>http://search.live.com/sphome.aspx"]http://search.live.com/sphome.aspx

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.3.7.16.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINDOWS\msdrive32.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [sRS Audio Sandbox] "C:\Arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme

O4 - HKCU\..\Run: [12CFG515-K641-55SF-N66P] C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556\pqlmq.exe

O4 - HKCU\..\Run: [12CFG214-K641-11SF-N33P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1077\vslmq.exe

O4 - HKCU\..\RunOnce: [uniblueRegistryBooster] "C:\Arquivos de programas\Uniblue\RegistryBooster 2009\launcher.exe" delay 20000

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\msdrive32.exe

O4 - Global Startup: Inicialização rápida do HP Image Zone.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqthb08.exe

O8 - Extra context menu item: &B&aixar &com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &B&aixar todos os vídeos com o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &B&aixar tudo usando o BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Arquivos de programas\PokerStars.NET\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab'>http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab"]http://messenger.zon...kr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zon...1/GAME_UNO1.cab'>http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/uno1/GAME_UNO1.cab"]http://messenger.zon...1/GAME_UNO1.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab'>http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab"]http://messenger.zon...nt.cab56907.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{29D7C588-2795-4F8D-8EC3-BD52B63F7C7F}: NameServer = 200.165.132.155 200.149.55.142

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\WINDOWS\system32\syst5a.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: CSIScanner - Prevx - C:\Arquivos de programas\Prevx\prevx.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: ServiceLayer - Nokia. - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe

--

End of file - 7927 bytes

esqueci de dizer,to usando um tal de prevx 3.0, mas ele n ta funcionando totalmente pq ta sem a license key e fui tentar instalar o avira mas n ta dando, ta muito lento o pc e a net

Power Max · Agosto 30, 2009

:) Olá Magaiver!

:seta: Sugiro que você salve ou imprima essas instruções abaixo, pois em alguns momentos você poderá precisar usar o computador sem o acesso à internet:

Faça o download do ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e aguarde (o processo total demora cerca de 10 minutos);

3) A janela de “NEGAÇÃO DE GARANTIA DO SOFTWARE” abrir-se-á. Clique em “SIM” para continuar.

4) Outra janela irá abrir, caso a sua máquina não possua o CONSOLE DE RECUPERAÇÃO DO WINDOWS. É recomendável executar a instalação do console antes de dar continuidade ao processo, pois tal ação proporcionará a garantia de que o sistema poderá ser recuperado em caso de problemas durante a varredura.

Clique sobre “SIM” e aguarde, pois o processo de instalação do console dar-se-á automaticamente através do próprio ComboFix. Ele poderá demorar alguns minutos (dependerá da velocidade de sua conexão), portanto seja paciente.

Quando a janela “INSTALANDO O CONSOLE DE RECUPERAÇÃO” aparecer clique em “OK”, depois clique sobre “SIM” para aceitar a licença EULA.

Ao término da instalação do console de recuperação abrir-se-á uma janela avisando que “O CONSOLE DE RECUPERAÇÃO FOI INSTALADO COM SUCESSO”.

Clique sobre “SIM” para continuar a varredura.

5) O ComboFix iniciará o AUTOSCAN (aguarde).

ATENÇÃO: Não clique na janela do ComboFix, nem termine o processo abruptamente enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco).

Ao término do processo a máquina será reiniciada para a emissão do relatório.

6) Ao reiniciar a máquina o ComboFix irá executar o FIND3M para a criação do relatório final da varredura. O log dele estará em C:\ComboFix.txt.

7) Reabilite o seu anti-vírus;

OBS.1: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO ou caso os virus ou malwares bloqueiem a execução do Combofix, baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Neste caso, nomeie-o como Kombofix durante o salvamento e não após salvá-lo!

Em último caso, se não for possível executar o Combofix no Modo Normal do Windows, tente utilizar o ComboFix em MODO SEGURO (reiniciando o computador e pressionando a tecla F8 intermitentemente, ou F5 em alguns casos, durante a inicialização e escolha a opção Modo Seguro na tela que se apresenta) e repita o procedimento;

OBS.2: Caso haja um clique sobre a janela do ComboFix em execução, ela irá MAXIMIZAR, sobrepondo-se sobre as demais. Para minimizá-la novamente basta utilizar a combinação ALT + TAB.

* Se por algum motivo você precisar parar ou sair do ComboFix, tecle "N".

* Se perder a conexão com a internet, reinicie o computador. Caso o problema persista, abra Conexões de Rede no Painel de Controle, clique com o botão direito do mouse sobre a sua conexão com a internet e em "Reparar";

Poste o log do Combofix que estará em C:\ComboFix.txt juntamente com um novo log do Hijackthis em sua próxima resposta e nos diga como está o seu PC depois disto.

Ficamos no aguardo.

MagaiverSlz · Agosto 30, 2009

Boa tarde Antonio

ai vai o log do combofix e do hijackthis, acho que está normal agora, nao apareceu mais o tal dlwin.exe

COMBOFIX

ComboFix 09-08-29.01 - Sonia 30/08/2009 14:44.1.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1023.584 [GMT -3:00]

Executando de: c:\documents and settings\Sonia\Meus documentos\Downloads\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\recycler\S-1-5-21-0214991080-1372334938-256954878-2120

c:\recycler\S-1-5-21-0243636035-3055115376-381863306-1556

c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1077

c:\recycler\S-1-5-21-2904054145-2135275654-952743524-8976

c:\recycler\S-1-5-21-3716410797-9500169992-504536580-2510

c:\recycler\S-1-5-21-3989618986-2161697392-130673376-3520

c:\recycler\S-1-5-21-4104035992-0255226233-870007155-3036

c:\recycler\S-1-5-21-5076726674-0775684204-464705322-1584

c:\recycler\S-1-5-21-6941598196-7589386040-252523708-1174

c:\recycler\S-1-5-21-7354449242-2924216321-506443413-3745

c:\recycler\S-1-5-21-7365854764-3425766093-112156793-7902

c:\windows\msdrive32.exe

c:\windows\system32\_000110_.tmp.dll

c:\windows\system32\Restore\05082009.kp_

c:\windows\system32\Restore\06082009.kp_

c:\windows\system32\Restore\07082009.kp_

c:\windows\system32\Restore\08082009.kp_

c:\windows\system32\Restore\12082009.kp_

c:\windows\system32\Restore\13082009.kp_

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-07-28 to 2009-08-30 ))))))))))))))))))))))))))))

.

2009-08-29 22:03 . 2009-03-30 13:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-08-29 22:03 . 2009-07-28 19:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-08-29 22:03 . 2009-02-13 15:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-08-29 22:03 . 2009-02-13 15:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-08-29 20:13 . 2009-08-29 20:13 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Avira

2009-08-29 20:13 . 2009-08-29 20:13 -------- d-----w- c:\arquivos de programas\Avira

2009-08-29 18:53 . 2009-08-29 18:53 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\Uniblue

2009-08-28 22:55 . 2009-08-29 21:49 -------- d--h--w- C:\$AVG8.VAULT$

2009-08-28 22:46 . 2009-08-28 22:46 -------- d-----w- c:\arquivos de programas\AVG

2009-08-28 22:46 . 2009-08-30 17:37 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8

2009-08-20 20:42 . 2009-08-20 20:42 25214 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{9509674F-3972-11DE-806D-005056806466}\UNINST_Uninstall_G_408FFBEED62349E08B232864A94D2864.exe

2009-08-20 20:42 . 2009-08-20 20:42 25214 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{9509674F-3972-11DE-806D-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe

2009-08-20 20:42 . 2009-08-20 20:42 25214 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{9509674F-3972-11DE-806D-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe

2009-08-20 20:42 . 2009-08-20 20:42 25214 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{9509674F-3972-11DE-806D-005056806466}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe

2009-08-20 20:42 . 2009-08-20 20:42 25214 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{9509674F-3972-11DE-806D-005056806466}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe

2009-08-20 20:42 . 2009-08-20 20:42 25214 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{9509674F-3972-11DE-806D-005056806466}\ARPPRODUCTICON.exe

2009-08-18 23:13 . 2009-08-18 23:13 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\pokerth

2009-08-18 23:09 . 2009-08-18 23:09 -------- d-----w- c:\arquivos de programas\PokerTH

2009-08-18 19:27 . 2009-08-30 16:23 -------- d-----w- C:\ROMS

2009-08-18 19:25 . 2009-08-18 19:25 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\fretsonfire

2009-08-18 16:31 . 2009-08-18 16:31 -------- d-----w- c:\arquivos de programas\Conduit

2009-08-15 16:58 . 2009-08-20 03:00 -------- d-----w- c:\arquivos de programas\PokerStars.NET

2009-08-13 21:02 . 2009-08-13 21:02 332 ----a-w- c:\windows\desctemp.dat

2009-08-13 02:52 . 2009-08-13 02:53 -------- d-----w- C:\ad79cd33f2bf60d5e11857521f2a

2009-08-13 02:52 . 2009-08-13 02:52 -------- d-----w- c:\windows\ServicePackFiles

2009-08-09 01:54 . 2009-08-09 01:54 -------- d-----w- c:\arquivos de programas\Microsoft CAPICOM 2.1.0.2

2009-08-09 01:50 . 2009-08-09 01:50 -------- d-----w- c:\arquivos de programas\MSXML 4.0

2009-08-09 01:49 . 2009-08-09 01:49 -------- d-----r- c:\documents and settings\LocalService\Meus documentos

2009-08-09 00:50 . 2008-10-16 17:06 268648 ----a-w- c:\windows\system32\mucltui.dll

2009-08-09 00:50 . 2008-10-16 17:06 208744 ----a-w- c:\windows\system32\muweb.dll

2009-08-08 23:49 . 2009-08-09 00:23 -------- d-----w- c:\arquivos de programas\MP3Gain

2009-08-08 23:35 . 2004-08-04 02:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys

2009-08-08 23:35 . 2004-08-04 02:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys

2009-08-08 23:35 . 2008-03-21 16:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll

2009-08-08 23:30 . 2009-08-08 23:35 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Suite

2009-08-08 23:00 . 2009-08-08 23:00 -------- d-----w- c:\arquivos de programas\Arquivos comuns\PCSuite

2009-08-08 23:00 . 2009-08-08 23:00 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Nokia

2009-08-08 22:59 . 2009-08-08 22:59 -------- d-----w- c:\arquivos de programas\DIFX

2009-08-08 22:59 . 2008-08-26 13:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys

2009-08-08 22:59 . 2009-08-08 22:59 -------- d-----w- c:\arquivos de programas\PC Connectivity Solution

2009-08-08 22:59 . 2009-02-09 11:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys

2009-08-08 22:59 . 2009-02-09 11:37 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys

2009-08-08 22:59 . 2009-02-09 11:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll

2009-08-08 22:59 . 2009-02-09 11:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys

2009-08-08 22:59 . 2009-02-09 11:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll

2009-08-08 22:59 . 2009-08-08 22:58 33930272 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_por_br.exe

2009-08-08 22:58 . 2009-08-08 22:58 95232 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe

2009-08-08 22:58 . 2009-08-08 22:58 8192 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe

2009-08-08 22:58 . 2009-08-08 22:58 61440 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe

2009-08-08 22:58 . 2009-08-08 22:58 10240 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe

2009-08-08 22:58 . 2009-08-08 22:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Installations

2009-08-08 17:56 . 2009-08-08 17:56 -------- d-----w- c:\arquivos de programas\Pando Networks

2009-08-08 17:46 . 2009-08-08 23:00 -------- d-----w- c:\arquivos de programas\Nokia

2009-08-05 18:26 . 2009-08-05 18:59 -------- d-----w- c:\arquivos de programas\Mobiola Web Camera 2 for S60 2nd Edition

2009-08-05 16:12 . 2004-08-04 02:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys

2009-08-04 23:21 . 2009-08-04 23:21 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Nero

2009-08-04 23:19 . 2000-06-26 13:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll

2009-08-04 23:19 . 2004-07-20 19:24 476320 ------w- c:\windows\system32\ImagXpr7.dll

2009-08-04 23:19 . 2004-07-20 19:24 471040 ------w- c:\windows\system32\ImagXRA7.dll

2009-08-04 23:19 . 2004-07-20 19:24 262144 ------w- c:\windows\system32\ImagXR7.dll

2009-08-04 23:19 . 2004-07-20 19:24 1568768 ------w- c:\windows\system32\ImagX7.dll

2009-08-04 23:19 . 2004-07-09 11:43 364544 ------w- c:\windows\system32\TwnLib4.dll

2009-08-04 23:19 . 2001-06-26 10:15 38912 ------w- c:\windows\system32\picn20.dll

2009-08-04 23:19 . 2009-08-04 23:19 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Ahead

2009-08-04 23:19 . 2001-07-09 13:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

2009-08-04 23:19 . 2009-08-04 23:19 -------- d-----w- c:\arquivos de programas\Ahead

2009-08-04 21:24 . 2009-08-04 21:24 -------- d-----w- c:\arquivos de programas\SRS Labs

2009-08-04 21:20 . 2009-08-29 21:49 -------- d-----w- C:\Downloads

2009-08-04 21:19 . 2009-08-29 22:06 -------- d-----w- c:\arquivos de programas\BitComet

2009-08-04 20:41 . 2009-08-04 20:41 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\SRS Labs

2009-08-04 20:41 . 2007-07-26 12:25 47360 ----a-r- c:\windows\system32\drivers\Surroundhp_kern_i386.sys

2009-08-04 20:41 . 2007-07-26 12:25 39808 ----a-r- c:\windows\system32\drivers\SRS_SSCFilter_i386.sys

2009-08-04 20:41 . 2007-07-26 12:25 42112 ----a-r- c:\windows\system32\drivers\csiidecoder_kern_i386.sys

2009-08-04 20:41 . 2007-07-26 12:25 47104 ----a-r- c:\windows\system32\drivers\tshd4_kern_i386.sys

2009-08-04 20:41 . 2007-07-26 12:25 32000 ----a-r- c:\windows\system32\drivers\wowhd_kern_i386.sys

2009-08-03 21:53 . 2009-08-08 20:15 -------- d-----w- c:\arquivos de programas\Mudinho

2009-08-03 00:17 . 2009-08-19 19:33 -------- d-----w- C:\Internacionais02

2009-08-03 00:06 . 2009-08-19 19:35 -------- d-----w- C:\Internacionais01

2009-08-02 17:44 . 2009-08-02 17:44 -------- d-sh--w- c:\arquivos de programas\RECYCLER

2009-08-02 16:48 . 2009-08-08 15:17 -------- d-----w- c:\arquivos de programas\sender

2009-08-01 17:59 . 2009-08-01 17:59 -------- d-----w- c:\arquivos de programas\Ask.com

2009-08-01 17:59 . 2009-08-02 02:18 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\Desktopicon

2009-08-01 17:59 . 2009-08-25 17:58 -------- d-----w- c:\arquivos de programas\VDOWNLOADER

2009-08-01 04:22 . 2009-08-29 22:18 -------- d-----w- c:\arquivos de programas\dvpls

2009-08-01 03:51 . 2009-08-29 22:18 -------- d-----w- c:\arquivos de programas\dvoss

2009-07-31 18:04 . 2009-08-09 21:58 -------- d-----w- c:\windows\system32\CatRoot_bak

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-28 23:52 . 2009-07-29 23:42 -------- d-----w- c:\arquivos de programas\Windows Media Connect 2

2009-08-25 17:35 . 2009-07-29 23:46 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-08-14 02:42 . 2009-07-29 21:53 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help

2009-08-11 23:19 . 2001-10-28 18:07 61966 ----a-w- c:\windows\system32\perfc016.dat

2009-08-11 23:19 . 2001-10-28 18:07 413812 ----a-w- c:\windows\system32\perfh016.dat

2009-08-08 23:36 . 2009-08-08 23:36 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf

2009-08-08 23:35 . 2009-08-08 23:35 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf

2009-08-08 23:35 . 2009-07-29 22:09 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\PC Suite

2009-08-08 23:35 . 2009-07-29 22:16 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\Nokia

2009-08-08 23:35 . 2009-08-08 23:35 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf

2009-08-08 23:35 . 2009-08-08 23:35 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

2009-08-08 22:59 . 2009-07-29 22:09 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Downloaded Installations

2009-08-08 17:38 . 2009-08-08 17:38 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf

2009-08-07 23:06 . 2009-08-07 23:06 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2009-08-05 09:06 . 2004-08-04 03:45 205312 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-31 16:45 . 2009-07-31 16:45 -------- d-----w- c:\arquivos de programas\Arquivos comuns\xing shared

2009-07-31 16:45 . 2009-07-31 16:45 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Real

2009-07-31 16:45 . 2003-03-18 23:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2009-07-31 16:45 . 2003-02-21 07:42 348160 ----a-w- c:\windows\system32\msvcr71.dll

2009-07-30 21:31 . 2009-07-29 21:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-07-29 23:27 . 2009-07-29 23:27 -------- d-----w- c:\arquivos de programas\Messenger Plus! Live

2009-07-29 23:11 . 2009-07-29 23:11 -------- d-----w- c:\arquivos de programas\Microsoft

2009-07-29 23:11 . 2009-07-29 23:10 -------- d-----w- c:\arquivos de programas\Windows Live

2009-07-29 23:10 . 2009-07-29 23:10 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2009-07-29 22:35 . 2009-07-29 22:35 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-07-29 22:27 . 2009-07-29 22:27 15240 ----a-w- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\IdentityCRL\ppcrlconfig.dll

2009-07-29 22:20 . 2009-07-29 22:20 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\Nokia Multimedia Player

2009-07-29 22:16 . 2009-07-29 22:16 -------- d-----w- c:\documents and settings\Sonia\Dados de aplicativos\Datalayer

2009-07-29 22:05 . 2009-07-29 22:05 0 ----a-w- c:\windows\nsreg.dat

2009-07-29 22:03 . 2009-07-29 22:02 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Bluetooth

2009-07-29 22:01 . 2009-07-29 22:01 -------- d-----w- c:\arquivos de programas\IVT Corporation

2009-07-29 21:57 . 2009-07-29 21:57 -------- d-----w- c:\arquivos de programas\Microsoft Works

2009-07-29 21:57 . 2009-07-29 21:57 -------- d-----w- c:\arquivos de programas\MSBuild

2009-07-29 21:56 . 2009-07-29 21:56 -------- d-----w- c:\arquivos de programas\Microsoft.NET

2009-07-29 21:47 . 2009-07-29 21:35 104311 ----a-w- c:\windows\hpoins04.dat

2009-07-29 21:47 . 2009-07-29 21:36 -------- d-----w- c:\arquivos de programas\HP

2009-07-29 21:45 . 2009-07-29 21:45 -------- d-----w- c:\arquivos de programas\Arquivos comuns\HP

2009-07-29 21:44 . 2009-07-29 21:44 -------- d-----w- c:\arquivos de programas\Hewlett-Packard

2009-07-29 21:44 . 2009-07-29 21:44 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Hewlett-Packard

2009-07-29 21:44 . 2009-07-29 21:44 45056 ----a-r- c:\documents and settings\Sonia\Dados de aplicativos\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe

2009-07-29 21:43 . 2009-07-29 21:43 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Hewlett-Packard

2009-07-29 21:28 . 2009-07-29 21:28 -------- d-----w- c:\arquivos de programas\Attansic

2009-07-29 21:28 . 2009-07-29 21:25 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-07-29 21:25 . 2009-07-29 21:25 -------- d-----w- c:\arquivos de programas\Realtek

2009-07-29 21:25 . 2009-07-29 21:25 315392 ----a-w- c:\windows\HideWin.exe

2009-07-29 21:25 . 2009-07-29 21:25 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-07-29 21:22 . 2009-07-29 21:22 -------- d-----w- c:\arquivos de programas\Intel

2009-07-29 21:11 . 2009-07-29 21:11 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2009-07-29 21:09 . 2009-07-29 21:09 -------- d-----w- c:\arquivos de programas\Serviços on-line

2009-07-29 21:09 . 2009-07-29 21:09 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2009-07-29 21:08 . 2009-07-29 21:08 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-07-17 18:57 . 2004-08-04 03:45 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-14 02:43 . 2004-08-04 03:45 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-06-26 16:18 . 2004-08-04 03:45 661504 ----a-w- c:\windows\system32\wininet.dll

2009-06-26 16:18 . 2004-08-04 03:45 81920 ----a-w- c:\windows\system32\ieencode.dll

2009-06-25 18:36 . 2004-08-04 03:45 95744 ----a-w- c:\windows\system32\mqsec.dll

2009-06-25 18:36 . 2004-08-04 03:45 661504 ----a-w- c:\windows\system32\mqqm.dll

2009-06-25 18:36 . 2004-08-04 03:45 523776 ----a-w- c:\windows\system32\mqutil.dll

2009-06-25 18:36 . 2004-08-04 03:45 517120 ----a-w- c:\windows\system32\mqsnap.dll

2009-06-25 18:36 . 2004-08-04 03:45 48640 ----a-w- c:\windows\system32\mqupgrd.dll

2009-06-25 18:36 . 2004-08-04 03:45 47104 ----a-w- c:\windows\system32\mqdscli.dll

2009-06-25 18:36 . 2004-08-04 03:45 225280 ----a-w- c:\windows\system32\mqoa.dll

2009-06-25 18:36 . 2004-08-04 03:45 186880 ----a-w- c:\windows\system32\mqtrig.dll

2009-06-25 18:36 . 2004-08-04 03:45 177152 ----a-w- c:\windows\system32\mqrt.dll

2009-06-25 18:36 . 2004-08-04 03:45 16896 ----a-w- c:\windows\system32\mqise.dll

2009-06-25 18:36 . 2004-08-04 03:45 138240 ----a-w- c:\windows\system32\mqad.dll

2009-06-25 18:36 . 2004-08-04 03:45 123392 ----a-w- c:\windows\system32\mqrtdep.dll

2009-06-25 08:46 . 2004-08-04 03:45 59392 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:46 . 2004-08-04 03:45 56320 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:46 . 2004-08-04 03:45 168448 ----a-w- c:\windows\system32\schannel.dll

2009-06-25 08:46 . 2004-08-04 03:45 133632 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-25 08:46 . 2004-08-04 03:45 727040 ----a-w- c:\windows\system32\lsasrv.dll

2009-06-25 08:46 . 2004-08-04 03:45 298496 ----a-w- c:\windows\system32\kerberos.dll

2009-06-22 11:49 . 2004-08-04 03:45 19968 ----a-w- c:\windows\system32\mqbkup.exe

2009-06-22 11:49 . 2004-08-04 03:45 117248 ----a-w- c:\windows\system32\mqtgsvc.exe

2009-06-22 11:49 . 2004-08-04 03:45 4608 ----a-w- c:\windows\system32\mqsvc.exe

2009-06-22 11:48 . 2004-08-04 01:58 91776 ----a-w- c:\windows\system32\drivers\mqac.sys

2009-06-22 11:34 . 2004-08-04 01:59 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2009-06-16 23:24 . 2004-08-04 03:45 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:54 . 2001-10-28 18:06 82432 ----a-w- c:\windows\system32\fontsub.dll

2009-06-15 11:33 . 2004-08-04 03:45 77824 ----a-w- c:\windows\system32\telnet.exe

2009-06-15 11:33 . 2004-08-04 03:45 81408 ----a-w- c:\windows\system32\tlntsess.exe

2009-06-10 14:24 . 2004-08-04 03:45 85504 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 06:31 . 2004-08-04 03:45 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-05 07:48 . 2009-07-29 21:07 655872 ----a-w- c:\windows\system32\mstscax.dll

2009-06-03 19:26 . 2004-08-04 03:45 1295360 ----a-w- c:\windows\system32\quartz.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2009-05-19 16:37 1144712 ----a-w- c:\arquivos de programas\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\arquivos de programas\Ask.com\GenericAskToolbar.dll" [2009-05-19 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\arquivos de programas\Ask.com\GenericAskToolbar.dll" [2009-05-19 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

"SRS Audio Sandbox"="c:\arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe" [2009-08-04 3215360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-16 8491008]

"TkBellExe"="c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2009-07-31 198160]

"avgnt"="c:\arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Inicializa‡Æo r pida do HP Image Zone.lnk - c:\arquivos de programas\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\BitComet\\BitComet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"14830:TCP"= 14830:TCP:BitComet 14830 TCP

"14830:UDP"= 14830:UDP:BitComet 14830 UDP

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\Avira\AntiVir Desktop\sched.exe [29/8/2009 19:03 108289]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [29/7/2009 20:11 55152]

R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys --> c:\windows\system32\Drivers\avgtdix.sys [?]

S3 fsssvc;Windows Live Proteção para a Família;c:\arquivos de programas\Windows Live\Family Safety\fsssvc.exe [6/2/2009 18:08 533360]

--- =Outros Serviços/Drivers Na Memória ---

*Deregistered* - AvgLdx86

*Deregistered* - CSIScanner

*Deregistered* - pxscan

*Deregistered* - pxsec

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-08-30 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

- c:\arquivos de programas\Ask.com\UpdateTask.exe [2009-05-19 16:37]

.

- - - - ORFÃOS REMOVIDOS - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKLM-Run-Microsoft Driver Setup - c:\windows\msdrive32.exe

.

------- Scan Suplementar -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2233703

IE: &B&aixar &com o BitComet - c:\arquivos de programas\BitComet\BitComet.exe/AddLink.htm

IE: &B&aixar todos os vídeos com o BitComet - c:\arquivos de programas\BitComet\BitComet.exe/AddVideo.htm

IE: &B&aixar tudo usando o BitComet - c:\arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\arquivos de programas\PokerStars.NET\PokerStarsUpdate.exe

TCP: {29D7C588-2795-4F8D-8EC3-BD52B63F7C7F} = 200.165.132.155 200.149.55.142

FF - ProfilePath - c:\documents and settings\Sonia\Dados de aplicativos\Mozilla\Firefox\Profiles\v6hxzb63.default\

FF - prefs.js: browser.startup.homepage - www.google.com.br

FF - prefs.js: keyword.URL - hxxp://br.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_br&p=

FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll

FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-30 14:47

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_USERS\S-1-5-21-1960408961-1123561945-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{77356F88-6A25-66E4-AF09-19749C398BBB}*]

@Allowed: (Read) (RestrictedCode)

"iaoljkngoilojkciec"=hex:69,61,6e,6f,66,6e,67,6f,70,6c,6b,70,67,69,65,6b,67,64,

00,02

"haedpmchhoadcjjo"=hex:69,61,6e,6f,66,6e,67,6f,70,6c,6b,70,67,69,65,6b,67,64,

00,02

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{77356F88-6A25-66E4-AF09-19749C398BBB}\InProcServer32*]

"faidlhclcfbh"=hex:70,61,6c,6f,65,6d,6f,6c,6c,62,6c,63,70,65,61,61,6e,64,65,64,

6b,6a,63,66,66,6b,66,63,6c,6a,6b,63,00,09

"naidbkdmodgpingljghbikhbgfge"=hex:70,61,6c,6d,69,62,66,68,6e,62,65,66,6f,67,

66,6d,68,65,68,67,6d,6a,61,6e,6a,62,65,61,62,65,6b,6e,00,09

.

Tempo para conclusão: 2009-08-30 14:49

ComboFix-quarantined-files.txt 2009-08-30 17:49

Pré-execução: 11 pasta(s) 55.268.847.616 bytes disponíveis

Pós execução: 11 pasta(s) 55.646.044.160 bytes disponíveis

367 --- E O F --- 2009-08-30 04:32

Aqui vai o log do hijackthis depois q usei o combofix

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:55:05, on 30/8/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\SRS Labs\Audio Sandbox\SRSSSC.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqgalry.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Documents and Settings\Sonia\Meus documentos\Downloads\HiJackThis.exe

C:\WINDOWS\system32\ctfmon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2233703

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet\tools\BitCometBHO_1.3.7.16.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min