[Resolvido!] analise do hijackthis

Power Max · Janeiro 2, 2010

:!: Olá! Você esqueceu de seguir estes passos que te indiquei na resposta anterior, siga-os por gentileza e poste os logs pedidos para que possamos analizá-los:

Infelizmente deu problema com o texto do findykill,eu fiz e rodou tudo certo apenas não encontrei na pasta o texto e além de tudo não consegui desinstá-lo como pedia no tutorial.O que devo fazer?

:) Pode deixar para desinstalar as ferramentas só no final do nosso trabalho, quando todos os problemas tiverem sido removidos.

_________________________________________

:) Um problema foi removido pelo Findykill.

_________________________________________

:!: Mas o seu log do Combofix está exatamente igual ao log anterior dele, o que mostra que você não fez este procedimento abaixo, faça ele novamente por gentileza:

:seta: Selecione o texto abaixo dentro do Quote (caixa branca abaixo) e copie para o Bloco de notas (para acessar o Bloco de notas é só ir no menu: Iniciar > Todos os programas > Acessórios > Bloco de notas). Salve-o como CFScript.txt

File::
c:\windows\system32\drivers\utmymjk3.sys

Folder::

c:\documents and settings\Nome\Dados de aplicativos\FKMonitor

C:\LinhaDefensiva

Driver::

utmymjk3

Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

Se solicitado pressione "Enter" para iniciar o processo de remoção;

Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

___________________________________

:seta: Depois disto siga as dicas deste tutorial:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-usbfix.html"]Tutorial do USBFix

Poste o log do Usbfix que estará em C:\UsbFix.txt em sua próxima resposta juntamente com o log que estará em C:\ComboFix.txt e um novo log do Hijackthis e nos diga como está o PC após estes procedimentos.

Ficamos no aguardo.

dal_rezende · Janeiro 2, 2010

Uma pergunta apareceu aqui,se devo atualizar a nova versão do combofix,digo sim ou não?

Power Max · Janeiro 2, 2010

Uma pergunta apareceu aqui,se devo atualizar a nova versão do combofix,digo sim ou não?

:) Sim, é bom atualizá-lo.

dal_rezende · Janeiro 2, 2010

:!: Olá! Você esqueceu de seguir estes passos que te indiquei na resposta anterior, siga-os por gentileza e poste os logs pedidos para que possamos analizá-los:

Infelizmente deu problema com o texto do findykill,eu fiz e rodou tudo certo apenas não encontrei na pasta o texto e além de tudo não consegui desinstá-lo como pedia no tutorial.O que devo fazer?

:) Pode deixar para desinstalar as ferramentas só no final do nosso trabalho, quando todos os problemas tiverem sido removidos.

_________________________________________

:) Um problema foi removido pelo Findykill.

_________________________________________

:!: Mas o seu log do Combofix está exatamente igual ao log anterior dele, o que mostra que você não fez este procedimento abaixo, faça ele novamente por gentileza:

:seta: Selecione o texto abaixo dentro do Quote (caixa branca abaixo) e copie para o Bloco de notas (para acessar o Bloco de notas é só ir no menu: Iniciar > Todos os programas > Acessórios > Bloco de notas). Salve-o como CFScript.txt

File::
c:\windows\system32\drivers\utmymjk3.sys

Folder::

c:\documents and settings\Nome\Dados de aplicativos\FKMonitor

C:\LinhaDefensiva

Driver::

utmymjk3

Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

Se solicitado pressione "Enter" para iniciar o processo de remoção;

Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

___________________________________

:seta: Depois disto siga as dicas deste tutorial:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-usbfix.html"]Tutorial do USBFix

Poste o log do Usbfix que estará em C:\UsbFix.txt em sua próxima resposta juntamente com o log que estará em C:\ComboFix.txt e um novo log do Hijackthis e nos diga como está o PC após estes procedimentos.

Ficamos no aguardo.

ComboFix 10-01-01.05 - Nome 02/01/2010 14:30:18.5.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2038.1547 [GMT -2:00]

Executando de: c:\documents and settings\Nome\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Nome\Desktop\CFScript.txt

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::

"c:\windows\system32\drivers\utmymjk3.sys"

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-02 to 2010-01-02 ))))))))))))))))))))))))))))

.

2010-01-03 07:18 . 2010-01-02 07:56 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2010-01-03 07:18 . 2010-01-02 07:56 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2010-01-03 07:18 . 2010-01-03 07:18 -------- d-----w- c:\arquivos de programas\Kaspersky Lab

2010-01-03 07:18 . 2010-01-02 16:30 196640 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2010-01-03 07:18 . 2010-01-02 16:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab

2010-01-03 07:18 . 2010-01-02 16:14 1605664 --sha-w- c:\windows\system32\drivers\fidbox.dat

2010-01-03 07:17 . 2010-01-03 07:17 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab Setup Files

2010-01-03 03:57 . 2010-01-03 05:16 -------- d-----w- C:\FindyKill

2010-01-02 07:56 . 2010-01-02 07:56 109072 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd3.dll

2010-01-02 07:56 . 2010-01-02 07:56 59920 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd.dll

2010-01-02 07:56 . 2010-01-02 07:56 208616 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe

2010-01-02 07:56 . 2010-01-02 07:56 33808 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys

2010-01-02 07:56 . 2010-01-02 07:56 226832 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys

2010-01-01 14:23 . 2010-01-01 14:23 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

2010-01-01 14:23 . 2010-01-01 14:23 -------- d-sh--w- c:\documents and settings\LocalService\IECompatCache

2010-01-01 13:50 . 2010-01-01 14:25 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-12-31 18:20 . 2009-12-03 18:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-31 18:20 . 2009-12-31 18:20 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-12-31 18:20 . 2009-12-03 18:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-31 16:17 . 2009-12-31 16:17 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Sophos

2009-12-31 16:15 . 2009-12-31 16:15 -------- d-----w- C:\stdtsa

2009-12-30 15:42 . 2009-12-31 16:08 -------- d-----w- c:\documents and settings\Nome\DoctorWeb

2009-12-30 13:08 . 2009-12-30 13:08 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-12-30 13:05 . 2009-12-30 14:16 -------- d-----w- c:\arquivos de programas\Windows Live Safety Center

2009-12-28 18:07 . 2010-01-01 13:51 -------- d-----w- c:\arquivos de programas\Panda Security

2009-12-26 10:55 . 2010-01-01 13:40 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\IObit

2009-12-26 10:55 . 2009-12-26 10:55 -------- d-----w- c:\arquivos de programas\IObit

2009-12-26 10:55 . 2009-11-04 18:49 635664 ----a-w- c:\documents and settings\Nome\Dados de aplicativos\IObit\Common\TB_Helper.exe

2009-12-25 02:50 . 2009-12-25 02:50 -------- d-sh--w- c:\documents and settings\Administrador\PrivacIE

2009-12-25 02:47 . 2009-12-25 02:47 -------- d-sh--w- c:\documents and settings\Administrador\IETldCache

2009-12-25 02:27 . 2009-12-25 02:27 -------- d-----w- c:\arquivos de programas\ToniArts

2009-12-25 02:17 . 2009-12-25 02:21 -------- d-----w- c:\windows\SxsCaPendDel

2009-12-21 04:15 . 2009-12-21 04:15 2951802 ----a-w- c:\arquivos de programas\EClea2_0.exe

2009-12-21 03:54 . 2009-12-21 03:54 3326576 ----a-w- c:\arquivos de programas\ccsetup226.exe

2009-12-21 03:39 . 2009-12-21 03:39 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

2009-12-21 03:38 . 2009-12-21 03:38 1429991 ----a-w- c:\arquivos de programas\mvregclean59-br.zip

2009-12-21 01:58 . 2009-12-31 20:46 -------- d-----w- C:\!KillBox

2009-12-21 01:51 . 2009-12-21 01:51 93696 ----a-w- c:\arquivos de programas\KillBox.exe

2009-12-20 09:12 . 2009-12-20 09:12 178597 ----a-w- c:\arquivos de programas\51942_bankerfix_30.exe

2009-12-19 06:12 . 2009-12-19 06:12 79488 ----a-w- c:\documents and settings\Nome\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-17 07:08 . 2009-12-17 07:08 282 ----a-w- c:\arquivos de programas\iSpQ8ClearLogins.reg

2009-12-07 23:39 . 2009-12-07 23:39 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Malwarebytes

2009-12-07 23:39 . 2009-12-07 23:39 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-12-07 23:29 . 2009-12-07 23:29 -------- d-----w- c:\arquivos de programas\Trend Micro

2009-12-07 23:28 . 2009-12-07 23:28 812344 ----a-w- c:\arquivos de programas\HijackThisInstaller.exe

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-03 04:15 . 2008-04-14 12:00 48628 ----a-w- c:\windows\system32\perfc016.dat

2010-01-03 04:15 . 2008-04-14 12:00 344380 ----a-w- c:\windows\system32\perfh016.dat

2010-01-02 16:29 . 2010-01-03 07:18 1752 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2010-01-02 16:14 . 2010-01-03 07:18 14672 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-01-02 07:57 . 2008-01-29 19:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-12-31 16:08 . 2009-11-25 06:15 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2009-12-24 13:11 . 2009-11-20 19:31 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-12-24 12:48 . 2009-11-20 18:24 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe

2009-12-21 23:21 . 2009-11-25 03:25 -------- d-----w- c:\arquivos de programas\Yahoo!

2009-12-20 09:32 . 2009-11-25 03:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Yahoo!

2009-12-10 19:41 . 2009-11-20 19:27 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-11-28 02:06 . 2009-11-28 02:06 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Media Player Classic

2009-11-25 06:13 . 2009-11-25 06:13 24246400 ----a-w- c:\arquivos de programas\Arquivos comuns\K-Lite_Codec_Pack_544_Mega.exe

2009-11-25 03:58 . 2009-11-25 03:42 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Yahoo!

2009-11-25 03:25 . 2009-11-25 03:25 388624 ----a-w- c:\arquivos de programas\Arquivos comuns\msgr10br.exe

2009-11-24 17:29 . 2009-11-20 19:33 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Ahead

2009-11-23 00:58 . 2009-11-23 00:58 -------- d-----w- c:\arquivos de programas\nanoCom Corporation

2009-11-23 00:58 . 2009-11-23 00:58 8288858 ----a-w- c:\arquivos de programas\ispq8.exe

2009-11-22 23:35 . 2009-11-22 23:35 -------- d-----w- c:\arquivos de programas\Ares

2009-11-22 23:31 . 2009-11-22 23:31 2379745 ----a-w- c:\arquivos de programas\aresregular212_installer.exe

2009-11-22 18:24 . 2009-11-20 18:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-11-21 03:31 . 2009-11-21 03:31 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\CyberLink

2009-11-20 21:25 . 2009-11-20 21:25 -------- d-----w- c:\arquivos de programas\Microsoft

2009-11-20 21:25 . 2009-11-20 21:24 -------- d-----w- c:\arquivos de programas\Windows Live

2009-11-20 21:25 . 2009-11-20 21:25 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2009-11-20 21:23 . 2009-11-20 21:23 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-11-20 21:20 . 2009-11-20 21:20 -------- d-----w- c:\arquivos de programas\Arquivos comuns\snp2std

2009-11-20 21:20 . 2009-11-20 21:20 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\InstallShield

2009-11-20 19:43 . 2009-11-20 19:43 -------- d-----w- c:\arquivos de programas\Realtek

2009-11-20 19:43 . 2009-11-20 19:43 315392 ----a-w- c:\windows\HideWin.exe

2009-11-20 19:43 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-11-20 19:38 . 2009-11-20 19:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Adobe Systems

2009-11-20 19:38 . 2009-11-20 19:38 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe Systems Shared

2009-11-20 19:36 . 2009-11-20 19:36 -------- d-----w- c:\arquivos de programas\Microsoft.NET

2009-11-20 19:35 . 2009-11-20 19:35 -------- d-----w- c:\arquivos de programas\Microsoft Works

2009-11-20 19:33 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Ahead

2009-11-20 19:33 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\PhotoScape

2009-11-20 19:32 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\Nero

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\CyberLink

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\CyberLink

2009-11-20 19:31 . 2009-11-20 19:31 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\Java

2009-11-20 18:25 . 2009-11-20 18:25 -------- d-----w- c:\arquivos de programas\Intel

2009-11-20 18:17 . 2009-11-20 18:17 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2009-11-20 18:16 . 2009-11-20 18:16 -------- d-----w- c:\arquivos de programas\Serviços on-line

2009-11-20 18:16 . 2009-11-20 18:16 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2009-11-20 18:14 . 2009-11-20 18:14 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-11-09 18:00 . 2009-11-25 06:15 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2009-05-19 17:00 . 2009-12-21 03:39 5754 ----a-w- c:\arquivos de programas\historico.txt

2007-10-15 16:13 . 2009-12-21 03:39 1764 ----a-w- c:\arquivos de programas\leiame.txt

2002-11-22 00:20 . 2009-12-21 03:39 51 ----a-w- c:\arquivos de programas\Marcos Velasco Security.url

.

((((((((((((((((((((((((((((( SnapShot@2010-01-02_03.46.33 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-01-02 16:15 . 2010-01-02 16:15 16384 c:\windows\temp\Perflib_Perfdata_3d8.dat

+ 2008-04-14 12:00 . 2010-01-03 04:15 39992 c:\windows\system32\perfc009.dat

- 2008-04-14 12:00 . 2009-11-20 18:21 39992 c:\windows\system32\perfc009.dat

+ 2008-11-11 21:58 . 2008-11-11 21:58 25601 c:\windows\system32\drivers\klopp.dat

+ 2008-04-30 19:06 . 2008-04-30 19:06 24592 c:\windows\system32\drivers\klim5.sys

+ 2008-04-14 12:00 . 2010-01-03 04:15 311604 c:\windows\system32\perfh009.dat

- 2008-04-14 12:00 . 2009-11-20 18:21 311604 c:\windows\system32\perfh009.dat

+ 2008-11-11 22:00 . 2008-11-11 22:00 218376 c:\windows\system32\klogon.dll

+ 2010-01-03 07:18 . 2010-01-02 07:57 226832 c:\windows\system32\drivers\klif.sys

+ 2008-07-21 19:34 . 2008-07-21 19:34 121872 c:\windows\system32\drivers\kl1.sys

+ 2010-01-02 07:42 . 2010-01-02 07:42 2719744 c:\windows\Installer\1385b7.msi

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]

"Advanced SystemCare 3"="c:\arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" [2009-11-20 2335880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-26 166424]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]

"SkyTel"="SkyTel.EXE" [2007-06-15 1826816]

"tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048]

"AVP"="c:\arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2010-01-02 208616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2008-01-26 16:40 137752 ----a-r- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-11-20 19:31 149280 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"wscsvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Ares\\Ares.exe"=

"c:\\Arquivos de programas\\nanoCom Corporation\\iSpQ VideoChat\\iSpQVideoChat8.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/1/2008 17:29 33808]

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [20/11/2009 17:49 38272]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/4/2008 17:06 24592]

.

Conteúdo da pasta 'Tarefas Agendadas'

2010-01-03 c:\windows\Tasks\User_Feed_Synchronization-{4D6F6429-62DC-4CBF-815E-474393257D07}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 06:31]

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-02 14:32

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'explorer.exe'(2460)

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

Tempo para conclusão: 2010-01-02 14:33:37

ComboFix-quarantined-files.txt 2010-01-02 16:33

ComboFix2.txt 2010-01-02 16:09

ComboFix3.txt 2010-01-03 03:44

ComboFix4.txt 2010-01-02 03:48

ComboFix5.txt 2010-01-02 16:29

Pré-execução: 5.413.339.136 bytes disponíveis

Pós execução: 5.380.067.328 bytes disponíveis

- - End Of File - - 34924C5948D18E5DE297CD98CE7E5DF7

Estou fazendo por etapa para não me perder..rs

farei o outro agora..Tutorial do USBFix

Espero ter feito como você me recomendou.

dal_rezende · Janeiro 2, 2010

:!: Olá! Você esqueceu de seguir estes passos que te indiquei na resposta anterior, siga-os por gentileza e poste os logs pedidos para que possamos analizá-los:

Infelizmente deu problema com o texto do findykill,eu fiz e rodou tudo certo apenas não encontrei na pasta o texto e além de tudo não consegui desinstá-lo como pedia no tutorial.O que devo fazer?

:) Pode deixar para desinstalar as ferramentas só no final do nosso trabalho, quando todos os problemas tiverem sido removidos.

_________________________________________

:) Um problema foi removido pelo Findykill.

_________________________________________

:!: Mas o seu log do Combofix está exatamente igual ao log anterior dele, o que mostra que você não fez este procedimento abaixo, faça ele novamente por gentileza:

:seta: Selecione o texto abaixo dentro do Quote (caixa branca abaixo) e copie para o Bloco de notas (para acessar o Bloco de notas é só ir no menu: Iniciar > Todos os programas > Acessórios > Bloco de notas). Salve-o como CFScript.txt

File::
c:\windows\system32\drivers\utmymjk3.sys

Folder::

c:\documents and settings\Nome\Dados de aplicativos\FKMonitor

C:\LinhaDefensiva

Driver::

utmymjk3

Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

Se solicitado pressione "Enter" para iniciar o processo de remoção;

Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

___________________________________

:seta: Depois disto siga as dicas deste tutorial:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-usbfix.html"]Tutorial do USBFix

Poste o log do Usbfix que estará em C:\UsbFix.txt em sua próxima resposta juntamente com o log que estará em C:\ComboFix.txt e um novo log do Hijackthis e nos diga como está o PC após estes procedimentos.

Ficamos no aguardo.

ComboFix 10-01-01.05 - Nome 02/01/2010 14:30:18.5.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2038.1547 [GMT -2:00]

Executando de: c:\documents and settings\Nome\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Nome\Desktop\CFScript.txt

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::

"c:\windows\system32\drivers\utmymjk3.sys"

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-02 to 2010-01-02 ))))))))))))))))))))))))))))

.

2010-01-03 07:18 . 2010-01-02 07:56 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2010-01-03 07:18 . 2010-01-02 07:56 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2010-01-03 07:18 . 2010-01-03 07:18 -------- d-----w- c:\arquivos de programas\Kaspersky Lab

2010-01-03 07:18 . 2010-01-02 16:30 196640 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2010-01-03 07:18 . 2010-01-02 16:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab

2010-01-03 07:18 . 2010-01-02 16:14 1605664 --sha-w- c:\windows\system32\drivers\fidbox.dat

2010-01-03 07:17 . 2010-01-03 07:17 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab Setup Files

2010-01-03 03:57 . 2010-01-03 05:16 -------- d-----w- C:\FindyKill

2010-01-02 07:56 . 2010-01-02 07:56 109072 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd3.dll

2010-01-02 07:56 . 2010-01-02 07:56 59920 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd.dll

2010-01-02 07:56 . 2010-01-02 07:56 208616 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe

2010-01-02 07:56 . 2010-01-02 07:56 33808 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys

2010-01-02 07:56 . 2010-01-02 07:56 226832 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys

2010-01-01 14:23 . 2010-01-01 14:23 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

2010-01-01 14:23 . 2010-01-01 14:23 -------- d-sh--w- c:\documents and settings\LocalService\IECompatCache

2010-01-01 13:50 . 2010-01-01 14:25 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-12-31 18:20 . 2009-12-03 18:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-31 18:20 . 2009-12-31 18:20 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-12-31 18:20 . 2009-12-03 18:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-31 16:17 . 2009-12-31 16:17 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Sophos

2009-12-31 16:15 . 2009-12-31 16:15 -------- d-----w- C:\stdtsa

2009-12-30 15:42 . 2009-12-31 16:08 -------- d-----w- c:\documents and settings\Nome\DoctorWeb

2009-12-30 13:08 . 2009-12-30 13:08 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-12-30 13:05 . 2009-12-30 14:16 -------- d-----w- c:\arquivos de programas\Windows Live Safety Center

2009-12-28 18:07 . 2010-01-01 13:51 -------- d-----w- c:\arquivos de programas\Panda Security

2009-12-26 10:55 . 2010-01-01 13:40 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\IObit

2009-12-26 10:55 . 2009-12-26 10:55 -------- d-----w- c:\arquivos de programas\IObit

2009-12-26 10:55 . 2009-11-04 18:49 635664 ----a-w- c:\documents and settings\Nome\Dados de aplicativos\IObit\Common\TB_Helper.exe

2009-12-25 02:50 . 2009-12-25 02:50 -------- d-sh--w- c:\documents and settings\Administrador\PrivacIE

2009-12-25 02:47 . 2009-12-25 02:47 -------- d-sh--w- c:\documents and settings\Administrador\IETldCache

2009-12-25 02:27 . 2009-12-25 02:27 -------- d-----w- c:\arquivos de programas\ToniArts

2009-12-25 02:17 . 2009-12-25 02:21 -------- d-----w- c:\windows\SxsCaPendDel

2009-12-21 04:15 . 2009-12-21 04:15 2951802 ----a-w- c:\arquivos de programas\EClea2_0.exe

2009-12-21 03:54 . 2009-12-21 03:54 3326576 ----a-w- c:\arquivos de programas\ccsetup226.exe

2009-12-21 03:39 . 2009-12-21 03:39 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

2009-12-21 03:38 . 2009-12-21 03:38 1429991 ----a-w- c:\arquivos de programas\mvregclean59-br.zip

2009-12-21 01:58 . 2009-12-31 20:46 -------- d-----w- C:\!KillBox

2009-12-21 01:51 . 2009-12-21 01:51 93696 ----a-w- c:\arquivos de programas\KillBox.exe

2009-12-20 09:12 . 2009-12-20 09:12 178597 ----a-w- c:\arquivos de programas\51942_bankerfix_30.exe

2009-12-19 06:12 . 2009-12-19 06:12 79488 ----a-w- c:\documents and settings\Nome\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-17 07:08 . 2009-12-17 07:08 282 ----a-w- c:\arquivos de programas\iSpQ8ClearLogins.reg

2009-12-07 23:39 . 2009-12-07 23:39 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Malwarebytes

2009-12-07 23:39 . 2009-12-07 23:39 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-12-07 23:29 . 2009-12-07 23:29 -------- d-----w- c:\arquivos de programas\Trend Micro

2009-12-07 23:28 . 2009-12-07 23:28 812344 ----a-w- c:\arquivos de programas\HijackThisInstaller.exe

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-03 04:15 . 2008-04-14 12:00 48628 ----a-w- c:\windows\system32\perfc016.dat

2010-01-03 04:15 . 2008-04-14 12:00 344380 ----a-w- c:\windows\system32\perfh016.dat

2010-01-02 16:29 . 2010-01-03 07:18 1752 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2010-01-02 16:14 . 2010-01-03 07:18 14672 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-01-02 07:57 . 2008-01-29 19:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-12-31 16:08 . 2009-11-25 06:15 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2009-12-24 13:11 . 2009-11-20 19:31 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-12-24 12:48 . 2009-11-20 18:24 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe

2009-12-21 23:21 . 2009-11-25 03:25 -------- d-----w- c:\arquivos de programas\Yahoo!

2009-12-20 09:32 . 2009-11-25 03:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Yahoo!

2009-12-10 19:41 . 2009-11-20 19:27 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-11-28 02:06 . 2009-11-28 02:06 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Media Player Classic

2009-11-25 06:13 . 2009-11-25 06:13 24246400 ----a-w- c:\arquivos de programas\Arquivos comuns\K-Lite_Codec_Pack_544_Mega.exe

2009-11-25 03:58 . 2009-11-25 03:42 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Yahoo!

2009-11-25 03:25 . 2009-11-25 03:25 388624 ----a-w- c:\arquivos de programas\Arquivos comuns\msgr10br.exe

2009-11-24 17:29 . 2009-11-20 19:33 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Ahead

2009-11-23 00:58 . 2009-11-23 00:58 -------- d-----w- c:\arquivos de programas\nanoCom Corporation

2009-11-23 00:58 . 2009-11-23 00:58 8288858 ----a-w- c:\arquivos de programas\ispq8.exe

2009-11-22 23:35 . 2009-11-22 23:35 -------- d-----w- c:\arquivos de programas\Ares

2009-11-22 23:31 . 2009-11-22 23:31 2379745 ----a-w- c:\arquivos de programas\aresregular212_installer.exe

2009-11-22 18:24 . 2009-11-20 18:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-11-21 03:31 . 2009-11-21 03:31 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\CyberLink

2009-11-20 21:25 . 2009-11-20 21:25 -------- d-----w- c:\arquivos de programas\Microsoft

2009-11-20 21:25 . 2009-11-20 21:24 -------- d-----w- c:\arquivos de programas\Windows Live

2009-11-20 21:25 . 2009-11-20 21:25 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2009-11-20 21:23 . 2009-11-20 21:23 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-11-20 21:20 . 2009-11-20 21:20 -------- d-----w- c:\arquivos de programas\Arquivos comuns\snp2std

2009-11-20 21:20 . 2009-11-20 21:20 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\InstallShield

2009-11-20 19:43 . 2009-11-20 19:43 -------- d-----w- c:\arquivos de programas\Realtek

2009-11-20 19:43 . 2009-11-20 19:43 315392 ----a-w- c:\windows\HideWin.exe

2009-11-20 19:43 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-11-20 19:38 . 2009-11-20 19:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Adobe Systems

2009-11-20 19:38 . 2009-11-20 19:38 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe Systems Shared

2009-11-20 19:36 . 2009-11-20 19:36 -------- d-----w- c:\arquivos de programas\Microsoft.NET

2009-11-20 19:35 . 2009-11-20 19:35 -------- d-----w- c:\arquivos de programas\Microsoft Works

2009-11-20 19:33 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Ahead

2009-11-20 19:33 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\PhotoScape

2009-11-20 19:32 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\Nero

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\CyberLink

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\CyberLink

2009-11-20 19:31 . 2009-11-20 19:31 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\Java

2009-11-20 18:25 . 2009-11-20 18:25 -------- d-----w- c:\arquivos de programas\Intel

2009-11-20 18:17 . 2009-11-20 18:17 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2009-11-20 18:16 . 2009-11-20 18:16 -------- d-----w- c:\arquivos de programas\Serviços on-line

2009-11-20 18:16 . 2009-11-20 18:16 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2009-11-20 18:14 . 2009-11-20 18:14 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-11-09 18:00 . 2009-11-25 06:15 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2009-05-19 17:00 . 2009-12-21 03:39 5754 ----a-w- c:\arquivos de programas\historico.txt

2007-10-15 16:13 . 2009-12-21 03:39 1764 ----a-w- c:\arquivos de programas\leiame.txt

2002-11-22 00:20 . 2009-12-21 03:39 51 ----a-w- c:\arquivos de programas\Marcos Velasco Security.url

.

((((((((((((((((((((((((((((( SnapShot@2010-01-02_03.46.33 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-01-02 16:15 . 2010-01-02 16:15 16384 c:\windows\temp\Perflib_Perfdata_3d8.dat

+ 2008-04-14 12:00 . 2010-01-03 04:15 39992 c:\windows\system32\perfc009.dat

- 2008-04-14 12:00 . 2009-11-20 18:21 39992 c:\windows\system32\perfc009.dat

+ 2008-11-11 21:58 . 2008-11-11 21:58 25601 c:\windows\system32\drivers\klopp.dat

+ 2008-04-30 19:06 . 2008-04-30 19:06 24592 c:\windows\system32\drivers\klim5.sys

+ 2008-04-14 12:00 . 2010-01-03 04:15 311604 c:\windows\system32\perfh009.dat

- 2008-04-14 12:00 . 2009-11-20 18:21 311604 c:\windows\system32\perfh009.dat

+ 2008-11-11 22:00 . 2008-11-11 22:00 218376 c:\windows\system32\klogon.dll

+ 2010-01-03 07:18 . 2010-01-02 07:57 226832 c:\windows\system32\drivers\klif.sys

+ 2008-07-21 19:34 . 2008-07-21 19:34 121872 c:\windows\system32\drivers\kl1.sys

+ 2010-01-02 07:42 . 2010-01-02 07:42 2719744 c:\windows\Installer\1385b7.msi

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]

"Advanced SystemCare 3"="c:\arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" [2009-11-20 2335880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-26 166424]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]

"SkyTel"="SkyTel.EXE" [2007-06-15 1826816]

"tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048]

"AVP"="c:\arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2010-01-02 208616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2008-01-26 16:40 137752 ----a-r- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-11-20 19:31 149280 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"wscsvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Ares\\Ares.exe"=

"c:\\Arquivos de programas\\nanoCom Corporation\\iSpQ VideoChat\\iSpQVideoChat8.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/1/2008 17:29 33808]

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [20/11/2009 17:49 38272]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/4/2008 17:06 24592]

.

Conteúdo da pasta 'Tarefas Agendadas'

2010-01-03 c:\windows\Tasks\User_Feed_Synchronization-{4D6F6429-62DC-4CBF-815E-474393257D07}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 06:31]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-02 14:32

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'explorer.exe'(2460)

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

Tempo para conclusão: 2010-01-02 14:33:37

ComboFix-quarantined-files.txt 2010-01-02 16:33

ComboFix2.txt 2010-01-02 16:09

ComboFix3.txt 2010-01-03 03:44

ComboFix4.txt 2010-01-02 03:48

ComboFix5.txt 2010-01-02 16:29

Pré-execução: 5.413.339.136 bytes disponíveis

Pós execução: 5.380.067.328 bytes disponíveis

- - End Of File - - 34924C5948D18E5DE297CD98CE7E5DF7

Estou fazendo por etapa para não me perder..rs

farei o outro agora..Tutorial do USBFix

Espero ter feito como você me recomendou.

############################## | UsbFix V6.069 |

User : Nome (Administradores) # DESKTOP

Update on 01/01/2010 by El Desaparecido , C_XX & Chimay8

Start at: 14:49:49 | 2/1/2010

Website : http://pagesperso-orange.fr/NosTools/index.html

Contact : FindyKill.Contact@gmail.com

Processador Intel Pentium II

Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3

Internet Explorer 8.0.6001.18702

Windows Firewall Status : Enabled

AV : Kaspersky Anti-Virus 8.0.0.506 [ Enabled | Updated ]

C:\ -> Disco fixo local # 39,06 Go (5,03 Go free) # NTFS

D:\ -> Disco fixo local # 259,02 Go (254,51 Go free) # NTFS

E:\ -> Disco CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS

F:\ -> Disco CD-ROM # 24,29 Mo (0 Mo free) [VIVO INTERNET] # CDFS

H:\ -> Disco removível

############################## | Processos activos |

C:\WINDOWS\System32\smss.exe 908

C:\WINDOWS\system32\csrss.exe 1004

C:\WINDOWS\system32\winlogon.exe 1028

C:\WINDOWS\system32\services.exe 1072

C:\WINDOWS\system32\lsass.exe 1084

C:\WINDOWS\system32\svchost.exe 1248

C:\WINDOWS\system32\svchost.exe 1344

C:\WINDOWS\System32\svchost.exe 1468

C:\WINDOWS\system32\logonui.exe 1604

C:\WINDOWS\system32\svchost.exe 1620

C:\WINDOWS\Explorer.EXE 1968

C:\WINDOWS\system32\spoolsv.exe 2032

C:\WINDOWS\System32\svchost.exe 644

C:\Arquivos de programas\Java\jre6\bin\jqs.exe 680

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE 724

C:\WINDOWS\system32\svchost.exe 800

C:\WINDOWS\system32\wuauclt.exe 1488

C:\WINDOWS\system32\wbem\wmiprvse.exe 988

C:\WINDOWS\System32\alg.exe 2108

################## | Ficheiros # pastas infeciosos |

Supprimido ! D:\Recycler\S-1-5-21-1292428093-1614895754-1177238915-1003

Não supprimido ! F:\autorun.inf

################## | Registro # Chaves infectieuses |

Supprimido ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"

Supprimido ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

Supprimido ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

Supprimido ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoResolveSearch"

################## | Registro # Mountpoints2 |

################## | Listing |

[20/11/2009 16:17|--a------|0] C:\AUTOEXEC.BAT

[29/04/2009 07:02|--a------|270336] C:\bluebirds.exe.back

[01/01/2010 11:29|--a------|211] C:\Boot.bak

[02/01/2010 14:03|-rahs----|281] C:\boot.ini

[14/04/2008 10:00|-rahs----|4952] C:\Bootfont.bin

[03/01/2010 01:29|--a------|160] C:\CFScript.txt

[03/08/2004 23:00|--a------|261856] C:\cmldr

[02/01/2010 14:33|--a------|16264] C:\ComboFix.txt

[20/11/2009 16:17|--a------|0] C:\CONFIG.SYS

[20/11/2009 16:17|-rahs----|0] C:\IO.SYS

[02/01/2010 01:52|--a------|12689] C:\log.txt combofix.txt

[21/12/2009 04:32|--a------|12855] C:\logcombofix.txt

[20/11/2009 16:17|-rahs----|0] C:\MSDOS.SYS

[30/12/2009 17:34|--a------|1758] C:\MSN Virus Removal Log 30_12_2009 17_34_14.txt

[14/04/2008 10:00|-rahs----|47564] C:\NTDETECT.COM

[14/04/2008 10:00|-rahs----|251696] C:\ntldr

[?|?|?] C:\pagefile.sys

[30/12/2009 00:47|--a------|230424] C:\snp2sxp-001.raw

[02/01/2010 14:54|--a------|3233] C:\UsbFix.txt

[15/09/2006 13:21|--a------|675840] C:\vsnp2std.exe.back

[31/12/1994 22:00|-r-------|44] E:\Track01.cda

[31/12/1994 22:05|-r-------|44] E:\Track02.cda

[31/12/1994 22:09|-r-------|44] E:\Track03.cda

[31/12/1994 22:13|-r-------|44] E:\Track04.cda

[31/12/1994 22:18|-r-------|44] E:\Track05.cda

[31/12/1994 22:21|-r-------|44] E:\Track06.cda

[31/12/1994 22:28|-r-------|44] E:\Track07.cda

[31/12/1994 22:30|-r-------|44] E:\Track08.cda

[31/12/1994 22:33|-r-------|44] E:\Track09.cda

[31/12/1994 22:38|-r-------|44] E:\Track10.cda

[31/12/1994 22:44|-r-------|44] E:\Track11.cda

[31/12/1994 22:48|-r-------|44] E:\Track12.cda

[22/08/2009 16:42|-r-------|143360] F:\AutoRun.exe

[25/07/2008 03:35|-r-------|45] F:\AUTORUN.INF

[06/06/2009 20:13|-r-------|94] F:\autorun.sh

[22/08/2009 16:42|-r-------|143360] F:\DataCard_Setup.exe

[22/08/2009 16:43|-r-------|206336] F:\DataCard_Setup64.exe

[02/02/2009 21:15|-r-------|4623] F:\install_linux

[20/02/2008 11:16|-r-------|7168] F:\ResetDevice.exe

[18/05/2009 14:19|-r-------|4286] F:\Startup.ico

[12/10/2009 08:34|-r-------|1357] F:\SysConfig.dat

################## | Vaccinação |

# C:\autorun.inf -> Folder criado por UsbFix.

# D:\autorun.inf -> Folder criado por UsbFix.

################## | Crack > Keygen > Serial |

################## | Upload |

Favor enviar o arquivo : C:\DOCUME~1\Nome\Desktop\UsbFix_Upload_Me_DESKTOP.zip : http://chiquitine.changelog.fr/Sample/Upload.php

Obrigado pela sua contribuição .

agurado o retorno,obrigada

dal_rezende · Janeiro 2, 2010

:!: Olá! Você esqueceu de seguir estes passos que te indiquei na resposta anterior, siga-os por gentileza e poste os logs pedidos para que possamos analizá-los:

Infelizmente deu problema com o texto do findykill,eu fiz e rodou tudo certo apenas não encontrei na pasta o texto e além de tudo não consegui desinstá-lo como pedia no tutorial.O que devo fazer?

:) Pode deixar para desinstalar as ferramentas só no final do nosso trabalho, quando todos os problemas tiverem sido removidos.

_________________________________________

:) Um problema foi removido pelo Findykill.

_________________________________________

:!: Mas o seu log do Combofix está exatamente igual ao log anterior dele, o que mostra que você não fez este procedimento abaixo, faça ele novamente por gentileza:

:seta: Selecione o texto abaixo dentro do Quote (caixa branca abaixo) e copie para o Bloco de notas (para acessar o Bloco de notas é só ir no menu: Iniciar > Todos os programas > Acessórios > Bloco de notas). Salve-o como CFScript.txt

File::
c:\windows\system32\drivers\utmymjk3.sys

Folder::

c:\documents and settings\Nome\Dados de aplicativos\FKMonitor

C:\LinhaDefensiva

Driver::

utmymjk3

Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

Se solicitado pressione "Enter" para iniciar o processo de remoção;

Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

___________________________________

:seta: Depois disto siga as dicas deste tutorial:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-usbfix.html"]Tutorial do USBFix

Poste o log do Usbfix que estará em C:\UsbFix.txt em sua próxima resposta juntamente com o log que estará em C:\ComboFix.txt e um novo log do Hijackthis e nos diga como está o PC após estes procedimentos.

Ficamos no aguardo.

ComboFix 10-01-01.05 - Nome 02/01/2010 14:30:18.5.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2038.1547 [GMT -2:00]

Executando de: c:\documents and settings\Nome\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Nome\Desktop\CFScript.txt

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::

"c:\windows\system32\drivers\utmymjk3.sys"

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-02 to 2010-01-02 ))))))))))))))))))))))))))))

.

2010-01-03 07:18 . 2010-01-02 07:56 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2010-01-03 07:18 . 2010-01-02 07:56 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2010-01-03 07:18 . 2010-01-03 07:18 -------- d-----w- c:\arquivos de programas\Kaspersky Lab

2010-01-03 07:18 . 2010-01-02 16:30 196640 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2010-01-03 07:18 . 2010-01-02 16:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab

2010-01-03 07:18 . 2010-01-02 16:14 1605664 --sha-w- c:\windows\system32\drivers\fidbox.dat

2010-01-03 07:17 . 2010-01-03 07:17 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab Setup Files

2010-01-03 03:57 . 2010-01-03 05:16 -------- d-----w- C:\FindyKill

2010-01-02 07:56 . 2010-01-02 07:56 109072 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd3.dll

2010-01-02 07:56 . 2010-01-02 07:56 59920 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\mzvkbd.dll

2010-01-02 07:56 . 2010-01-02 07:56 208616 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe

2010-01-02 07:56 . 2010-01-02 07:56 33808 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys

2010-01-02 07:56 . 2010-01-02 07:56 226832 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys

2010-01-01 14:23 . 2010-01-01 14:23 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

2010-01-01 14:23 . 2010-01-01 14:23 -------- d-sh--w- c:\documents and settings\LocalService\IECompatCache

2010-01-01 13:50 . 2010-01-01 14:25 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2009-12-31 18:20 . 2009-12-03 18:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-31 18:20 . 2009-12-31 18:20 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2009-12-31 18:20 . 2009-12-03 18:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-31 16:17 . 2009-12-31 16:17 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Sophos

2009-12-31 16:15 . 2009-12-31 16:15 -------- d-----w- C:\stdtsa

2009-12-30 15:42 . 2009-12-31 16:08 -------- d-----w- c:\documents and settings\Nome\DoctorWeb

2009-12-30 13:08 . 2009-12-30 13:08 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-12-30 13:05 . 2009-12-30 14:16 -------- d-----w- c:\arquivos de programas\Windows Live Safety Center

2009-12-28 18:07 . 2010-01-01 13:51 -------- d-----w- c:\arquivos de programas\Panda Security

2009-12-26 10:55 . 2010-01-01 13:40 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\IObit

2009-12-26 10:55 . 2009-12-26 10:55 -------- d-----w- c:\arquivos de programas\IObit

2009-12-26 10:55 . 2009-11-04 18:49 635664 ----a-w- c:\documents and settings\Nome\Dados de aplicativos\IObit\Common\TB_Helper.exe

2009-12-25 02:50 . 2009-12-25 02:50 -------- d-sh--w- c:\documents and settings\Administrador\PrivacIE

2009-12-25 02:47 . 2009-12-25 02:47 -------- d-sh--w- c:\documents and settings\Administrador\IETldCache

2009-12-25 02:27 . 2009-12-25 02:27 -------- d-----w- c:\arquivos de programas\ToniArts

2009-12-25 02:17 . 2009-12-25 02:21 -------- d-----w- c:\windows\SxsCaPendDel

2009-12-21 04:15 . 2009-12-21 04:15 2951802 ----a-w- c:\arquivos de programas\EClea2_0.exe

2009-12-21 03:54 . 2009-12-21 03:54 3326576 ----a-w- c:\arquivos de programas\ccsetup226.exe

2009-12-21 03:39 . 2009-12-21 03:39 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

2009-12-21 03:38 . 2009-12-21 03:38 1429991 ----a-w- c:\arquivos de programas\mvregclean59-br.zip

2009-12-21 01:58 . 2009-12-31 20:46 -------- d-----w- C:\!KillBox

2009-12-21 01:51 . 2009-12-21 01:51 93696 ----a-w- c:\arquivos de programas\KillBox.exe

2009-12-20 09:12 . 2009-12-20 09:12 178597 ----a-w- c:\arquivos de programas\51942_bankerfix_30.exe

2009-12-19 06:12 . 2009-12-19 06:12 79488 ----a-w- c:\documents and settings\Nome\Dados de aplicativos\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-17 07:08 . 2009-12-17 07:08 282 ----a-w- c:\arquivos de programas\iSpQ8ClearLogins.reg

2009-12-07 23:39 . 2009-12-07 23:39 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Malwarebytes

2009-12-07 23:39 . 2009-12-07 23:39 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-12-07 23:29 . 2009-12-07 23:29 -------- d-----w- c:\arquivos de programas\Trend Micro

2009-12-07 23:28 . 2009-12-07 23:28 812344 ----a-w- c:\arquivos de programas\HijackThisInstaller.exe

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-03 04:15 . 2008-04-14 12:00 48628 ----a-w- c:\windows\system32\perfc016.dat

2010-01-03 04:15 . 2008-04-14 12:00 344380 ----a-w- c:\windows\system32\perfh016.dat

2010-01-02 16:29 . 2010-01-03 07:18 1752 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2010-01-02 16:14 . 2010-01-03 07:18 14672 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-01-02 07:57 . 2008-01-29 19:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-12-31 16:08 . 2009-11-25 06:15 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2009-12-24 13:11 . 2009-11-20 19:31 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-12-24 12:48 . 2009-11-20 18:24 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe

2009-12-21 23:21 . 2009-11-25 03:25 -------- d-----w- c:\arquivos de programas\Yahoo!

2009-12-20 09:32 . 2009-11-25 03:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Yahoo!

2009-12-10 19:41 . 2009-11-20 19:27 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-11-28 02:06 . 2009-11-28 02:06 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Media Player Classic

2009-11-25 06:13 . 2009-11-25 06:13 24246400 ----a-w- c:\arquivos de programas\Arquivos comuns\K-Lite_Codec_Pack_544_Mega.exe

2009-11-25 03:58 . 2009-11-25 03:42 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Yahoo!

2009-11-25 03:25 . 2009-11-25 03:25 388624 ----a-w- c:\arquivos de programas\Arquivos comuns\msgr10br.exe

2009-11-24 17:29 . 2009-11-20 19:33 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\Ahead

2009-11-23 00:58 . 2009-11-23 00:58 -------- d-----w- c:\arquivos de programas\nanoCom Corporation

2009-11-23 00:58 . 2009-11-23 00:58 8288858 ----a-w- c:\arquivos de programas\ispq8.exe

2009-11-22 23:35 . 2009-11-22 23:35 -------- d-----w- c:\arquivos de programas\Ares

2009-11-22 23:31 . 2009-11-22 23:31 2379745 ----a-w- c:\arquivos de programas\aresregular212_installer.exe

2009-11-22 18:24 . 2009-11-20 18:16 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-11-21 03:31 . 2009-11-21 03:31 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\CyberLink

2009-11-20 21:25 . 2009-11-20 21:25 -------- d-----w- c:\arquivos de programas\Microsoft

2009-11-20 21:25 . 2009-11-20 21:24 -------- d-----w- c:\arquivos de programas\Windows Live

2009-11-20 21:25 . 2009-11-20 21:25 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2009-11-20 21:23 . 2009-11-20 21:23 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2009-11-20 21:20 . 2009-11-20 21:20 -------- d-----w- c:\arquivos de programas\Arquivos comuns\snp2std

2009-11-20 21:20 . 2009-11-20 21:20 -------- d-----w- c:\documents and settings\Nome\Dados de aplicativos\InstallShield

2009-11-20 19:43 . 2009-11-20 19:43 -------- d-----w- c:\arquivos de programas\Realtek

2009-11-20 19:43 . 2009-11-20 19:43 315392 ----a-w- c:\windows\HideWin.exe

2009-11-20 19:43 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2009-11-20 19:38 . 2009-11-20 19:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Adobe Systems

2009-11-20 19:38 . 2009-11-20 19:38 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe Systems Shared

2009-11-20 19:36 . 2009-11-20 19:36 -------- d-----w- c:\arquivos de programas\Microsoft.NET

2009-11-20 19:35 . 2009-11-20 19:35 -------- d-----w- c:\arquivos de programas\Microsoft Works

2009-11-20 19:33 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Ahead

2009-11-20 19:33 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\PhotoScape

2009-11-20 19:32 . 2009-11-20 19:32 -------- d-----w- c:\arquivos de programas\Nero

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\CyberLink

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\CyberLink

2009-11-20 19:31 . 2009-11-20 19:31 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-11-20 19:31 . 2009-11-20 19:31 -------- d-----w- c:\arquivos de programas\Java

2009-11-20 18:25 . 2009-11-20 18:25 -------- d-----w- c:\arquivos de programas\Intel

2009-11-20 18:17 . 2009-11-20 18:17 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2009-11-20 18:16 . 2009-11-20 18:16 -------- d-----w- c:\arquivos de programas\Serviços on-line

2009-11-20 18:16 . 2009-11-20 18:16 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2009-11-20 18:14 . 2009-11-20 18:14 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2009-11-09 18:00 . 2009-11-25 06:15 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2009-05-19 17:00 . 2009-12-21 03:39 5754 ----a-w- c:\arquivos de programas\historico.txt

2007-10-15 16:13 . 2009-12-21 03:39 1764 ----a-w- c:\arquivos de programas\leiame.txt

2002-11-22 00:20 . 2009-12-21 03:39 51 ----a-w- c:\arquivos de programas\Marcos Velasco Security.url

.

((((((((((((((((((((((((((((( SnapShot@2010-01-02_03.46.33 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-01-02 16:15 . 2010-01-02 16:15 16384 c:\windows\temp\Perflib_Perfdata_3d8.dat

+ 2008-04-14 12:00 . 2010-01-03 04:15 39992 c:\windows\system32\perfc009.dat

- 2008-04-14 12:00 . 2009-11-20 18:21 39992 c:\windows\system32\perfc009.dat

+ 2008-11-11 21:58 . 2008-11-11 21:58 25601 c:\windows\system32\drivers\klopp.dat

+ 2008-04-30 19:06 . 2008-04-30 19:06 24592 c:\windows\system32\drivers\klim5.sys

+ 2008-04-14 12:00 . 2010-01-03 04:15 311604 c:\windows\system32\perfh009.dat

- 2008-04-14 12:00 . 2009-11-20 18:21 311604 c:\windows\system32\perfh009.dat

+ 2008-11-11 22:00 . 2008-11-11 22:00 218376 c:\windows\system32\klogon.dll

+ 2010-01-03 07:18 . 2010-01-02 07:57 226832 c:\windows\system32\drivers\klif.sys

+ 2008-07-21 19:34 . 2008-07-21 19:34 121872 c:\windows\system32\drivers\kl1.sys

+ 2010-01-02 07:42 . 2010-01-02 07:42 2719744 c:\windows\Installer\1385b7.msi

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]

"Advanced SystemCare 3"="c:\arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" [2009-11-20 2335880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-26 166424]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]

"SkyTel"="SkyTel.EXE" [2007-06-15 1826816]

"tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048]

"AVP"="c:\arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2010-01-02 208616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2008-01-26 16:40 137752 ----a-r- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-11-20 19:31 149280 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"wscsvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Ares\\Ares.exe"=

"c:\\Arquivos de programas\\nanoCom Corporation\\iSpQ VideoChat\\iSpQVideoChat8.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/1/2008 17:29 33808]

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [20/11/2009 17:49 38272]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/4/2008 17:06 24592]

.

Conteúdo da pasta 'Tarefas Agendadas'

2010-01-03 c:\windows\Tasks\User_Feed_Synchronization-{4D6F6429-62DC-4CBF-815E-474393257D07}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 06:31]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-02 14:32

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'explorer.exe'(2460)

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

Tempo para conclusão: 2010-01-02 14:33:37

ComboFix-quarantined-files.txt 2010-01-02 16:33

ComboFix2.txt 2010-01-02 16:09

ComboFix3.txt 2010-01-03 03:44

ComboFix4.txt 2010-01-02 03:48

ComboFix5.txt 2010-01-02 16:29

Pré-execução: 5.413.339.136 bytes disponíveis

Pós execução: 5.380.067.328 bytes disponíveis

- - End Of File - - 34924C5948D18E5DE297CD98CE7E5DF7

Estou fazendo por etapa para não me perder..rs

farei o outro agora..Tutorial do USBFix

Espero ter feito como você me recomendou.

############################## | UsbFix V6.069 |

User : Nome (Administradores) # DESKTOP

Update on 01/01/2010 by El Desaparecido , C_XX & Chimay8

Start at: 14:49:49 | 2/1/2010

Website : http://pagesperso-orange.fr/NosTools/index.html

Contact : FindyKill.Contact@gmail.com

Processador Intel Pentium II

Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3

Internet Explorer 8.0.6001.18702

Windows Firewall Status : Enabled

AV : Kaspersky Anti-Virus 8.0.0.506 [ Enabled | Updated ]

C:\ -> Disco fixo local # 39,06 Go (5,03 Go free) # NTFS

D:\ -> Disco fixo local # 259,02 Go (254,51 Go free) # NTFS

E:\ -> Disco CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS

F:\ -> Disco CD-ROM # 24,29 Mo (0 Mo free) [VIVO INTERNET] # CDFS

H:\ -> Disco removível

############################## | Processos activos |

C:\WINDOWS\System32\smss.exe 908

C:\WINDOWS\system32\csrss.exe 1004

C:\WINDOWS\system32\winlogon.exe 1028

C:\WINDOWS\system32\services.exe 1072

C:\WINDOWS\system32\lsass.exe 1084

C:\WINDOWS\system32\svchost.exe 1248

C:\WINDOWS\system32\svchost.exe 1344

C:\WINDOWS\System32\svchost.exe 1468

C:\WINDOWS\system32\logonui.exe 1604

C:\WINDOWS\system32\svchost.exe 1620

C:\WINDOWS\Explorer.EXE 1968

C:\WINDOWS\system32\spoolsv.exe 2032

C:\WINDOWS\System32\svchost.exe 644

C:\Arquivos de programas\Java\jre6\bin\jqs.exe 680

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE 724

C:\WINDOWS\system32\svchost.exe 800

C:\WINDOWS\system32\wuauclt.exe 1488

C:\WINDOWS\system32\wbem\wmiprvse.exe 988

C:\WINDOWS\System32\alg.exe 2108

################## | Ficheiros # pastas infeciosos |

Supprimido ! D:\Recycler\S-1-5-21-1292428093-1614895754-1177238915-1003

Não supprimido ! F:\autorun.inf

################## | Registro # Chaves infectieuses |

Supprimido ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"

Supprimido ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

Supprimido ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"

Supprimido ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoResolveSearch"

################## | Registro # Mountpoints2 |

################## | Listing |

[20/11/2009 16:17|--a------|0] C:\AUTOEXEC.BAT

[29/04/2009 07:02|--a------|270336] C:\bluebirds.exe.back

[01/01/2010 11:29|--a------|211] C:\Boot.bak

[02/01/2010 14:03|-rahs----|281] C:\boot.ini

[14/04/2008 10:00|-rahs----|4952] C:\Bootfont.bin

[03/01/2010 01:29|--a------|160] C:\CFScript.txt

[03/08/2004 23:00|--a------|261856] C:\cmldr

[02/01/2010 14:33|--a------|16264] C:\ComboFix.txt

[20/11/2009 16:17|--a------|0] C:\CONFIG.SYS

[20/11/2009 16:17|-rahs----|0] C:\IO.SYS

[02/01/2010 01:52|--a------|12689] C:\log.txt combofix.txt

[21/12/2009 04:32|--a------|12855] C:\logcombofix.txt

[20/11/2009 16:17|-rahs----|0] C:\MSDOS.SYS

[30/12/2009 17:34|--a------|1758] C:\MSN Virus Removal Log 30_12_2009 17_34_14.txt

[14/04/2008 10:00|-rahs----|47564] C:\NTDETECT.COM

[14/04/2008 10:00|-rahs----|251696] C:\ntldr

[?|?|?] C:\pagefile.sys

[30/12/2009 00:47|--a------|230424] C:\snp2sxp-001.raw

[02/01/2010 14:54|--a------|3233] C:\UsbFix.txt

[15/09/2006 13:21|--a------|675840] C:\vsnp2std.exe.back

[31/12/1994 22:00|-r-------|44] E:\Track01.cda

[31/12/1994 22:05|-r-------|44] E:\Track02.cda

[31/12/1994 22:09|-r-------|44] E:\Track03.cda

[31/12/1994 22:13|-r-------|44] E:\Track04.cda

[31/12/1994 22:18|-r-------|44] E:\Track05.cda

[31/12/1994 22:21|-r-------|44] E:\Track06.cda

[31/12/1994 22:28|-r-------|44] E:\Track07.cda

[31/12/1994 22:30|-r-------|44] E:\Track08.cda

[31/12/1994 22:33|-r-------|44] E:\Track09.cda

[31/12/1994 22:38|-r-------|44] E:\Track10.cda

[31/12/1994 22:44|-r-------|44] E:\Track11.cda

[31/12/1994 22:48|-r-------|44] E:\Track12.cda

[22/08/2009 16:42|-r-------|143360] F:\AutoRun.exe

[25/07/2008 03:35|-r-------|45] F:\AUTORUN.INF

[06/06/2009 20:13|-r-------|94] F:\autorun.sh

[22/08/2009 16:42|-r-------|143360] F:\DataCard_Setup.exe

[22/08/2009 16:43|-r-------|206336] F:\DataCard_Setup64.exe

[02/02/2009 21:15|-r-------|4623] F:\install_linux

[20/02/2008 11:16|-r-------|7168] F:\ResetDevice.exe

[18/05/2009 14:19|-r-------|4286] F:\Startup.ico

[12/10/2009 08:34|-r-------|1357] F:\SysConfig.dat

################## | Vaccinação |

# C:\autorun.inf -> Folder criado por UsbFix.

# D:\autorun.inf -> Folder criado por UsbFix.

################## | Crack > Keygen > Serial |

################## | Upload |

Favor enviar o arquivo : C:\DOCUME~1\Nome\Desktop\UsbFix_Upload_Me_DESKTOP.zip : http://chiquitine.changelog.fr/Sample/Upload.php

Obrigado pela sua contribuição .

agurado o retorno,obrigada

Desculpe me ai vai o resultado do hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:38:01, on 2/1/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe

O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Estatísticas de proteção de tráfego da web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

--

End of file - 5151 bytes

obrigada:)

Power Max · Janeiro 2, 2010

:) Outros problemas foram removidos do seu computador.

:seta: Exclua o arquivo CFScript.txt que está no Desktop (área de trabalho).

Selecione o texto abaixo dentro do Quote (caixa branca abaixo) e copie para o Bloco de notas. Salve-o como CFScript.txt

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000000

Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

Se solicitado pressione "Enter" para iniciar o processo de remoção;

Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

_____________________________________

:seta: Siga também as dicas destes tutoriais:

Tutorial do Flash Disinfector

'>http://dicasetutoriaisparapc.blogspot.com/2008/09/tutorial-do-antivirus-nod32-online.html"]Tutorial do antivirus Nod32 Online

Após o término do escaneamento será gerado um relatório (log) que estará no seguinte local do seu computador:

C:\Arquivos de programas\Eset\Eset Online Scanner\log.txt

Na sua próxima resposta poste este log do Nod32 Online juntamente com o log que estará em C:\ComboFix.txt e um novo log do Hijackthis e nos diga, por gentileza, como está o seu PC após seguir estes procedimentos.

Ficamos no aguardo de sua resposta.

dal_rezende · Janeiro 2, 2010