[Resolvido!] Suspeita de vírus

[Jackson Dias 68]

Suspeita de vírus.

 

Segue o log:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:15:44, on 21/7/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Vivo 3G\Vivo 3G.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\AVG\AVG9\avgrsx.exe

C:\Arquivos de programas\AVG\AVG9\avgchsvx.exe

C:\Arquivos de programas\AVG\AVG9\avgcsrvx.exe

C:\Arquivos de programas\AVG\AVG9\avgwdsvc.exe

C:\Arquivos de programas\AVG\AVG9\avgnsx.exe

C:\Arquivos de programas\AVG\AVG9\avgemc.exe

C:\Arquivos de programas\AVG\AVG9\avgcsrvx.exe

C:\Arquivos de programas\AVG\AVG9\avgtray.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\rundll32.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\HijackThis\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2567694'>http://search.conduit.com?SearchSource=10&ctid=CT2567694"]http://search.conduit.com?SearchSource=10&ctid=CT2567694

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll

R3 - URLSearchHook: Messenger Plus Live Brazil Toolbar - {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - C:\Arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: Messenger Plus Live Brazil Toolbar - {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - C:\Arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll

O3 - Toolbar: Messenger Plus Live Brazil Toolbar - {edbca961-4bf8-4cbe-8c63-a11dff9ed2d9} - C:\Arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [AVG9_TRAY] C:\ARQUIV~1\AVG\AVG9\avgtray.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\RunOnce: [RegisterHPDeviceDetectionDll] regsvr32.exe /s "C:\Arquivos de programas\HP\Common\HPDeviceDetection.dll"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Winnet] C:\Arquivos de programa\Adobe\PhotoShop\Unistall\csrrs.exe

O4 - HKCU\..\Run: [software Informer] "C:\Arquivos de programas\Software Informer\softinfo.exe" -autorun

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-5/myWebFaceInitialSetup1.0.1.3.cab'>http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-5/myWebFaceInitialSetup1.0.1.3.cab"]http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-5/myWebFaceInitialSetup1.0.1.3.cab

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab'>http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab"]http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab'>http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab"]http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab'>http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab"]http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{64732AC3-BF47-4751-8FBF-CDA0940361E5}: NameServer = 200.220.227.57 200.142.130.203

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG9\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Arquivos de programas\AVG\AVG9\Toolbar\ToolbarBroker.exe

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Arquivos de programas\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Arquivos de programas\AVG\AVG9\avgwdsvc.exe

 

--

End of file - 7576 bytes

 

 

 

Abraço!

[wings 22]

Boa tarde....

 

 

*Baixe o MalwareBytes Anti-malware e salve-o no desktop

*Instale o programa

*Se alguma atualização existir,o download será automático. Aguarde...

*O programa será aberto automaticamente.

*Na aba [Verificação], selecione a opção [Verificação completa]

*Clique em [Verificar] e selecione as partições a serem examinadas (geralmente C:\ e D:\)

*Ao término do scan, poderá ser interrogado se deseja remover objetos da memória. Clique [sIM] > [OK] > [Mostrar Resultados]

*Clique em [Remover Selecionados]

*Um relatório (mbam-log-ano-mês-data.txt) será apresentado.

*Cole-o na sua próxima resposta

[Jackson Dias 68]

Ôpa Wings. Boa Tarde!

Agradeço sua atenção com o meu caso ;)

 

Segue em anexo o log pedido:

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org'>http://www.malwarebytes.org"]www.malwarebytes.org

 

Versão da Base de Dados: 4052

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

22/7/2010 15:02:59

mbam-log-2010-07-22 (15-02-59).txt

 

Tipo de Verificação: Verificação Completa (C:\|D:\|)

Objetos escaneados: 177420

Tempo decorrido: 28 minuto(s), 39 segundo(s)

 

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 15

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 3

Pastas Infectadas: 0

Arquivos Infectados: 8

 

Processos de Memória Infectados:

(Não foram detectados ítens maliciosos)

 

Módulos de Memória Infectados:

(Não foram detectados ítens maliciosos)

 

Chaves de Registro Infectadas:

HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

 

Valores de Registro Infectados:

(Não foram detectados ítens maliciosos)

 

Itens de Dados no Registro Infectados:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Pastas Infectadas:

(Não foram detectados ítens maliciosos)

 

Arquivos Infectados:

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008084.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008085.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008086.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008087.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008088.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008089.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008090.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1B1B1E0B-E41E-4F31-8B15-F1E7D3B8F198}\RP46\A0008127.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

 

 

 

Abraço!

[wings 22]

*Desative temporariamente seu antivírus

 

Iniciar > Programas > AVG

Abra a Interface do usuário do AVG

Clique duas vezes na Proteção Residente

Desmarque a opção "Proteção Residente ativa"

Salve as alterações

*Baixe o ComboFix e salve-o no desktop

 

*Execute o Combofix e aceite o contrato

 

*Se o console de recuperação do Windows já estiver instalado, o ComboFix continuará o processo automaticamente. Caso contrário, clique em [sIM] para a sua instalação.

 

 

*Clique em [sIM] para continuar.

 

 

*Aguarde a conclusão de todas as etapas

 

 

*Enquanto o ComboFix estiver em execução, evite usar o mouse e o teclado!!..... Para interromper o procedimento tecle N ou 2 e depois ENTER.

 

*O programa será fechado automaticamente e um relatório (C:\combofix.txt) será apresentado. Cole-o na próxima resposta.

[Jackson Dias 68]

ComboFix 10-07-22.01 - IsaIca 22/07/2010 19:10:04.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2039.1544 [GMT -3:00]

Executando de: c:\documents and settings\IsaIca\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\windows\Downloaded Program Files\f3initialsetup1.0.1.3.inf

c:\windows\system32\AutoRun.inf

 

.

(((((((((((((((( Arquivos/Ficheiros criados de 2010-06-22 to 2010-07-22 ))))))))))))))))))))))))))))

.

 

2010-07-22 17:32 . 2010-07-22 17:32 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\Malwarebytes

2010-07-22 06:37 . 2010-07-22 06:37 -------- d-----w- c:\windows\system32\KB905474

2010-07-22 06:00 . 2010-07-22 06:00 -------- d-----w- c:\arquivos de programas\MSXML 4.0

2010-07-22 05:15 . 2010-05-06 10:34 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2010-07-22 05:15 . 2010-05-06 10:34 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-07-22 05:15 . 2010-05-06 10:34 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2010-07-22 05:15 . 2010-05-06 10:34 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2010-07-22 05:15 . 2010-05-06 10:34 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2010-07-22 05:15 . 2010-05-06 10:34 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

2010-07-22 05:15 . 2010-05-06 10:34 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll

2010-07-22 02:20 . 2008-04-13 14:45 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys

2010-07-22 02:20 . 2008-04-13 14:45 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys

2010-07-21 18:41 . 2010-07-21 18:41 -------- d-----w- c:\windows\ie8updates

2010-07-21 18:24 . 2010-02-16 19:07 2071040 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-07-21 18:17 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2010-07-21 16:04 . 2008-06-14 17:34 272384 -c----w- c:\windows\system32\dllcache\bthport.sys

2010-07-21 16:04 . 2008-06-14 17:34 272384 ------w- c:\windows\system32\drivers\bthport.sys

2010-07-21 14:13 . 2010-07-21 14:15 -------- d-----w- C:\HijackThis

2010-07-21 12:15 . 2010-07-21 12:15 10134 ----a-r- c:\documents and settings\IsaIca\Dados de aplicativos\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe

2010-07-21 12:15 . 2010-07-21 12:15 -------- d-----w- c:\windows\Downloaded Installations

2010-07-21 11:41 . 2010-07-21 11:41 1615200 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg9\update\backup\avgssie.dll

2010-07-21 11:41 . 2010-07-21 11:41 1107296 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg9\update\backup\avgxpl.dll

2010-07-21 11:41 . 2010-07-21 11:41 921440 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg9\update\backup\avgemc.exe

2010-07-21 11:41 . 2010-07-21 11:41 4368224 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg9\update\backup\avgcorex.dll

2010-07-21 04:11 . 2007-07-27 13:41 26488 ----a-w- c:\windows\system32\spupdsvc.exe

2010-07-21 04:11 . 2010-07-22 13:15 -------- d--h--w- c:\windows\$hf_mig$

2010-07-20 22:14 . 2010-07-20 22:14 -------- d-----w- c:\arquivos de programas\Conduit

2010-07-20 22:14 . 2010-07-20 22:15 -------- d-----w- c:\arquivos de programas\Messenger_Plus_Live_Brazil

2010-07-20 22:14 . 2010-04-21 15:06 52224 ----a-w- c:\documents and settings\IsaIca\Dados de aplicativos\Mozilla\Firefox\Profiles\bdmic5az.default\extensions\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}\components\FFExternalAlert.dll

2010-07-20 22:14 . 2010-04-21 15:06 101376 ----a-w- c:\documents and settings\IsaIca\Dados de aplicativos\Mozilla\Firefox\Profiles\bdmic5az.default\extensions\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}\components\RadioWMPCore.dll

2010-07-17 05:18 . 2010-07-19 15:29 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\Software Informer

2010-07-17 05:18 . 2010-07-17 11:05 -------- d-----w- c:\arquivos de programas\Free Download Manager

2010-07-16 18:52 . 2010-07-18 16:59 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\FileZilla

2010-07-16 16:43 . 2010-07-16 16:43 -------- d-----w- c:\windows\system32\wbem\Repository

2010-07-15 19:05 . 2010-07-16 18:52 -------- d-----w- c:\arquivos de programas\FileZilla FTP Client

2010-07-14 15:09 . 2010-07-14 15:09 -------- d-----w- C:\$AVG

2010-07-13 22:54 . 2010-07-13 22:54 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\AdobeUM

2010-07-13 16:20 . 2010-07-13 16:33 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\PhotoScape

2010-07-13 16:20 . 2010-07-13 16:20 -------- d-----w- c:\arquivos de programas\PhotoScape

2010-07-13 05:01 . 2010-07-13 05:01 -------- d-----w- c:\windows\system32\custom matrices

2010-07-13 05:01 . 2010-07-13 05:01 -------- d-----w- c:\windows\system32\C2MP

2010-07-13 05:01 . 2010-07-13 05:01 -------- d-----w- c:\windows\system32\QuickTime

2010-07-11 12:15 . 2010-07-11 12:30 1687 ----a-w- c:\documents and settings\IsaIca\simdataconf.dll

2010-07-10 14:28 . 2010-07-10 14:28 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\HpUpdate

2010-07-10 14:28 . 2010-07-10 14:28 -------- d-----w- c:\windows\Hewlett-Packard

2010-07-09 15:26 . 2010-07-09 15:26 0 ----a-w- c:\windows\nsreg.dat

2010-07-08 20:25 . 2010-07-08 20:25 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\HPSSUPPLY

2010-07-08 18:54 . 2010-04-19 13:25 2117704 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\AVG Security Toolbar\IEToolbar.dll

2010-07-08 18:36 . 2010-07-08 18:36 109702 ----a-w- c:\windows\hpqins11.dat

2010-07-08 18:13 . 2010-07-08 18:13 12536 ----a-w- c:\windows\system32\avgrsstx.dll

2010-07-08 18:13 . 2010-07-08 18:13 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-08 18:13 . 2010-07-08 18:13 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-07-08 18:13 . 2010-07-22 12:56 -------- d-----w- c:\windows\system32\drivers\Avg

2010-07-08 18:13 . 2010-07-08 18:54 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\AVG Security Toolbar

2010-07-08 18:13 . 2010-07-08 18:13 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-07-08 18:13 . 2010-07-08 18:13 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg9

2010-07-08 18:13 . 2010-07-08 18:13 -------- d-----w- c:\arquivos de programas\AVG

2010-07-07 16:00 . 2010-07-07 16:00 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\HP Product Assistant

2010-07-07 15:53 . 2010-07-11 00:15 126537 ----a-w- c:\windows\hpoins14.dat

2010-07-07 15:53 . 2007-09-20 15:05 1996 ------w- c:\windows\hpomdl14.dat

2010-07-07 14:29 . 2010-07-12 18:22 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\Media Player Classic

2010-07-07 13:46 . 2010-07-08 02:58 -------- d-----w- c:\arquivos de programas\3GPplayer2010

2010-07-07 06:38 . 2010-07-07 06:38 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\HP

2010-07-07 06:08 . 2010-07-07 06:50 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\HP

2010-07-07 06:08 . 2010-07-07 06:08 -------- d-----w- c:\arquivos de programas\Arquivos comuns\HP

2010-07-07 06:07 . 2010-07-07 13:19 -------- d-----w- c:\arquivos de programas\Essentials Codec Pack

2010-07-06 02:05 . 2010-07-07 19:07 -------- d-----w- c:\arquivos de programas\VDownloader

2010-07-06 01:51 . 2010-07-06 01:51 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-22 17:19 . 2008-04-14 12:00 49180 ----a-w- c:\windows\system32\perfc016.dat

2010-07-22 17:19 . 2008-04-14 12:00 345432 ----a-w- c:\windows\system32\perfh016.dat

2010-07-22 12:27 . 2010-06-18 19:13 -------- d-----w- c:\arquivos de programas\Vivo 3G

2010-07-22 00:03 . 2010-06-18 22:02 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe

2010-07-20 22:27 . 2010-06-18 21:45 -------- d-----w- c:\arquivos de programas\Messenger Plus! Live

2010-07-19 11:25 . 2010-06-18 19:13 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo

2010-07-08 20:25 . 2010-06-18 19:38 -------- d-----w- c:\arquivos de programas\HP

2010-07-08 12:20 . 2010-06-18 21:47 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2010-07-07 20:12 . 2010-06-18 22:29 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help

2010-07-07 19:07 . 2010-06-18 18:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\inf

2010-07-07 19:07 . 2010-06-18 20:27 -------- d-----w- c:\arquivos de programas\XP Codec Pack

2010-07-07 19:07 . 2010-06-18 22:55 -------- d-----w- c:\arquivos de programas\Real Alternative

2010-07-07 19:07 . 2010-06-18 19:35 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2010-06-18 22:38 . 2010-06-18 22:34 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\NOS

2010-06-18 22:32 . 2010-06-18 22:32 -------- d-----w- c:\arquivos de programas\Microsoft Works

2010-06-18 22:02 . 2010-06-18 22:02 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Adobe Systems

2010-06-18 22:02 . 2010-06-18 22:02 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe Systems Shared

2010-06-18 21:43 . 2010-06-18 21:43 -------- d-----w- c:\arquivos de programas\Microsoft

2010-06-18 21:43 . 2010-06-18 21:43 -------- d-----w- c:\arquivos de programas\Windows Live

2010-06-18 21:43 . 2010-06-18 21:43 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2010-06-18 20:51 . 2010-06-18 20:51 -------- d-----w- c:\arquivos de programas\Realtek

2010-06-18 20:51 . 2010-06-18 19:13 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2010-06-18 20:20 . 2010-06-18 20:20 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live

2010-06-18 20:04 . 2010-06-18 20:04 -------- d-----w- c:\arquivos de programas\Lavalys

2010-06-18 19:53 . 2010-06-18 19:53 -------- d-----w- c:\arquivos de programas\VS Revo Group

2010-06-18 19:53 . 2010-06-18 19:53 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\Foxit

2010-06-18 19:53 . 2010-06-18 19:53 -------- d-----w- c:\arquivos de programas\Foxit Software

2010-06-18 19:44 . 2010-06-18 17:52 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-06-18 19:38 . 2010-06-18 19:38 -------- d-----w- c:\arquivos de programas\Hewlett-Packard

2010-06-18 19:38 . 2010-06-18 19:38 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Hewlett-Packard

2010-06-18 19:38 . 2010-06-18 19:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Hewlett-Packard

2010-06-18 19:35 . 2010-06-18 19:35 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2010-06-18 19:31 . 2010-06-18 19:31 -------- d-----w- c:\documents and settings\IsaIca\Dados de aplicativos\Nero

2010-06-18 19:30 . 2010-06-18 19:30 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Nero

2010-06-18 19:30 . 2010-06-18 19:30 -------- d-----w- c:\arquivos de programas\Nero

2010-06-18 19:30 . 2010-06-18 19:30 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Nero

2010-06-18 19:21 . 2010-06-18 19:21 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InstallShield

2010-06-18 19:20 . 2010-06-18 19:20 -------- d-----w- c:\arquivos de programas\LG Soft India

2010-06-18 19:20 . 2010-06-18 19:19 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield

2010-06-18 18:49 . 2010-06-18 18:49 -------- d-----w- c:\arquivos de programas\DIFX

2010-06-18 17:58 . 2010-06-18 17:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Innovative Solutions

2010-06-18 17:53 . 2010-06-18 17:53 -------- d-----w- c:\arquivos de programas\microsoft frontpage

2010-06-18 17:52 . 2010-06-18 17:52 -------- d-----w- c:\arquivos de programas\Serviços on-line

2010-06-18 17:51 . 2010-06-18 17:51 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços

2010-06-18 17:50 . 2010-06-18 17:50 21844 ----a-w- c:\windows\system32\emptyregdb.dat

2010-06-14 14:31 . 2010-06-18 17:51 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-05-19 20:59 . 2010-05-19 20:59 150528 ----a-w- c:\windows\system32\mkx.dll

2010-05-19 20:59 . 2010-05-19 20:59 109568 ----a-w- c:\windows\system32\avi.dll

2010-05-19 20:59 . 2010-05-19 20:59 141824 ----a-w- c:\windows\system32\mp4.dll

2010-05-19 20:58 . 2010-05-19 20:58 123392 ----a-w- c:\windows\system32\ogm.dll

2010-05-19 20:58 . 2010-05-19 20:58 113152 ----a-w- c:\windows\system32\dsmux.exe

2010-05-19 20:58 . 2010-05-19 20:58 154112 ----a-w- c:\windows\system32\ts.dll

2010-05-19 20:58 . 2010-05-19 20:58 249856 ----a-w- c:\windows\system32\dxr.dll

2010-05-19 20:57 . 2010-05-19 20:57 97792 ----a-w- c:\windows\system32\avs.dll

2010-05-19 20:57 . 2010-05-19 20:57 137728 ----a-w- c:\windows\system32\mkv2vfr.exe

2010-05-19 20:57 . 2010-05-19 20:57 93184 ----a-w- c:\windows\system32\avss.dll

2010-05-19 20:57 . 2010-05-19 20:57 358400 ----a-w- c:\windows\system32\gdsmux.exe

2010-05-19 20:55 . 2010-05-19 20:55 80384 ----a-w- c:\windows\system32\mkzlib.dll

2010-05-19 20:55 . 2010-05-19 20:55 24576 ----a-w- c:\windows\system32\mkunicode.dll

2010-05-06 10:34 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 08:08 . 2008-04-14 12:00 1851392 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 18:39 . 2010-06-18 19:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 18:39 . 2010-06-18 19:35 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.

 

------- Sigcheck -------

 

[-] 2008-05-19 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

"{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}"= "c:\arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll" [2010-04-15 2515552]

 

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

 

[HKEY_CLASSES_ROOT\clsid\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2010-04-19 13:25 2117704 ----a-w- c:\arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}]

2010-04-15 15:33 2515552 ----a-w- c:\arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

"{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}"= "c:\arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll" [2010-04-15 2515552]

 

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

 

[HKEY_CLASSES_ROOT\clsid\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

"{EDBCA961-4BF8-4CBE-8C63-A11DFF9ED2D9}"= "c:\arquivos de programas\Messenger_Plus_Live_Brazil\tbMess.dll" [2010-04-15 2515552]

 

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

 

[HKEY_CLASSES_ROOT\clsid\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSScheduler"="c:\arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]

"AVG9_TRAY"="c:\arquiv~1\AVG\AVG9\avgtray.exe" [2010-07-08 2065760]

"HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]

"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-07-08 18:13 12536 ----a-w- c:\windows\system32\avgrsstx.dll

 

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^forteManager.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\forteManager.lnk

backup=c:\windows\pss\forteManager.lnkCommon Startup

 

[HKLM\~\startupfolder\C:^Documents and Settings^IsaIca^Menu Iniciar^Programas^Inicializar^Adobe Gamma.lnk]

path=c:\documents and settings\IsaIca\Menu Iniciar\Programas\Inicializar\Adobe Gamma.lnk

backup=c:\windows\pss\Adobe Gamma.lnkStartup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"ose"=3 (0x3)

"odserv"=3 (0x3)

"Adobe LM Service"=3 (0x3)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\AVG\\AVG9\\avgemc.exe"=

"c:\\Arquivos de programas\\AVG\\AVG9\\avgupd.exe"=

"c:\\Arquivos de programas\\AVG\\AVG9\\avgnsx.exe"=

 

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/7/2010 15:13 216400]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/7/2010 15:13 243024]

R2 avg9emc;AVG Free E-mail Scanner;c:\arquivos de programas\AVG\AVG9\avgemc.exe [8/7/2010 15:13 921952]

R2 avg9wd;AVG Free WatchDog;c:\arquivos de programas\AVG\AVG9\avgwdsvc.exe [8/7/2010 15:13 308136]

S0 Shadow;Shadow; [x]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\arquivos de programas\AVG\AVG9\Toolbar\ToolbarBroker.exe [8/7/2010 15:13 430152]

S3 LGDDCDevice;LGDDCDevice;c:\arquivos de programas\LG Soft India\forteManager\bin\I2CDriver.sys [18/6/2010 16:20 14336]

S3 LGII2CDevice;LGII2CDevice;c:\arquivos de programas\LG Soft India\forteManager\bin\PII2CDriver.sys [18/6/2010 16:20 13312]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Conteúdo da pasta 'Tarefas Agendadas'

 

2010-07-22 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2010-07-22 01:18]

 

2010-07-21 c:\windows\Tasks\Windows Codec Update Service.job

- c:\arquivos de programas\Essentials Codec Pack\WECPUpdate.exe [2010-05-30 13:17]

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2567694

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: {64732AC3-BF47-4751-8FBF-CDA0940361E5} = 200.220.227.57 200.142.130.203

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\arquivos de programas\AVG\AVG9\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\IsaIca\Dados de aplicativos\Mozilla\Firefox\Profiles\bdmic5az.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567694&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Messenger Plus Live Brazil Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2567694&SearchSource=13

FF - component: c:\documents and settings\IsaIca\Dados de aplicativos\Mozilla\Firefox\Profiles\bdmic5az.default\extensions\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\IsaIca\Dados de aplicativos\Mozilla\Firefox\Profiles\bdmic5az.default\extensions\{edbca961-4bf8-4cbe-8c63-a11dff9ed2d9}\components\RadioWMPCore.dll

 

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORFÃOS REMOVIDOS - - - -

 

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-Winnet - c:\arquivos de programa\Adobe\PhotoShop\Unistall\csrrs.exe

HKCU-Run-Software Informer - c:\arquivos de programas\Software Informer\softinfo.exe

MSConfigStartUp-Alcmtr - ALCMTR.EXE

MSConfigStartUp-HotKeysCmds - c:\windows\system32\hkcmd.exe

MSConfigStartUp-IgfxTray - c:\windows\system32\igfxtray.exe

MSConfigStartUp-Persistence - c:\windows\system32\igfxpers.exe

MSConfigStartUp-RTHDCPL - RTHDCPL.EXE

MSConfigStartUp-SuNotification - c:\arquivos de programas\ShadowStor\ShadowUser\suatshut.exe

AddRemove-7528B499AC64EC7C6CB65ABC419484B3F9C8D27E - c:\arquiv~1\DIFX\7F01D4C0B2897E27\dpinst.exe

AddRemove-949EC76C8EB99D68F3737ACDCE838E09CC9F30C1 - c:\arquiv~1\DIFX\7F01D4C0B2897E27\dpinst.exe

AddRemove-Curso HJ de Datilografia - c:\hjdatilo\uninst.exe

AddRemove-HDMI - c:\windows\system32\igxpun.exe

AddRemove-RealAlt_is1 - c:\arquivos de programas\Real Alternative\unins000.exe

AddRemove-Windows Essentials Media Codec Pack - c:\arquivos de programas\Essentials Codec Pack\uninst.exe

AddRemove-WinLiveSuite_Wave3 - c:\arquivos de programas\Windows Live\Installer\wlarp.exe

AddRemove-XP Codec Pack - c:\arquivos de programas\XP Codec Pack\Uninstall.exe

 

 

 

**************************************************************************

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos:

 

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Tempo para conclusão: 2010-07-22 19:14:13

ComboFix-quarantined-files.txt 2010-07-22 22:14

 

Pré-execução: 9 pasta(s) 44.800.700.416 bytes disponíveis

Pós execução: 12 pasta(s) 51.172.892.672 bytes disponíveis

 

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

- - End Of File - - 83C5E6C6C79FD28C6F97B88908060500

[wings 22]

OK...log limpo.

 

 

1.

*Clique em [iniciar] > [Executar] > digite: Combofix /uninstall

*Clique [OK]

 

 

*Clique em [Executar]

*Aguarde até surgir a mensagem: "ComboFix está desinstalado"

*Clique [OK]

 

2.

*Clique em [iniciar] > [Executar] > digite: msconfig

*Clique OK

*Clique na aba "BOOT.INI"

*Selecione a linha C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

 

 

*Clique em [Verificar caminhos de inicialização]

*Clique em [sIM] > [OK]

 

 

*Reinicie o PC

*Ao iniciar o Windows, o utilitário de configuração informará que foi alterado.

*Clique em "Não mostrar esta mensagem ou iniciar o utilitário de configuração do sistema ao iniciar o Windows"

 

 

Um abraço.

[Jackson Dias 68]

Opa!

Tranquilo Wings, agradeço a força.

Tinha alguma praga aqui no pc? (se sim o que era?)

 

Abraços!

[wings 22]

Tinha alguma praga aqui no pc? (se sim o que era?)

 

Só um Trojan.FakeAlert -> C:\Windows\System32\autorun.inf

 

e uma entrada no registro referente a um arquivo malicioso que já não estava mais presente no PC:

 

HKCU-Run-Winnet - c:\arquivos de programa\Adobe\PhotoShop\Unistall\csrrs.exe

 

 

Um abraço.

[Jackson Dias 68]

Ah ta, então ta tudo 100%.

Mais uma vez agradeço pela atenção.

 

Abraço!

[wings 22]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.