[Resolvido] &nbspMalware rootkit

[lucasbsp 0]

olá gostaria que vcs me ajudassem a tirar um virus que nao consigo retirar e ja formatei os hds aguardo ancioso obrigado

 

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:53:31, on 11/25/aaaa

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20627)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\VM305_STI.EXE

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Windows Media Player\wmplayer.exe

C:\Documents and Settings\Lucas\Meus documentos\Downloads\HiJackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://so92.com/?

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [uSB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Arquivos de programas\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [bigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ccleaner] "C:\Arquivos de programas\CCleaner\CCleaner.exe" /AUTO

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{8D0E73B4-96AE-4D5B-9CD1-48F0473B9492}: NameServer = 10.0.1.254

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

 

--

End of file - 5671 bytes

[wings 22]

Olá lucasbsp

 

 

*Faça um scan online com o NOD32

 

 

*Ao término cole o relatório criado em C:\Arquivos de programas\EsetOnlineScanner\log

[lucasbsp 0]

Olá Wings fiz o scaneamento lembrando que ele travou em 70% aguardei 1hora e nd depois conclui.

 

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=623a8f04a5d4d84a803ca57c12af8f9c

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-11-26 04:07:53

# local_time=2010-11-26 02:07:53 (-0300, Hora oficial do Brasil)

# country="Brazil"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=52858

# found=6

# cleaned=6

# scan_time=2361

D:\backup\pc cruel\profiles\Downloads\Desflasheando w300i\Programas\Far Manager\Plugins\SEFP\sefp0.10.0.51patch.exe probably a variant of Win32/Agent.NMZPOJA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\programas\sound forge 8.0\keygen - Sound Forge 8.0.exe a variant of Win32/Keygen.AQ application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\Utilitários básicos\nero 7 full\Nero-7.7.5.1_ptb_trial.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\programas\MsgPlusLive-483.exe a variant of Win32/Adware.CiDHelp application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\programas\unlocker1.8.7.exe a variant of Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\programas\nero 7 full\Nero-7.7.5.1_ptb_trial.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C

esets_scanner_update returned -1 esets_gle=53251

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=623a8f04a5d4d84a803ca57c12af8f9c

# end=stopped

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-11-26 05:58:28

# local_time=2010-11-26 03:58:28 (-0300, Hora oficial do Brasil)

# country="Brazil"

# lang=1033

# osver=5.1.2600 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=49884

# found=10

# cleaned=10

# scan_time=6369

D:\backup\DEKSTOP\Downloads\crack + keygen NFS.www.therebels.biz.rar probably a variant of Win32/Agent.BXDOMKW trojan (deleted - quarantined) 00000000000000000000000000000000 C

D:\backup\pc cruel\profiles\Downloads\Desflash_w300i.zip probably a variant of Win32/Agent.NMZPOJA trojan (deleted - quarantined) 00000000000000000000000000000000 C

D:\backup\pc cruel\profiles\Downloads\SETOOL v0.915034.rar a variant of Win32/Packed.Themida application (deleted - quarantined) 00000000000000000000000000000000 C

D:\backup\pc cruel\profiles\Downloads\ultrasurf.zip Win32/UltraReach application (deleted - quarantined) 00000000000000000000000000000000 C

D:\backup\pc cruel\profiles\Downloads\Desflasheando w300i\Programas\Far Manager.zip probably a variant of Win32/Agent.NMZPOJA trojan (deleted - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\Anti-virus\programas para recuperar senhas do msn\systempassrec4134.rar Win32/PassRecovery application (deleted - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\Anti-virus\programas para recuperar senhas do msn\mailpv\mailpv.exe Win32/MailPassView.132 application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\Anti-virus\programas para recuperar senhas do msn\System Password Recovery 4.1.3.4.455 + Serial\setup.exe Win32/PassRecovery application (deleted - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\programas\WinXP keyChanger.exe Win32/PSWTool.RAS.A application (deleted - quarantined) 00000000000000000000000000000000 C

D:\Meus documentos\Pen driver\Utilitários básicos\nero 7 full\Nero.Premium.Edition.v7.0.5.4.Incl.KeyMaker.REPACK-DVT.ZIP probably a variant of Win32/Agent.HZREFUA trojan (deleted - quarantined) 00000000000000000000000000000000 C

[wings 22]

1.

*Desative seu antivírus temporariamente

 

*Baixe o RSIT e salve-o no desktop

*Execute o RSIT e clique [Continue]

*Cole o relatório C:\rsit\log.txt

 

2.

*Baixe o GMER e salve-o no desktop

*Crie uma pasta chamada GMER em C:\ e extraia para lá

*Feche todos os programas ativos (MSN, IE, Firefox, etc...)

*Desative temporariamente o antivírus

*Execute o gmer

*Se receber um aviso sobre atividade de rootkit clique [Não]

*Desmarque

[] IAT/EAT

*Clique [scan] e aguarde. Pode demorar....

*Ao finalizar, clique [save...]

*Salve no desktop como gmer

*Cole o relatório gmer.txt

[lucasbsp 0]

Segue os logs

 

Logfile of random's system information tool 1.08 (written by random/random)

Run by Lucas at 2010-11-26 13:57:06

Microsoft Windows XP Professional Service Pack 2

System drive C: has 67 GB (87%) free of 76 GB

Total RAM: 1023 MB (74% free)

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:57:28, on 11/26/aaaa

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20627)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\VM305_STI.EXE

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Documents and Settings\Lucas\Desktop\RSIT.exe

C:\Arquivos de programas\trend micro\Lucas.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://so92.com/?

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [uSB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Arquivos de programas\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [bigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ccleaner] "C:\Arquivos de programas\CCleaner\CCleaner.exe" /AUTO

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{8D0E73B4-96AE-4D5B-9CD1-48F0473B9492}: NameServer = 10.0.1.254

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

 

--

End of file - 5398 bytes

 

======Scheduled tasks folder======

 

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

 

======Registry dump======

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Auxiliar de Conexão do Windows Live - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll [2010-11-22 41760]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-11-22 79648]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"USB Antivirus"=C:\Arquivos de programas\USB Disk Security\USBGuard.exe [2008-08-16 798720]

"NeroFilterCheck"=C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

"UnlockerAssistant"=C:\Arquivos de programas\Unlocker\UnlockerAssistant.exe [2008-05-02 15872]

"SunJavaUpdateSched"=C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe [2010-02-18 248040]

"BigDog305"=C:\WINDOWS\VM305_STI.EXE [2005-08-05 61440]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-10-10 7286784]

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-10-10 86016]

"Adobe Reader Speed Launcher"=C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]

"Adobe ARM"=C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"=C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]

"ccleaner"=C:\Arquivos de programas\CCleaner\CCleaner.exe [2010-04-23 1668920]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2007-07-21 15360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

nwiz.exe /install []

 

 

Ad-Aware Update (Weekly).job

SA.DAT

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2007-09-02 133632]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoDriveAutoRun"=67108863

"NoDrives"=0

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveAutoRun"=67108863

"NoDriveTypeAutoRun"=323

"NoDrives"=0

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe"="C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe"="C:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

 

======File associations======

 

.inf - open - Notepad.exe "%1"

.ini - open - Notepad.exe "%1"

.js - open - WScript.exe "%1" %*

.txt - open - Notepad.exe "%1"

.vbs - open - WScript.exe "%1" %*

 

======List of files/folders created in the last 1 months======

 

2010-11-26 13:57:06 ----D---- C:\rsit

2010-11-26 13:57:06 ----D---- C:\Arquivos de programas\trend micro

2010-11-26 00:29:44 ----D---- C:\Arquivos de programas\ESET

2010-11-26 00:02:06 ----D---- C:\Nova pasta

2010-11-25 23:31:12 ----A---- C:\mbr.exe

2010-11-25 23:03:01 ----ASH---- C:\hiberfil.sys

2010-11-25 22:18:26 ----SHD---- C:\Config.Msi

2010-11-25 22:18:14 ----D---- C:\WINDOWS\SxsCaPendDel

2010-11-25 21:13:02 ----A---- C:\InfoSat.txt

2010-11-25 04:32:38 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com

2010-11-25 04:32:32 ----D---- C:\Arquivos de programas\SUPERAntiSpyware

2010-11-25 03:57:36 ----SHD---- C:\RECYCLER

2010-11-25 01:46:29 ----A---- C:\ComboFix.txt

2010-11-25 01:22:44 ----D---- C:\WINDOWS\Minidump

2010-11-24 21:01:25 ----D---- C:\Arquivos de programas\ToniArts

2010-11-24 19:40:49 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Adobe

2010-11-24 19:40:02 ----D---- C:\Arquivos de programas\Arquivos comuns\Adobe

2010-11-24 19:40:02 ----D---- C:\Arquivos de programas\Adobe

2010-11-24 15:45:55 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\TeamViewer

2010-11-24 15:45:50 ----D---- C:\Arquivos de programas\TeamViewer

2010-11-24 15:18:03 ----D---- C:\WINDOWS\Sun

2010-11-24 00:58:26 ----D---- C:\Arquivos de programas\GameVicio

2010-11-24 00:48:18 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll

2010-11-24 00:41:04 ----D---- C:\Arquivos de programas\Sierra

2010-11-24 00:16:36 ----A---- C:\WINDOWS\ODBC.INI

2010-11-24 00:16:32 ----A---- C:\WINDOWS\system32\mdimon.dll

2010-11-24 00:15:34 ----D---- C:\Arquivos de programas\Microsoft.NET

2010-11-24 00:15:01 ----D---- C:\Arquivos de programas\Arquivos comuns\DESIGNER

2010-11-24 00:14:49 ----D---- C:\WINDOWS\SHELLNEW

2010-11-24 00:14:46 ----D---- C:\Arquivos de programas\Microsoft Office

2010-11-24 00:13:42 ----RD---- C:\MSOCache

2010-11-23 19:25:01 ----D---- C:\Arquivos de programas\Marcos Velasco Security

2010-11-23 15:16:09 ----A---- C:\WINDOWS\NeroDigital.ini

2010-11-23 15:16:06 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Media Player Classic

2010-11-23 15:07:05 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Malwarebytes

2010-11-23 15:06:56 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes

2010-11-23 13:46:50 ----A---- C:\WINDOWS\system32\CF26396.exe

2010-11-23 13:16:05 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Apple Computer

2010-11-23 13:15:56 ----A---- C:\WINDOWS\system32\rmoc3260.dll

2010-11-23 13:15:56 ----A---- C:\WINDOWS\system32\pndx5032.dll

2010-11-23 13:15:56 ----A---- C:\WINDOWS\system32\pndx5016.dll

2010-11-23 13:15:56 ----A---- C:\WINDOWS\system32\pncrt.dll

2010-11-23 13:15:53 ----A---- C:\WINDOWS\system32\x264vfw.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\xvidvfw.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\xvidcore.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\WMV9VCM.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\ssldivx.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\qt-dx331.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\libdivx.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\dtu100.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\dpl100.dll

2010-11-23 13:15:52 ----A---- C:\WINDOWS\system32\divx.dll

2010-11-23 13:15:51 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest

2010-11-23 13:15:51 ----A---- C:\WINDOWS\system32\ff_vfw.dll

2010-11-23 13:15:50 ----A---- C:\WINDOWS\system32\msvcr71.dll

2010-11-23 13:15:49 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Real

2010-11-23 13:15:49 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Real

2010-11-23 13:15:49 ----D---- C:\Arquivos de programas\K-Lite Codec Pack

2010-11-23 13:15:49 ----A---- C:\WINDOWS\system32\msvcp71.dll

2010-11-23 12:33:54 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2010-11-23 00:44:03 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\TS3Client

2010-11-23 00:42:45 ----D---- C:\Arquivos de programas\TeamSpeak 3 Client

2010-11-22 21:57:40 ----D---- C:\WINDOWS\nview

2010-11-22 21:57:39 ----A---- C:\WINDOWS\system32\nvudisp.exe

2010-11-22 21:57:05 ----D---- C:\WINDOWS\system32\ReinstallBackups

2010-11-22 21:56:24 ----A---- C:\WINDOWS\system32\NVUNINST.EXE

2010-11-22 21:39:49 ----A---- C:\WINDOWS\system32\drivers\NdisIP.sys

2010-11-22 21:39:48 ----A---- C:\WINDOWS\system32\drivers\StreamIP.sys

2010-11-22 21:39:47 ----A---- C:\WINDOWS\system32\drivers\MSTEE.sys

2010-11-22 21:39:46 ----A---- C:\WINDOWS\system32\drivers\SLIP.sys

2010-11-22 21:39:44 ----A---- C:\WINDOWS\system32\drivers\WSTCODEC.SYS

2010-11-22 21:39:43 ----A---- C:\WINDOWS\system32\drivers\NABTSFEC.sys

2010-11-22 21:39:41 ----A---- C:\WINDOWS\system32\drivers\CCDECODE.sys

2010-11-22 21:39:32 ----A---- C:\WINDOWS\system32\vfwwdm32.dll

2010-11-22 21:39:30 ----RA---- C:\WINDOWS\VM305_STI.EXE

2010-11-22 21:39:30 ----RA---- C:\WINDOWS\system32\VM305STI.dll

2010-11-22 21:39:30 ----RA---- C:\WINDOWS\system32\drivers\usbVM305.sys

2010-11-22 21:39:30 ----R---- C:\WINDOWS\Zoom.exe

2010-11-22 21:39:30 ----R---- C:\WINDOWS\VMPipe.dll

2010-11-22 21:39:29 ----RA---- C:\WINDOWS\amcap.exe

2010-11-22 21:39:29 ----D---- C:\WINDOWS\EffectResources

2010-11-22 21:39:29 ----A---- C:\WINDOWS\VM303UninstNT.exe

2010-11-22 21:33:50 ----HD---- C:\WINDOWS\PIF

2010-11-22 19:30:12 ----D---- C:\Arquivos de programas\FlashGet

2010-11-22 17:24:17 ----D---- C:\Arquivos de programas\FlashGet Network

2010-11-22 16:05:55 ----D---- C:\Arquivos de programas\xerox

2010-11-22 16:05:54 ----D---- C:\WINDOWS\system32\xircom

2010-11-22 16:05:54 ----D---- C:\Arquivos de programas\microsoft frontpage

2010-11-22 16:01:06 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Sun

2010-11-22 16:01:06 ----D---- C:\Arquivos de programas\Arquivos comuns\Java

2010-11-22 16:00:41 ----A---- C:\WINDOWS\system32\javaws.exe

2010-11-22 16:00:41 ----A---- C:\WINDOWS\system32\javaw.exe

2010-11-22 16:00:41 ----A---- C:\WINDOWS\system32\java.exe

2010-11-22 16:00:41 ----A---- C:\WINDOWS\system32\deploytk.dll

2010-11-22 16:00:28 ----D---- C:\Arquivos de programas\Java

2010-11-22 16:00:06 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Sun

2010-11-22 15:10:04 ----D---- C:\WINDOWS\temp

2010-11-22 15:04:04 ----A---- C:\WINDOWS\libem.INI

2010-11-22 15:04:00 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\FlashGet

2010-11-22 15:03:55 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\FlashGetBHO

2010-11-22 15:02:22 ----D---- C:\Arquivos de programas\CCleaner

2010-11-22 14:50:06 ----A---- C:\WINDOWS\system32\spupdsvc.exe

2010-11-22 14:49:01 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Windows Genuine Advantage

2010-11-22 14:44:31 ----D---- C:\Arquivos de programas\Unlocker

2010-11-22 14:40:37 ----D---- C:\Arquivos de programas\VS Revo Group

2010-11-22 14:38:58 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\BITS

2010-11-22 14:38:47 ----D---- C:\profiles

2010-11-22 14:32:37 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Ahead

2010-11-22 14:31:35 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2010-11-22 14:31:35 ----D---- C:\Arquivos de programas\Nero

2010-11-22 14:31:35 ----D---- C:\Arquivos de programas\Arquivos comuns\Ahead

2010-11-22 14:30:22 ----A---- C:\WINDOWS\system32\d3dx9_30.dll

2010-11-22 14:30:21 ----A---- C:\WINDOWS\system32\d3dx9_28.dll

2010-11-21 11:56:05 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Macromedia

2010-11-21 11:56:04 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Adobe

2010-11-21 11:55:28 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Mozilla

2010-11-21 11:42:43 ----D---- C:\Documents and Settings\Lucas\Dados de aplicativos\Identities

2010-11-21 11:42:19 ----SD---- C:\Documents and Settings\Lucas\Dados de aplicativos\Microsoft

2010-11-21 11:42:19 ----ASH---- C:\Documents and Settings\Lucas\Dados de aplicativos\desktop.ini

2010-11-21 11:41:27 ----D---- C:\WINDOWS\Prefetch

2010-11-21 11:39:25 ----D---- C:\WINDOWS\system32\dllcache

2010-11-21 11:38:53 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest

2010-11-21 11:33:01 ----A---- C:\WINDOWS\system32\drivers\fetnd5.sys

2010-11-21 09:43:11 ----A---- C:\WINDOWS\system32\drivers\SBREDrv.sys

2010-11-21 09:24:02 ----ASH---- C:\pagefile.sys

2010-11-21 08:42:59 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Lavasoft

2010-11-21 05:23:00 ----D---- C:\WINDOWS\ERDNT

2010-11-21 04:04:56 ----D---- C:\Arquivos de programas\Mozilla Firefox

2010-11-21 04:01:30 ----D---- C:\Arquivos de programas\Microsoft

2010-11-21 04:01:17 ----D---- C:\Arquivos de programas\Windows Live SkyDrive

2010-11-21 04:00:57 ----D---- C:\Arquivos de programas\Windows Live

2010-11-21 03:59:41 ----D---- C:\Arquivos de programas\Arquivos comuns\Windows Live

2010-11-21 03:58:33 ----D---- C:\WINDOWS\pss

2010-11-21 03:52:06 ----D---- C:\Arquivos de programas\USB Disk Security

2010-11-21 03:51:50 ----A---- C:\WINDOWS\system32\drivers\AegisP.sys

2010-11-21 03:51:46 ----DC---- C:\WINDOWS\system32\DRVSTORE

2010-11-21 03:51:39 ----A---- C:\WINDOWS\system32\Install6x.dll

2010-11-21 03:51:39 ----A---- C:\WINDOWS\system32\drivers\rt61.sys

2010-11-21 03:51:39 ----A---- C:\WINDOWS\system32\AegisI5.exe

2010-11-21 03:51:32 ----D---- C:\Arquivos de programas\RALINK

2010-11-21 03:49:56 ----D---- C:\Arquivos de programas\WinRAR

2010-11-21 03:49:11 ----A---- C:\WINDOWS\system32\drivers\splitter.sys

2010-11-21 03:49:10 ----A---- C:\WINDOWS\system32\drivers\DMusic.sys

2010-11-21 03:47:36 ----N---- C:\WINDOWS\system32\ksuser.dll

2010-11-21 03:47:34 ----A---- C:\WINDOWS\system32\wdmioctl.dll

2010-11-21 03:47:34 ----A---- C:\WINDOWS\system32\drivers\smsens.sys

2010-11-21 03:47:34 ----A---- C:\WINDOWS\system32\drivers\aeaudio.sys

2010-11-21 03:47:33 ----A---- C:\WINDOWS\system32\SMMedia.dll

2010-11-21 03:47:32 ----A---- C:\WINDOWS\SynthCoreA.Dll

2010-11-21 03:47:32 ----A---- C:\WINDOWS\SynCor.exe

2010-11-21 03:47:31 ----A---- C:\WINDOWS\system32\SynthCore11Resources.dll

2010-11-21 03:47:31 ----A---- C:\WINDOWS\system32\Syncor11.dll

2010-11-21 03:47:31 ----A---- C:\WINDOWS\system32\S11thk32.dll

2010-11-21 03:47:28 ----D---- C:\WINDOWS\VirtualEar

2010-11-21 03:47:28 ----A---- C:\WINDOWS\system32\Audio3d.dll

2010-11-21 03:47:27 ----A---- C:\WINDOWS\system32\virtear.dll

2010-11-21 03:47:26 ----D---- C:\Arquivos de programas\Analog Devices

2010-11-21 03:47:26 ----A---- C:\WINDOWS\system32\drivers\smwdm.sys

2010-11-21 03:47:26 ----A---- C:\WINDOWS\system32\CleanUp.exe

2010-11-21 03:47:26 ----A---- C:\WINDOWS\system32\a3d.dll

2010-11-21 03:47:25 ----HD---- C:\Arquivos de programas\InstallShield Installation Information

2010-11-21 03:47:25 ----A---- C:\WINDOWS\system32\DSndUp.exe

2010-11-21 03:47:17 ----D---- C:\Arquivos de programas\Arquivos comuns\InstallShield

2010-11-21 03:47:02 ----A---- C:\WINDOWS\Ascd_tmp.ini

2010-11-21 03:46:59 ----A---- C:\WINDOWS\system32\drivers\ASUSHWIO.SYS

2010-11-21 03:45:46 ----HD---- C:\Arquivos de programas\Uninstall Information

2010-11-21 03:40:21 ----D---- C:\WINDOWS\SoftwareDistribution

2010-11-21 03:40:20 ----SD---- C:\WINDOWS\system32\Microsoft

2010-11-21 03:40:20 ----N---- C:\WINDOWS\SchedLgU.Txt

2010-11-21 03:39:01 ----A---- C:\WINDOWS\system32\tzchange.exe

2010-11-21 03:38:58 ----HD---- C:\WINDOWS\$hf_mig$

2010-11-21 03:38:51 ----N---- C:\WINDOWS\system32\spmsg.dll

2010-11-21 03:38:45 ----D---- C:\Arquivos de programas\MSXML 6.0

2010-11-21 03:38:42 ----D---- C:\Arquivos de programas\MSXML 4.0

2010-11-21 03:38:34 ----RASH---- C:\MSDOS.SYS

2010-11-21 03:38:34 ----RASH---- C:\IO.SYS

2010-11-21 03:38:34 ----A---- C:\WINDOWS\control.ini

2010-11-21 03:38:34 ----A---- C:\CONFIG.SYS

2010-11-21 03:38:34 ----A---- C:\AUTOEXEC.BAT

2010-11-21 03:38:22 ----A---- C:\WINDOWS\system32\mapi32.dll

2010-11-21 03:37:37 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest

2010-11-21 03:37:33 ----HD---- C:\Arquivos de programas\WindowsUpdate

2010-11-21 03:37:32 ----D---- C:\Arquivos de programas\Serviços on-line

2010-11-21 03:37:14 ----D---- C:\WINDOWS\system32\DirectX

2010-11-21 03:36:42 ----A---- C:\WINDOWS\system32\atrace.dll

2010-11-21 03:36:38 ----A---- C:\WINDOWS\system32\desktop.ini

2010-11-21 03:36:38 ----A---- C:\WINDOWS\desktop.ini

2010-11-21 03:36:28 ----A---- C:\WINDOWS\system32\nmevtmsg.dll

2010-11-21 03:36:26 ----A---- C:\WINDOWS\system32\acctres.dll

2010-11-21 03:36:25 ----D---- C:\Arquivos de programas\Arquivos comuns\Serviços

2010-11-21 03:36:21 ----SD---- C:\WINDOWS\Tasks

2010-11-21 03:36:21 ----A---- C:\WINDOWS\system32\icfgnt5.dll

2010-11-21 03:36:19 ----D---- C:\Arquivos de programas\Arquivos comuns\MSSoap

2010-11-21 03:36:13 ----D---- C:\WINDOWS\srchasst

2010-11-21 03:36:11 ----D---- C:\WINDOWS\system32\Macromed

2010-11-21 03:36:09 ----A---- C:\WINDOWS\system32\wuweb.dll

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wups.dll

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wucltui.dll

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wuauserv.dll

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wuaueng1.dll

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wuaueng.dll

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wuauclt1.exe

2010-11-21 03:36:08 ----A---- C:\WINDOWS\system32\wuauclt.exe

2010-11-21 03:36:07 ----A---- C:\WINDOWS\system32\wuapi.dll

2010-11-21 03:36:07 ----A---- C:\WINDOWS\system32\qmgrprxy.dll

2010-11-21 03:36:07 ----A---- C:\WINDOWS\system32\qmgr.dll

2010-11-21 03:36:07 ----A---- C:\WINDOWS\system32\bitsprx3.dll

2010-11-21 03:36:07 ----A---- C:\WINDOWS\system32\bitsprx2.dll

2010-11-21 03:36:02 ----D---- C:\Arquivos de programas\Movie Maker

2010-11-21 03:35:54 ----A---- C:\WINDOWS\system32\safrslv.dll

2010-11-21 03:35:54 ----A---- C:\WINDOWS\system32\safrdm.dll

2010-11-21 03:35:54 ----A---- C:\WINDOWS\system32\safrcdlg.dll

2010-11-21 03:35:54 ----A---- C:\WINDOWS\system32\racpldlg.dll

2010-11-21 03:35:49 ----A---- C:\WINDOWS\system32\fltMc.exe

2010-11-21 03:35:49 ----A---- C:\WINDOWS\system32\fltlib.dll

2010-11-21 03:35:49 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys

2010-11-21 03:35:48 ----D---- C:\WINDOWS\system32\Restore

2010-11-21 03:35:48 ----A---- C:\WINDOWS\system32\srsvc.dll

2010-11-21 03:35:48 ----A---- C:\WINDOWS\system32\srrstr.dll

2010-11-21 03:35:48 ----A---- C:\WINDOWS\system32\srclient.dll

2010-11-21 03:35:48 ----A---- C:\WINDOWS\system32\drivers\sr.sys

2010-11-21 03:35:47 ----A---- C:\WINDOWS\system32\mnmdd.dll

2010-11-21 03:35:47 ----A---- C:\WINDOWS\system32\isrdbg32.dll

2010-11-21 03:35:47 ----A---- C:\WINDOWS\system32\ils.dll

2010-11-21 03:35:46 ----A---- C:\WINDOWS\system32\nmmkcert.dll

2010-11-21 03:35:46 ----A---- C:\WINDOWS\system32\msconf.dll

2010-11-21 03:35:46 ----A---- C:\WINDOWS\system32\mnmsrvc.exe

2010-11-21 03:35:42 ----D---- C:\Arquivos de programas\NetMeeting

2010-11-21 03:35:41 ----A---- C:\WINDOWS\system32\msoert2.dll

2010-11-21 03:35:41 ----A---- C:\WINDOWS\system32\msoeacct.dll

2010-11-21 03:35:40 ----A---- C:\WINDOWS\system32\inetres.dll

2010-11-21 03:35:39 ----A---- C:\WINDOWS\system32\inetcomm.dll

2010-11-21 03:35:37 ----D---- C:\Arquivos de programas\Outlook Express

2010-11-21 03:35:37 ----A---- C:\WINDOWS\system32\schedsvc.dll

2010-11-21 03:35:37 ----A---- C:\WINDOWS\system32\mstinit.exe

2010-11-21 03:35:37 ----A---- C:\WINDOWS\system32\mstask.dll

2010-11-21 03:35:36 ----A---- C:\WINDOWS\system32\icwphbk.dll

2010-11-21 03:35:36 ----A---- C:\WINDOWS\system32\icwdial.dll

2010-11-21 03:35:35 ----A---- C:\WINDOWS\system32\isign32.dll

2010-11-21 03:35:35 ----A---- C:\WINDOWS\system32\inetcfg.dll

2010-11-21 03:35:27 ----D---- C:\Arquivos de programas\Arquivos comuns\System

2010-11-21 03:35:25 ----D---- C:\Arquivos de programas\Internet Explorer

2010-11-21 03:34:59 ----D---- C:\Arquivos de programas\ComPlus Applications

2010-11-21 03:34:59 ----A---- C:\WINDOWS\vbaddin.ini

2010-11-21 03:34:59 ----A---- C:\WINDOWS\vb.ini

2010-11-21 03:34:58 ----D---- C:\WINDOWS\Registration

2010-11-21 03:34:53 ----D---- C:\Arquivos de programas\Windows Media Connect 2

2010-11-21 03:34:51 ----D---- C:\Arquivos de programas\Windows Media Player

2010-11-21 03:34:49 ----D---- C:\Arquivos de programas\Messenger

2010-11-21 03:34:43 ----D---- C:\Arquivos de programas\MSN Gaming Zone

2010-11-21 03:34:43 ----A---- C:\WINDOWS\system32\write.exe

2010-11-21 03:34:30 ----A---- C:\WINDOWS\system32\sndvol32.exe

2010-11-21 03:34:29 ----A---- C:\WINDOWS\system32\hticons.dll

2010-11-21 03:34:29 ----A---- C:\WINDOWS\system32\avwav.dll

2010-11-21 03:34:29 ----A---- C:\WINDOWS\system32\avtapi.dll

2010-11-21 03:34:29 ----A---- C:\WINDOWS\system32\avmeter.dll

2010-11-21 03:34:28 ----A---- C:\WINDOWS\system32\winchat.exe

2010-11-21 03:34:18 ----A---- C:\WINDOWS\system32\getuname.dll

2010-11-21 03:34:18 ----A---- C:\WINDOWS\system32\charmap.exe

2010-11-21 03:34:17 ----A---- C:\WINDOWS\system32\winmine.exe

2010-11-21 03:34:17 ----A---- C:\WINDOWS\system32\sol.exe

2010-11-21 03:34:17 ----A---- C:\WINDOWS\system32\calc.exe

2010-11-21 03:34:16 ----A---- C:\WINDOWS\system32\reset.exe

2010-11-21 03:34:16 ----A---- C:\WINDOWS\system32\mshearts.exe

2010-11-21 03:34:16 ----A---- C:\WINDOWS\system32\freecell.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\usrlogon.cmd

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\tsshutdn.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\tslabels.ini

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\tskill.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\tsdiscon.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\tscon.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\shadow.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\rwinsta.exe

2010-11-21 03:34:15 ----A---- C:\WINDOWS\system32\regini.exe

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\rdpcfgex.dll

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\qwinsta.exe

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\qappsrv.exe

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\msg.exe

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\msdtcprf.ini

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\logoff.exe

2010-11-21 03:34:14 ----A---- C:\WINDOWS\system32\cdmodem.dll

2010-11-21 03:34:12 ----A---- C:\WINDOWS\system32\mtxlegih.dll

2010-11-21 03:34:12 ----A---- C:\WINDOWS\system32\mtxex.dll

2010-11-21 03:34:12 ----A---- C:\WINDOWS\system32\mtxdm.dll

2010-11-21 03:34:12 ----A---- C:\WINDOWS\system32\dcomcnfg.exe

2010-11-21 03:34:12 ----A---- C:\WINDOWS\system32\comrepl.dll

2010-11-21 03:34:12 ----A---- C:\WINDOWS\system32\comaddin.dll

2010-11-21 03:34:11 ----A---- C:\WINDOWS\system32\stclient.dll

2010-11-21 03:34:11 ----A---- C:\WINDOWS\system32\comsnap.dll

2010-11-21 03:34:04 ----A---- C:\WINDOWS\system32\wmimgmt.msc

2010-11-21 03:34:02 ----A---- C:\WINDOWS\system32\sndrec32.exe

2010-11-21 03:34:02 ----A---- C:\WINDOWS\system32\mplay32.exe

2010-11-21 03:34:02 ----A---- C:\WINDOWS\system32\accwiz.exe

2010-11-21 03:34:01 ----D---- C:\Arquivos de programas\Windows NT

2010-11-21 03:34:01 ----A---- C:\WINDOWS\system32\hypertrm.dll

2010-11-21 03:34:00 ----A---- C:\WINDOWS\system32\mspaint.exe

2010-11-21 03:34:00 ----A---- C:\WINDOWS\system32\clipbrd.exe

2010-11-21 03:33:59 ----A---- C:\WINDOWS\system32\tscfgwmi.dll

2010-11-21 03:33:59 ----A---- C:\WINDOWS\system32\spider.exe

2010-11-21 03:33:59 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys

2010-11-21 03:33:59 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys

2010-11-21 03:33:59 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\sessmgr.exe

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\remotepg.dll

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\rdshost.exe

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\rdsaddin.exe

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\rdchost.dll

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\mstscax.dll

2010-11-21 03:33:58 ----A---- C:\WINDOWS\system32\mstsc.exe

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\tscupgrd.exe

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\termsrv.dll

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\rdpwsx.dll

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\rdpsnd.dll

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\rdpclip.exe

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\qprocess.exe

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\icaapi.dll

2010-11-21 03:33:57 ----A---- C:\WINDOWS\system32\cfgbkend.dll

2010-11-21 03:33:56 ----D---- C:\WINDOWS\system32\MsDtc

2010-11-21 03:33:56 ----A---- C:\WINDOWS\system32\mtxoci.dll

2010-11-21 03:33:56 ----A---- C:\WINDOWS\system32\msdtcuiu.dll

2010-11-21 03:33:56 ----A---- C:\WINDOWS\system32\msdtcprx.dll

2010-11-21 03:33:55 ----A---- C:\WINDOWS\system32\xolehlp.dll

2010-11-21 03:33:55 ----A---- C:\WINDOWS\system32\msdtctm.dll

2010-11-21 03:33:55 ----A---- C:\WINDOWS\system32\msdtclog.dll

2010-11-21 03:33:55 ----A---- C:\WINDOWS\system32\msdtc.exe

2010-11-21 03:33:53 ----D---- C:\WINDOWS\system32\Com

2010-11-21 03:33:53 ----A---- C:\WINDOWS\system32\colbact.dll

2010-11-21 03:33:53 ----A---- C:\WINDOWS\system32\clbcatex.dll

2010-11-21 03:33:53 ----A---- C:\WINDOWS\system32\catsrvps.dll

2010-11-21 03:33:52 ----A---- C:\WINDOWS\system32\comsvcs.dll

2010-11-21 03:33:52 ----A---- C:\WINDOWS\system32\catsrvut.dll

2010-11-21 03:33:52 ----A---- C:\WINDOWS\system32\catsrv.dll

2010-11-21 03:33:51 ----A---- C:\WINDOWS\system32\comuid.dll

2010-11-21 03:33:51 ----A---- C:\WINDOWS\system32\clbcatq.dll

2010-11-21 03:33:44 ----A---- C:\WINDOWS\system32\servdeps.dll

2010-11-21 03:33:43 ----A---- C:\WINDOWS\system32\mmfutil.dll

2010-11-21 03:33:43 ----A---- C:\WINDOWS\system32\licwmi.dll

2010-11-21 03:33:43 ----A---- C:\WINDOWS\system32\cmprops.dll

2010-11-21 03:33:39 ----A---- C:\WINDOWS\system32\drivers\termdd.sys

2010-11-21 03:33:39 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys

2010-11-21 01:33:28 ----A---- C:\WINDOWS\system32\h323log.txt

2010-11-21 01:33:07 ----A---- C:\WINDOWS\system32\drivers\audstub.sys

2010-11-21 01:32:36 ----A---- C:\WINDOWS\system32\drivers\redbook.sys

2010-11-21 01:32:22 ----A---- C:\WINDOWS\system32\storprop.dll

2010-11-21 01:32:20 ----A---- C:\WINDOWS\system32\nv4_disp.dll

2010-11-21 01:32:20 ----A---- C:\WINDOWS\system32\drivers\nv4_mini.sys

2010-11-21 01:32:04 ----A---- C:\WINDOWS\system32\drivers\GAGP30KX.SYS

2010-11-21 01:31:21 ----SHD---- C:\WINDOWS\Installer

2010-11-21 01:31:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-11-21 01:31:20 ----D---- C:\Arquivos de programas\Arquivos comuns\ODBC

2010-11-21 01:31:20 ----A---- C:\WINDOWS\ODBCINST.INI

2010-11-21 01:31:17 ----D---- C:\Arquivos de programas\Arquivos comuns\SpeechEngines

2010-11-21 01:31:16 ----RD---- C:\Arquivos de programas

2010-11-21 01:31:16 ----D---- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared

2010-11-21 01:31:16 ----D---- C:\Arquivos de programas\Arquivos comuns

2010-11-21 01:30:40 ----ASH---- C:\Documents and Settings\All Users\Dados de aplicativos\desktop.ini

2010-11-21 01:30:20 ----D---- C:\WINDOWS\system32\CatRoot2

2010-11-21 01:30:20 ----D---- C:\WINDOWS\system32\CatRoot

2010-11-21 01:30:15 ----SD---- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft

2010-11-21 01:29:46 ----D---- C:\Documents and Settings

2010-11-21 01:29:45 ----SHD---- C:\System Volume Information

2010-11-21 01:23:46 ----SH---- C:\boot.ini

2010-11-21 01:20:12 ----D---- C:\WINDOWS\OemDir

2010-11-21 01:20:06 ----SD---- C:\WINDOWS\Downloaded Program Files

2010-11-21 01:20:06 ----RSD---- C:\WINDOWS\Fonts

2010-11-21 01:20:06 ----RD---- C:\WINDOWS\Web

2010-11-21 01:20:06 ----HD---- C:\WINDOWS\inf

2010-11-21 01:20:06 ----D---- C:\WINDOWS\WinSxS

2010-11-21 01:20:06 ----D---- C:\WINDOWS\WBEM

2010-11-21 01:20:06 ----D---- C:\WINDOWS\twain_32

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\wins

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\wbem

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\usmt

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\spool

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\ShellExt

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\Setup

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\ras

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\pt-br

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\oobe

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\npp

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\mui

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\inetsrv

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\IME

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\icsxml

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\ias

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\export

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\drivers\UMDF

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\drivers\etc

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\drivers\disdn

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\drivers

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\dhcp

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\config

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\3com_dmi

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\3076

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\2052

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1054

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1046

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1042

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1041

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1037

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1033

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1031

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1028

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32\1025

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system32

2010-11-21 01:20:06 ----D---- C:\WINDOWS\system

2010-11-21 01:20:06 ----D---- C:\WINDOWS\security

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Resources

2010-11-21 01:20:06 ----D---- C:\WINDOWS\repair

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Provisioning

2010-11-21 01:20:06 ----D---- C:\WINDOWS\PeerNet

2010-11-21 01:20:06 ----D---- C:\WINDOWS\pchealth

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Offline Web Pages

2010-11-21 01:20:06 ----D---- C:\WINDOWS\mui

2010-11-21 01:20:06 ----D---- C:\WINDOWS\msapps

2010-11-21 01:20:06 ----D---- C:\WINDOWS\msagent

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Media

2010-11-21 01:20:06 ----D---- C:\WINDOWS\java

2010-11-21 01:20:06 ----D---- C:\WINDOWS\ime

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Help

2010-11-21 01:20:06 ----D---- C:\WINDOWS\ehome

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Driver Cache

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Debug

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Cursors

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Connection Wizard

2010-11-21 01:20:06 ----D---- C:\WINDOWS\Config

2010-11-21 01:20:06 ----D---- C:\WINDOWS\AppPatch

2010-11-21 01:20:06 ----D---- C:\WINDOWS\addins

2010-11-21 01:20:06 ----D---- C:\WINDOWS

 

======List of files/folders modified in the last 1 months======

 

2010-11-25 21:19:12 ----A---- C:\WINDOWS\win.ini

2010-11-25 21:19:12 ----A---- C:\WINDOWS\system.ini

2010-11-21 11:39:15 ----ASH---- C:\WINDOWS\fonts\desktop.ini

 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2004-08-03 46464]

R0 viamraid;viamraid; C:\WINDOWS\system32\drivers\viamraid.sys [2005-04-26 60928]

R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2007-07-21 14848]

R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.5.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2010-11-21 21419]

R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]

R3 hidusb;Driver de classe HID da Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2007-07-21 9600]

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-10-10 3530432]

R3 RT61;Ralink RT61 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2006-08-02 384384]

R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-07-15 578368]

R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2007-07-21 31616]

R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2007-07-21 20480]

R3 ZSMC0305;A4 TECH PC Camera V; C:\WINDOWS\System32\Drivers\usbVM305.sys [2006-05-08 391688]

S3 catchme;catchme; \??\C:\DOCUME~1\Lucas\CONFIG~1\Temp\catchme.sys []

S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]

S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]

S3 MSTEE;Conversor em T entre locais de fluxo contínuo Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]

S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]

S3 NdisIP;Conexão de TV e vídeo da Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]

S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]

S3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-07-21 26496]

S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]

S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2007-09-02 77568]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2007-09-02 82944]

 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R2 JavaQuickStarterService;Java Quick Starter; C:\Arquivos de programas\Java\jre6\bin\jqs.exe [2010-11-22 153376]

R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-10-10 131139]

R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]

R3 NMIndexingService;NMIndexingService; C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]

S3 NBService;NBService; C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]

S3 ose;Office Source Engine; C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 WMPNetworkSvc;Serviço de Compartilhamento de Rede do Windows Media Player; C:\Arquivos de programas\Windows Media Player\WMPNetwk.exe [2006-11-02 914944]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2007-07-21 14336]

 

-----------------EOF-----------------

 

GMER 1.0.15.15530 - http://www.gmer.net

Rootkit scan 2010-11-26 14:17:45

Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Scsi\viamraid1Port2Path0Target0Lun0 SAMSUNG_ rev.SU10

Running: gmer.exe; Driver: C:\DOCUME~1\Lucas\CONFIG~1\Temp\kwliqkoc.sys

 

 

---- Kernel code sections - GMER 1.0.15 ----

 

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6F63360, 0x20469D, 0xE8000020]

 

---- EOF - GMER 1.0.15 ----

[wings 22]

*Baixe o OTC e salve-o no desktop

*Execute o OTC e clique em [CleanUp!]

 

 

Seus logs estão limpos.

 

Ainda com problema?

[lucasbsp 0]

Então wings fiz todos os procedimentos que você me falou mas quando atualizo o combofix e ele escanear

mostra o seguinte foi detectado rootkit no seu sistema e deve ser reiniciado agora

nao sei se pelos logs da pra você saber mas tenho 2 hds um de 80gb que eh para o sistema

e um de 160gb que eh para backup tem como esse virus ter infiltrado nos meus arquivos? abrass aguardo resposta

[wings 22]

Combofix não é uma ferramenta para ser usada como antivírus!

 

Seu uso é complexo e pode acarretar alterações no sistema.

 

De onde você baixou o combofix?

[lucasbsp 0]

Eu sei mas não uso ele como anti virus

e sim quando eu acho que tem algum malware que o antivirus nao pega

baixei ele no baixaki wings!

[wings 22]

1.

*Execute o arquivo c:\Arquivos de programas\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe

 

2.

*Desative temporariamente seu antivírus

 

*Baixe o ComboFix e salve-o no desktop

 

*Execute o Combofix e aceite o contrato

 

*Se o console de recuperação do Windows já estiver instalado, o ComboFix continuará o processo automaticamente. Caso contrário, clique [sIM] para instalar e depois [sIM] para continuar.

 

 

 

*Aguarde a conclusão de todas as etapas

 

 

*Não use o mouse e o teclado durante a execução do Combofix!!..... Para interromper o procedimento tecle [N] ou [2] e depois [ENTER]

 

*Cole o relatório C:\combofix.txt

 

*Se for reiniciar o PC haverá uma opção, na inicialização, chamada Console de Recuperação. Não entre no Windows através da mesma desde que devidamente orientado(a)!

[lucasbsp 0]

Então wings fiz o procedimento igual você mostra no tópico quando om combofix começa a verificar arquivos e ficheiros segue a seguinte mensagem apos alguns minutos "O COMBOFIX DETECTOU A PRESENÇA DE ATIVIDADE DE ROOTKIT E PRECISA REINICIAR A MÁQUINA.Renicio a maquina normalmente ele faz os procedimentos padrão e abaixo segue o log

 

ComboFix 10-11-25.06 - Lucas 11/26/aaaa 18:04:27.11.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1023.807 [GMT -2:00]

Executando de: c:\documents and settings\Lucas\Desktop\ComboFix.exe

.

 

(((((((((((((((( Arquivos/Ficheiros criados de 2010-10-26 to 2010-11-26 ))))))))))))))))))))))))))))

.

 

2010-11-24 02:13 . 2010-11-24 02:13 -------- d-----r- C:\MSOCache

2010-11-22 16:38 . 2010-11-22 16:38 -------- d-----w- C:\profiles

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

 

------- Sigcheck -------

 

[-] 2007-09-03 . BD8686216E34E22C4ED45A2320B2BEA1 . 360576 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys

 

[-] 2007-09-02 . DB3AA410ED1228B9DF98C06549AE0763 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

 

[-] 2007-09-02 17:20 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]

"ccleaner"="c:\arquivos de programas\CCleaner\CCleaner.exe" [2010-04-23 1668920]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"USB Antivirus"="c:\arquivos de programas\USB Disk Security\USBGuard.exe" [2008-08-16 798720]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"UnlockerAssistant"="c:\arquivos de programas\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

"SunJavaUpdateSched"="c:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]

"BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-10 7286784]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-10 86016]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]

"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-07-21 15360]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2007-07-21 44544]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

2005-10-10 13:49 1519616 ----a-w- c:\windows\system32\nwiz.exe

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

 

R3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [11/22/aaaa 21:39 391688]

.

Conteúdo da pasta 'Tarefas Agendadas'

.

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

TCP: {8D0E73B4-96AE-4D5B-9CD1-48F0473B9492} = 10.0.1.254

FF - ProfilePath - c:\documents and settings\Lucas\Dados de aplicativos\Mozilla\Firefox\Profiles\zawixtqt.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

.

.

------- Associação de arquivos/ficheiros -------

.

inifile=Notepad.exe "%1"

txtfile=Notepad.exe "%1"

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-11-26 18:07

Windows 5.1.2600 Service Pack 2 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????

 

Procurando ficheiros/arquivos ocultos ...

 

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

 

**************************************************************************

 

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: SAMSUNG_ rev.SU10 -> Harddisk0\DR0 -> \Device\Scsi\viamraid1Port2Path0Target2Lun0

 

device: opened successfully

user: MBR read successfully

 

Disk trace:

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys SCSIPORT.SYS hal.dll viamraid.sys

c:\docume~1\Lucas\CONFIG~1\Temp\catchme.sys

c:\windows\system32\drivers\viamraid.sys VIA Technologies inc,.ltd VIA RAID driver

1 ntkrnlpa!IofCallDriver[0x804EE0F6] -> \Device\Harddisk0\DR0[0x86592AB8]

3 CLASSPNP[0xF762D05B] -> ntkrnlpa!IofCallDriver[0x804EE0F6] -> \Device\Scsi\viamraid1Port2Path0Target0Lun0[0x86586A38]

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

user != kernel MBR !!!

sectors 156368014 (+255): user != kernel

 

**************************************************************************

.

Tempo para conclusão: 2010-11-26 18:08:52

ComboFix-quarantined-files.txt 2010-11-26 20:08

 

Pré-execução: 6 pasta(s) 70.128.513.024 bytes disponíveis

Pós execução: 8 pasta(s) 70.130.139.136 bytes disponíveis

 

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

- - End Of File - - DBE569F4041376428D0BB040D8368DBB

 

esqueci de ressaltar quando entro em minha unidade D: aparece o RECYLCLER

[wings 22]

1.

*Baixe o TDSSKiller e salve-o no desktop

*Extraia para o desktop e execute o TDSSKiller

*Clique [start Scan]

*Caso encontre algo, clique na seta ao lado da palavra "Cure" e selecione "Skip"

*Clique [Continue]

*Ao término, clique [Close]

*Cole o relatório C:\TDSSKiller.versão_data.mês.ano_hora.minutos.segundos_log.txt

 

2.

*Baixe o MalwareBytes Anti-malware e salve-o no desktop

 

*Instale o programa e aguarde a atualização

*O programa será aberto automaticamente

*Na aba [Verificação], selecione [Verificação completa]

*Clique [Verificar] e selecione todas as partições

*Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados]

*Clique [Remover Selecionados]

*Cole o relatório apresentado

[lucasbsp 0]

segue os log o tdsskiller nao encontrou nd

 

2010/11/26 23:05:13.0218 TDSS rootkit removing tool 2.4.9.0 Nov 26 2010 15:38:31

2010/11/26 23:05:13.0218 ================================================================================

2010/11/26 23:05:13.0218 SystemInfo:

2010/11/26 23:05:13.0218

2010/11/26 23:05:13.0218 OS Version: 5.1.2600 ServicePack: 2.0

2010/11/26 23:05:13.0218 Product type: Workstation

2010/11/26 23:05:13.0218 ComputerName: LUCAS-1B5A603ED

2010/11/26 23:05:13.0218 UserName: Lucas

2010/11/26 23:05:13.0218 Windows directory: C:\WINDOWS

2010/11/26 23:05:13.0218 System windows directory: C:\WINDOWS

2010/11/26 23:05:13.0218 Processor architecture: Intel x86

2010/11/26 23:05:13.0218 Number of processors: 1

2010/11/26 23:05:13.0218 Page size: 0x1000

2010/11/26 23:05:13.0218 Boot type: Normal boot

2010/11/26 23:05:13.0218 ================================================================================

2010/11/26 23:05:13.0578 Initialize success

2010/11/26 23:05:22.0640 ================================================================================

2010/11/26 23:05:22.0640 Scan started

2010/11/26 23:05:22.0640 Mode: Manual;

2010/11/26 23:05:22.0640 ================================================================================

2010/11/26 23:05:23.0218 ACPI (c0162963d82fcfb3f1795263ece1088a) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2010/11/26 23:05:23.0328 ACPIEC (ebd5cf43ad9526eab9b2a15a54760ea9) C:\WINDOWS\system32\drivers\ACPIEC.sys

2010/11/26 23:05:23.0484 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys

2010/11/26 23:05:23.0546 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys

2010/11/26 23:05:23.0640 AegisP (15e655baa989444f56787ef558823643) C:\WINDOWS\system32\DRIVERS\AegisP.sys

2010/11/26 23:05:23.0718 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys

2010/11/26 23:05:24.0265 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2010/11/26 23:05:24.0328 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys

2010/11/26 23:05:24.0437 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2010/11/26 23:05:24.0515 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2010/11/26 23:05:24.0578 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2010/11/26 23:05:24.0828 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2010/11/26 23:05:24.0906 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2010/11/26 23:05:24.0984 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2010/11/26 23:05:25.0031 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys

2010/11/26 23:05:25.0125 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2010/11/26 23:05:25.0812 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys

2010/11/26 23:05:25.0906 dmboot (ee1e26656d60b8ade14a058a56ebd5f7) C:\WINDOWS\system32\drivers\dmboot.sys

2010/11/26 23:05:25.0984 dmio (29a6d15f8d2f1d9a5c7e0ef594a0dcc4) C:\WINDOWS\system32\DRIVERS\dmio.sys

2010/11/26 23:05:26.0046 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2010/11/26 23:05:26.0109 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys

2010/11/26 23:05:26.0187 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys

2010/11/26 23:05:26.0281 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys

2010/11/26 23:05:26.0343 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys

2010/11/26 23:05:26.0390 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys

2010/11/26 23:05:26.0421 Fips (8ec0d923cd6128de73dda0df082bb985) C:\WINDOWS\system32\drivers\Fips.sys

2010/11/26 23:05:26.0453 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2010/11/26 23:05:26.0500 FltMgr (5a85cd3d07273e3f6fe72ee9c6431632) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

2010/11/26 23:05:26.0515 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2010/11/26 23:05:26.0593 Ftdisk (d24d7839d594b255e1c298245b7ba6a2) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2010/11/26 23:05:26.0640 gagp30kx (4216cd545e5c30807b560c5dcaa812e6) C:\WINDOWS\system32\DRIVERS\gagp30kx.sys

2010/11/26 23:05:26.0703 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2010/11/26 23:05:26.0734 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2010/11/26 23:05:26.0828 HTTP (909d110c9634b0f1487eaaea837317d9) C:\WINDOWS\system32\Drivers\HTTP.sys

2010/11/26 23:05:26.0921 i8042prt (fcad1d4a4724b6fa6f05a5db7f89443c) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2010/11/26 23:05:26.0953 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys

2010/11/26 23:05:27.0062 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

2010/11/26 23:05:27.0109 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2010/11/26 23:05:27.0140 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2010/11/26 23:05:27.0171 IpNat (5191673215c91ff13ceaa83ef8e9653f) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2010/11/26 23:05:27.0234 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2010/11/26 23:05:27.0281 isapnp (a41645b9470d99701e90715d443374bd) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2010/11/26 23:05:27.0343 Kbdclass (7fc1e330386610d5eb3e7c4c7893ca93) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2010/11/26 23:05:27.0375 kbdhid (45c3722b3bd4c7aa411eae97f2f050db) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2010/11/26 23:05:27.0406 kmixer (8531438246ce9474e41ee1599904c0c7) C:\WINDOWS\system32\drivers\kmixer.sys

2010/11/26 23:05:27.0437 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys

2010/11/26 23:05:27.0531 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2010/11/26 23:05:27.0593 Modem (ceaf7d279d51d10b9cee49f56422b213) C:\WINDOWS\system32\drivers\Modem.sys

2010/11/26 23:05:27.0625 Mouclass (b4766ab1c226e04a9d7ca4f99d2aa795) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2010/11/26 23:05:27.0671 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys

2010/11/26 23:05:27.0734 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2010/11/26 23:05:27.0796 MRxSmb (7412ce77c6fd823f8889b4df420c680b) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2010/11/26 23:05:27.0859 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys

2010/11/26 23:05:27.0906 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2010/11/26 23:05:27.0921 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2010/11/26 23:05:27.0984 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys

2010/11/26 23:05:28.0015 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2010/11/26 23:05:28.0062 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys

2010/11/26 23:05:28.0421 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys

2010/11/26 23:05:28.0453 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2010/11/26 23:05:28.0531 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys

2010/11/26 23:05:28.0593 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2010/11/26 23:05:28.0687 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2010/11/26 23:05:28.0734 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2010/11/26 23:05:28.0781 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2010/11/26 23:05:28.0843 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys

2010/11/26 23:05:28.0890 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys

2010/11/26 23:05:28.0968 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys

2010/11/26 23:05:29.0140 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys

2010/11/26 23:05:29.0218 Ntfs (05ab81909514bfd69cbb1f2c147cf6b9) C:\WINDOWS\system32\drivers\Ntfs.sys

2010/11/26 23:05:29.0312 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2010/11/26 23:05:29.0531 nv (9e1f2f09e34c92a96b9900b6a45d5026) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

2010/11/26 23:05:29.0703 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2010/11/26 23:05:29.0765 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2010/11/26 23:05:29.0859 Parport (8b225d87cbe08a5cb090bbf9f7de1d30) C:\WINDOWS\system32\DRIVERS\parport.sys

2010/11/26 23:05:29.0906 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys

2010/11/26 23:05:30.0015 ParVdm (598a4e8249dcee03c4426b1cf3917abd) C:\WINDOWS\system32\drivers\ParVdm.sys

2010/11/26 23:05:30.0078 PCI (ef5c8b50da721eb49c5466f1317b8fc9) C:\WINDOWS\system32\DRIVERS\pci.sys

2010/11/26 23:05:30.0265 Pcmcia (20ccda6d41140456f4bd91c1b188812d) C:\WINDOWS\system32\drivers\Pcmcia.sys

2010/11/26 23:05:30.0750 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2010/11/26 23:05:30.0859 Processor (5eb97be44a1bf76d1b077f3dbe4a55ba) C:\WINDOWS\system32\DRIVERS\processr.sys

2010/11/26 23:05:30.0953 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys

2010/11/26 23:05:31.0015 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2010/11/26 23:05:31.0359 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2010/11/26 23:05:31.0421 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2010/11/26 23:05:31.0500 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2010/11/26 23:05:31.0562 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2010/11/26 23:05:31.0656 Rdbss (ed375ce745c42a14f10753f7022ecd6a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2010/11/26 23:05:31.0703 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2010/11/26 23:05:31.0796 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2010/11/26 23:05:31.0906 RDPWD (047bea21274c8a4a233674a76c958c2c) C:\WINDOWS\system32\drivers\RDPWD.sys

2010/11/26 23:05:32.0015 redbook (ddd1a19cd2eda2d6ae5ab61baaeb4278) C:\WINDOWS\system32\DRIVERS\redbook.sys

2010/11/26 23:05:32.0218 RT61 (4bb5f4cdd6c6b9874eb2bb40f657e9f3) C:\WINDOWS\system32\DRIVERS\RT61.sys

2010/11/26 23:05:32.0359 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2010/11/26 23:05:32.0437 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys

2010/11/26 23:05:32.0484 Serial (d8b7e132cb532ee6f3fb5bb3a96df946) C:\WINDOWS\system32\DRIVERS\serial.sys

2010/11/26 23:05:32.0546 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys

2010/11/26 23:05:32.0718 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2010/11/26 23:05:32.0828 smwdm (1d381a07361e4d6a8be95026b3eba47a) C:\WINDOWS\system32\drivers\smwdm.sys

2010/11/26 23:05:33.0000 splitter (9bb1dd670cb7505a90fc4e61d4aa8227) C:\WINDOWS\system32\drivers\splitter.sys

2010/11/26 23:05:33.0093 sr (cfa635cf7e75e4eb98fbc164e3583111) C:\WINDOWS\system32\DRIVERS\sr.sys

2010/11/26 23:05:33.0187 Srv (5230953c21c811b5fc1ff31ae2b48097) C:\WINDOWS\system32\DRIVERS\srv.sys

2010/11/26 23:05:33.0265 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2010/11/26 23:05:33.0328 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys

2010/11/26 23:05:33.0406 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys

2010/11/26 23:05:33.0687 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys

2010/11/26 23:05:33.0781 Tcpip (bd8686216e34e22c4ed45a2320b2bea1) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2010/11/26 23:05:33.0875 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys

2010/11/26 23:05:33.0937 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys

2010/11/26 23:05:34.0015 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys

2010/11/26 23:05:34.0234 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys

2010/11/26 23:05:34.0359 Update (7b2170ee3d858ce8fbe503904cc9b663) C:\WINDOWS\system32\DRIVERS\update.sys

2010/11/26 23:05:34.0453 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2010/11/26 23:05:34.0500 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2010/11/26 23:05:34.0562 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2010/11/26 23:05:34.0625 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2010/11/26 23:05:34.0687 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2010/11/26 23:05:34.0734 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys

2010/11/26 23:05:34.0796 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys

2010/11/26 23:05:34.0859 viamraid (0363e216e4eb5052969c96608934dbde) C:\WINDOWS\system32\drivers\viamraid.sys

2010/11/26 23:05:34.0937 VolSnap (eb2f82aaeadcc9baac66cba4d714e338) C:\WINDOWS\system32\drivers\VolSnap.sys

2010/11/26 23:05:35.0031 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2010/11/26 23:05:35.0203 wdmaud (0bfa8203b8148fb4e54bc212c41ce497) C:\WINDOWS\system32\drivers\wdmaud.sys

2010/11/26 23:05:35.0515 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2010/11/26 23:05:35.0625 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2010/11/26 23:05:35.0687 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2010/11/26 23:05:35.0796 ZSMC0305 (c53cb6b30e8d7fe6d950707508aacfb9) C:\WINDOWS\system32\Drivers\usbVM305.sys

2010/11/26 23:05:36.0093 ================================================================================

2010/11/26 23:05:36.0093 Scan finished

2010/11/26 23:05:36.0093 ================================================================================

2010/11/26 23:05:51.0546 Deinitialize success

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Versão da Base de Dados: 5195

 

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.11

 

11/26/aaaa 23:41:04

mbam-log-2010-11-26 (23-41-04).txt

 

Tipo de Verificação: Verificação Completa (A:\|C:\|D:\|)

Objetos escaneados: 193322

Tempo decorrido: 23 minuto(s), 29 segundo(s)

 

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 0

Arquivos Infectados: 3

 

Processos de Memória Infectados:

(Não foram detectados ítens maliciosos)

 

Módulos de Memória Infectados:

(Não foram detectados ítens maliciosos)

 

Chaves de Registro Infectadas:

(Não foram detectados ítens maliciosos)

 

Valores de Registro Infectados:

(Não foram detectados ítens maliciosos)

 

Itens de Dados no Registro Infectados:

(Não foram detectados ítens maliciosos)

 

Pastas Infectadas:

(Não foram detectados ítens maliciosos)

 

Arquivos Infectados:

D:\System Volume Information\_restore{545B52EC-1B93-495B-9FE2-79FCC1B9ECFF}\RP5\A0001359.exe (Trojan.Downloader) -> No action taken.

D:\System Volume Information\_restore{545B52EC-1B93-495B-9FE2-79FCC1B9ECFF}\RP5\A0001364.exe (PUP.MailPassView) -> No action taken.

D:\System Volume Information\_restore{545B52EC-1B93-495B-9FE2-79FCC1B9ECFF}\RP5\A0001366.exe (RiskWare.Tool.CK) -> No action taken.

[wings 22]

1.

*Delete o TDSSKiller e o relatório C:\TDSSKiller.versão_data.mês.ano_hora.minutos.segundos_log.txt

 

2.

*Clique [iniciar] > [Executar] > copie e cole: Combofix /uninstall

 

 

*Clique [OK] > [Executar]

*Aguarde surgir a mensagem: "ComboFix está desinstalado"

*Clique [OK]

 

3.

*Baixe o Kaspersky Virus Removal Tool e salve-o no desktop

*Instale o programa

*Selecione a opção:

[X] Meu Computador

*Clique em [start scan]....aguarde. Pode demorar, seja paciente!

*Caso encontre algo, clique [skip] ou [ignorar]

*Ao finalizar, clique [Report]

*Uma janela chamada "Detailed report" será aberta

*Clique no sinal [+] ao lado de Autoscan para expandir os eventos encontrados

*Clique com o botão direito do mouse em Autoscan e selecione "Select all"

*Clique novamente com o botão direito do mouse e selecione "Copy"

*Abra o bloco de notas, cole (Ctrl+v) e salve o arquivo no desktop como log.txt

*Feche a janela "Detailed report" do Kasperky

*Na tela principal do Kaspersky clique em [Exit] > [No]

*Cole o relatório log.txt salvo no desktop

[lucasbsp 0]

Autoscan: completed 32 minutes ago (events: 2, objects: 323395, time: 01:36:59)

11/27/aaaa 12:31:44 Task started

11/27/aaaa 14:08:43 Task completed

[wings 22]

OK...

 

1.

*Abra a pasta Virus Removal Tool, localizada no desktop, execute o atalho Start

*Clique em [Exit] > [Yes] > [sim] > [sim]

*O PC será reiniciado

*Delete os arquivos setup do Kaspersky e log.txt salvos no desktop

 

2.

*Baixe o antiboot e salve-o no desktop

*Extraia para C:\

*Clique [iniciar] > [Executar] > copie e cole: C:\antiboot.exe -l sinowal.txt

*Clique [OK]

*Caso receba a mensagem: "No infected Disks found", tecle [ENTER] e o programa será fechado.

*Caso receba a mensagem: "Bootkit has been detected! Would you like to cure? y/n", tecle [Y]

*Ao término, tecle [Y] > [ENTER] e o PC será reiniciado

*Cole o relatório C:\sinowal.txt

 

Informe.

[lucasbsp 0]

Log started....

Unpacking driver

 

Starting up driver

No Infected Disks found

 

Log started....

Unpacking driver

 

Starting up driver

No Infected Disks found

[wings 22]

OK...o PC está limpo. :)

 

Delete o antiboot e o arquivo C:\sinowal.txt

 

 

Um abraço.

[lucasbsp 0]

sim ok muito obrigado wings mas ak será msm que saiu tudo rsrsrs???

sera que nao conveem passar o combofix novamente pra ver se dar a mensagem de rootkit ?

eh so uma duvida ok grande abrass e muito obrigado pela atenção e disposição pra ajudar" :)

[wings 22]

PROBLEMA RESOLVIDO

 

Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.