[Resolvido] &nbspmalware dando dor de cabeça

lucasbsp · Dezembro 17, 2010

Então Lord, não creio que seja ela pois instalei ela depois que a gente fez o teste do combofix

e nao tinha nenhum arquivo dela no meu pc pois o pc tinha formatado fiz o teste pelo site q você me mandou

mas nao encontrou nd no arquivo não sei acho que pode estar envolvido com alguma coisa com meu driver de internet

pois o que eu uso eh ralink e minha net é via radio o unico arquivo que instalei dos backups foi o ralink

pois sem ele nao poderia fazer contato acho que pode ser naum sei mas ja estou perdendo as esperanças pois acho que vou te que perder todos os meus arquivos e são mais de 70gb aguardo resposta grande abraço segue os logs

ComboFix 10-12-16.02 - Lucas 17/12/2010 4:14.7.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1023.787 [GMT -2:00]

Executando de: c:\documents and settings\Lucas\Desktop\ComboFix.exe

.

(((((((((((((((( Arquivos/Ficheiros criados de 2010-11-17 to 2010-12-17 ))))))))))))))))))))))))))))

.

Nenhum ficheiro/arquivo criado durante este período

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-22 11:43 . 2010-10-22 11:43 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-10-22 11:43 . 2010-10-22 11:43 348160 ----a-w- c:\windows\system32\msvcr71.dll

.

------- Sigcheck -------

[-] 2007-09-03 . BD8686216E34E22C4ED45A2320B2BEA1 . 360576 . . [5.1.2600.2892] . . c:\windows\system32\drivers\tcpip.sys

[-] 2007-09-02 . DB3AA410ED1228B9DF98C06549AE0763 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2007-09-02 17:20 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]

"msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BigDog305"="c:\windows\VM305_STI.EXE" [2007-04-09 57344]

"GrooveMonitor"="c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"NBKeyScan"="c:\arquivos de programas\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]

"UnlockerAssistant"="c:\arquivos de programas\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2007-07-21 110592]

"USB Antivirus"="c:\arquivos de programas\USB Disk Security\USBGuard.exe" [2008-08-16 798720]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-07-21 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Ralink Wireless Utility.lnk - c:\arquivos de programas\RALINK\Common\RaUI.exe [2010-12-15 659456]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

R3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [14/12/2010 13:05 391688]

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: {EC5D72A5-7054-4BC6-8FD8-7059249580EC} = 10.0.1.254

FF - ProfilePath - c:\documents and settings\Lucas\Dados de aplicativos\Mozilla\Firefox\Profiles\0n840pdq.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\arquivos de programas\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - user.js: network.http.max-connections-per-server - 6

FF - user.js: network.http.max-persistent-connections-per-server - 3

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-12-17 04:17

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: SAMSUNG_ rev.SU10 -> Harddisk0\DR0 -> \Device\Scsi\viamraid1Port2Path0Target2Lun0

device: opened successfully

user: MBR read successfully

Disk trace:

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys SCSIPORT.SYS hal.dll viamraid.sys

c:\docume~1\Lucas\CONFIG~1\Temp\catchme.sys

c:\windows\system32\drivers\viamraid.sys VIA Technologies inc,.ltd VIA RAID driver

1 ntkrnlpa!IofCallDriver[0x804EE0F6] -> \Device\Harddisk0\DR0[0x86570AB8]

3 CLASSPNP[0xF762D05B] -> ntkrnlpa!IofCallDriver[0x804EE0F6] -> \Device\Scsi\viamraid1Port2Path0Target0Lun0[0x86585A38]

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

user != kernel MBR !!!

sectors 156368014 (+255): user != kernel

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

@DACL=(02 0000)

@=""

"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

@DACL=(02 0000)

@=""

"Installed"="1"

"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

@DACL=(02 0000)

@=""

"Installed"="1"

.

Tempo para conclusão: 2010-12-17 04:18:15

ComboFix-quarantined-files.txt 2010-12-17 06:18

ComboFix2.txt 2010-12-16 21:40

Pré-execução: 5 pasta(s) 72.445.362.176 bytes disponíveis

Pós execução: 6 pasta(s) 72.443.351.040 bytes disponíveis

- - End Of File - - B387C9443037B7E52FDAAAEB6F9AACFA

DDS (Ver_10-11-10.01) - NTFSx86

Run by Lucas at 4:20:33,59 on --- 17/12/2010

Internet Explorer: 7.0.5730.11

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1023.747 [GMT -2:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Lucas\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com.br/

BHO: QuickStores-Toolbar: {10edb994-47f8-43f7-ae96-f2ea63e9f90f} - mscoree.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\arquivos de programas\arquivos comuns\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\arquiv~1\micros~3\office12\GRA8E1~1.DLL

BHO: Auxiliar de Conexão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\arquivos de programas\arquivos comuns\microsoft shared\windows live\WindowsLiveLogin.dll

TB: QuickStores-Toolbar: {10edb994-47f8-43f7-ae96-f2ea63e9f90f} - mscoree.dll

uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\arquivos de programas\arquivos comuns\nero\lib\NMBgMonitor.exe"

uRun: [msnmsgr] "c:\arquivos de programas\windows live\messenger\msnmsgr.exe" /background

mRun: [bigDog305] c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

mRun: [GrooveMonitor] "c:\arquivos de programas\microsoft office\office12\GrooveMonitor.exe"

mRun: [Adobe Reader Speed Launcher] "c:\arquivos de programas\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\arquivos de programas\arquivos comuns\adobe\arm\1.0\AdobeARM.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NeroFilterCheck] c:\arquivos de programas\arquivos comuns\nero\lib\NeroCheck.exe

mRun: [NBKeyScan] "c:\arquivos de programas\nero\nero8\nero backitup\NBKeyScan.exe"

mRun: [unlockerAssistant] "c:\arquivos de programas\unlocker\UnlockerAssistant.exe"

mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

mRun: [uSB Antivirus] c:\arquivos de programas\usb disk security\USBGuard.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32

StartupFolder: c:\docume~1\alluse~1\menuin~1\progra~1\inicia~1\ralink~1.lnk - c:\arquivos de programas\ralink\common\RaUI.exe

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\micros~3\office12\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\arquivos de programas\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\arquiv~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\arquiv~1\micros~3\office12\REFIEBAR.DLL

TCP: {EC5D72A5-7054-4BC6-8FD8-7059249580EC} = 10.0.1.254

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\arquiv~1\micros~3\office12\GR99D3~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\arquiv~1\micros~3\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\lucas\dadosd~1\mozilla\firefox\profiles\0n840pdq.default\

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-connections-per-server - 6

FF - user.js: network.http.max-persistent-connections-per-server - 3

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgba3a4f16a", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgba3a4fra", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

============= SERVICES / DRIVERS ===============

R3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [2010-12-14 391688]

=============== Created Last 30 ================

2010-12-17 06:10:05 98816 ----a-w- c:\windows\sed.exe

2010-12-17 06:10:05 89088 ----a-w- c:\windows\MBR.exe

2010-12-17 06:10:05 256512 ----a-w- c:\windows\PEV.exe

2010-12-17 06:10:05 161792 ----a-w- c:\windows\SWREG.exe

2010-12-16 14:44:50 -------- d-----w- c:\windows\SxsCaPendDel

2010-12-16 02:33:59 -------- d-----w- c:\arquivos de programas\USB Disk Security

2010-12-15 22:55:26 -------- d-----w- c:\docume~1\lucas\dadosd~1\TuneUp Software

2010-12-15 22:55:07 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\TuneUp Software

2010-12-15 22:55:03 -------- d-sh--w- c:\docume~1\alluse~1\dadosd~1\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

2010-12-15 22:49:45 -------- d-----w- c:\arquivos de programas\arquivos comuns\Wise Installation Wizard

2010-12-15 19:43:44 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\SUPERAntiSpyware.com

2010-12-15 19:42:21 165376 ----a-w- c:\windows\system32\unrar.dll

2010-12-15 19:42:20 232448 ----a-w- c:\windows\system32\mp3fhg.acm

2010-12-15 19:42:20 151552 ----a-w- c:\windows\system32\ac3acm.acm

2010-12-15 19:42:19 790528 ----a-w- c:\windows\system32\xvidcore.dll

2010-12-15 19:42:19 237568 ----a-w- c:\windows\system32\yv12vfw.dll

2010-12-15 19:42:19 134144 ----a-w- c:\windows\system32\xvidvfw.dll

2010-12-15 19:42:19 108032 ----a-w- c:\windows\system32\ff_vfw.dll

2010-12-15 19:42:16 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2010-12-15 18:50:31 -------- d-----w- c:\arquivos de programas\Unlocker

2010-12-15 18:36:18 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys

2010-12-15 14:42:54 -------- d-----w- c:\arquivos de programas\Microsoft

2010-12-15 14:41:53 142922064 ----a-w- c:\arquivos de programas\arquivos comuns\windows live\.cache\wlc2.tmp

2010-12-15 14:23:57 -------- d-----w- c:\arquivos de programas\Marcos Velasco Security

2010-12-15 03:52:35 -------- d-----w- c:\arquivos de programas\VS Revo Group

2010-12-15 03:09:11 -------- d-----w- c:\docume~1\lucas\config~1\dadosd~1\Ahead

2010-12-15 02:51:31 -------- d-----w- c:\docume~1\lucas\dadosd~1\Malwarebytes

2010-12-15 02:51:18 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\Malwarebytes

2010-12-15 02:49:56 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\Nero

2010-12-15 02:49:56 -------- d-----w- c:\arquivos de programas\Nero

2010-12-15 02:27:10 208896 ----a-w- c:\windows\system32\nvudisp.exe

2010-12-15 02:27:10 -------- d-----w- c:\windows\nview

2010-12-15 02:27:05 -------- d-----w- c:\windows\system32\ReinstallBackups

2010-12-15 02:27:00 208896 ----a-w- c:\windows\system32\NVUNINST.EXE

2010-12-15 02:26:59 729088 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\iKernel.dll

2010-12-15 02:26:59 69715 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\ctor.dll

2010-12-15 02:26:59 5632 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe

2010-12-15 02:26:59 266240 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\iscript.dll

2010-12-15 02:26:59 192512 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\iuser.dll

2010-12-15 02:26:54 188548 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\iGdi.dll

2010-12-15 02:26:53 311428 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\09\01\intel32\setup.dll

2010-12-15 00:48:11 -------- d-----w- c:\docume~1\lucas\config~1\dadosd~1\Adobe

2010-12-15 00:47:38 -------- d-----w- c:\windows\system32\Adobe

2010-12-15 00:45:52 33104 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll

2010-12-15 00:45:52 32592 ----a-w- c:\windows\system32\msonpmon.dll

2010-12-15 00:41:59 -------- d-----w- c:\arquivos de programas\IObit

2010-12-15 00:40:20 -------- d-----w- c:\windows\SHELLNEW

2010-12-15 00:40:10 -------- d-----w- c:\docume~1\lucas\config~1\dadosd~1\Microsoft Help

2010-12-14 15:05:58 81920 ----a-w- c:\windows\system32\VM305STI.dll

2010-12-14 15:05:58 57344 ----a-w- c:\windows\vm305_sti.exe

2010-12-14 15:05:58 391688 ----a-w- c:\windows\system32\drivers\usbVM305.sys

2010-12-14 15:05:58 176128 ----a-w- c:\windows\amcap.exe

2010-12-14 15:05:58 155722 ----a-w- c:\windows\system32\VM305Prp.Ax

2010-12-14 15:05:54 -------- d-----w- c:\arquivos de programas\Vimicro

2010-12-14 12:51:39 -------- d-----w- c:\windows\system32\xircom

2010-12-14 12:51:39 -------- d-----w- c:\windows\system32\wbem\snmp

2010-12-14 12:50:47 -------- d-----w- c:\windows\system32\wbem\repository\FS

2010-12-14 12:50:47 -------- d-----w- c:\windows\system32\wbem\Repository

2010-12-13 23:20:48 -------- d-sha-r- C:\cmdcons

2010-12-13 22:54:44 -------- d-----w- c:\documents and settings\lucas\Tracing

2010-12-13 22:54:00 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2010-12-13 22:48:59 -------- d-----w- c:\arquivos de programas\arquivos comuns\Windows Live

2010-12-13 22:26:55 -------- d-----w- c:\docume~1\lucas\config~1\dadosd~1\Mozilla

2010-12-13 22:24:36 -------- d-----w- c:\windows\pss

2010-12-13 22:15:23 -------- d-----w- c:\arquivos de programas\RALINK

2010-12-13 22:15:22 32768 ----a-w- c:\arquivos de programas\arquivos comuns\installshield\professional\runtime\Objectps.dll

2010-12-13 22:07:53 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys

2010-12-13 22:07:53 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys

2010-12-13 22:07:52 54272 ----a-w- c:\windows\system32\drivers\swmidi.sys

2010-12-13 22:07:52 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys

2010-12-13 22:07:51 6272 ----a-w- c:\windows\system32\drivers\splitter.sys

2010-12-13 22:07:51 142464 ----a-w- c:\windows\system32\drivers\aec.sys

2010-12-13 22:07:50 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys

2010-12-13 22:05:47 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys

2010-12-13 22:04:21 -------- d-----w- c:\arquivos de programas\CCleaner

2010-12-13 22:01:50 5824 ----a-w- c:\windows\system32\drivers\ASUSHWIO.SYS

==================== Find3M ====================

2010-10-22 11:43:18 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-10-22 11:43:18 348160 ----a-w- c:\windows\system32\msvcr71.dll

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: SAMSUNG_ rev.SU10 -> Harddisk0\DR0 -> \Device\Scsi\viamraid1Port2Path0Target2Lun0

device: opened successfully

user: MBR read successfully

Disk trace:

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys SCSIPORT.SYS hal.dll viamraid.sys

c:\docume~1\lucas\config~1\temp\catchme.sys

c:\windows\system32\drivers\viamraid.sys VIA Technologies inc,.ltd VIA RAID driver

1 ntkrnlpa!IofCallDriver[0x804EE0F6] -> \Device\Harddisk0\DR0[0x86570AB8]

3 CLASSPNP[0xF762D05B] -> ntkrnlpa!IofCallDriver[0x804EE0F6] -> \Device\Scsi\viamraid1Port2Path0Target0Lun0[0x86585A38]

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

user != kernel MBR !!!

sectors 156368014 (+255): user != kernel

============= FINISH: 4:20:46,20 ===============

Renato Utsch · Dezembro 17, 2010

Olá!

Ah, bom, tenho quase certeza que esse rootkit para o qual o ComboFix aponta é para esse seu driver de WebCam. Talvez seja um falso positivo.

Por favor, desinstale o seu driver de WebCam e refaça o scan com o ComboFix. Me diga se o aviso quanto a rootkits ainda continua.

---

<< 2 >>

Siga o tutorial abaixo e execute o Ad-Remover. Utilize a opção clean e poste o log gerado.

Tutorial do Ad-Remover

Abraços :D

lucasbsp · Dezembro 17, 2010

olá entao....desinstalei a web mas mesmo assim deu a mesma mensagem e passei o outro programa ad-r uma coisa boa o recycler na unidade d: nao apareceu dessa vez quando passei o combofix segue os logs

ComboFix 10-12-16.04 - Lucas 17/12/2010 12:01:39.8.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1023.782 [GMT -2:00]