iSombra 0 Denunciar post Postado Abril 3, 2011 Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Versão da Base de Dados: 6253 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 3/4/2011 02:38:39 mbam-log-2011-04-03 (02-38-39).txt Tipo de Verificação: Verificação Completa (C:\|) Objetos escaneados: 218891 Tempo decorrido: 44 minuto(s), 39 segundo(s) Processos de Memória Infectados: 0 Módulos de Memória Infectados: 0 Chaves de Registro Infectadas: 0 Valores de Registro Infectados: 1 Itens de Dados no Registro Infectados: 0 Pastas Infectadas: 1 Arquivos Infectados: 22 Processos de Memória Infectados: (Não foram detectados ítens maliciosos) Módulos de Memória Infectados: (Não foram detectados ítens maliciosos) Chaves de Registro Infectadas: (Não foram detectados ítens maliciosos) Valores de Registro Infectados: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdVantage (Adware.Vomba) -> Value: AdVantage -> Quarantined and deleted successfully. Itens de Dados no Registro Infectados: (Não foram detectados ítens maliciosos) Pastas Infectadas: c:\documents and settings\all users\menu iniciar\programas\ardamax keylogger (PUP.ArdamaxKeyLogger) -> Not selected for removal. Arquivos Infectados: c:\documents and settings\all users\documentos\afqjop.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\usuario\dados de aplicativos\wplugin.dll (Trojan.Dropper) -> Quarantined and deleted successfully. c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\cópia de ragnarok online\GF.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully. c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\warcraft iii\xpam.exe (Trojan.MultiDropper) -> Quarantined and deleted successfully. c:\documents and settings\Usuario\Desktop\my shared folder\penis drive\sony vegas pro 10\sony vegas 10 32-bit\Keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. c:\arquivos de programas\htv\htv.003 (PUP.ArdamaxKeyLogger) -> Not selected for removal. c:\arquivos de programas\htv\htv.004 (PUP.ArdamaxKeyLogger) -> Not selected for removal. c:\arquivos de programas\htv\htv.007 (PUP.ArdamaxKeyLogger) -> Not selected for removal. c:\arquivos de programas\htv\jeremias cabra homem.exe (Spyware.Ardamax) -> Quarantined and deleted successfully. c:\windows\wplugin.dll (Trojan.Dropper) -> Quarantined and deleted successfully. c:\windows\system32\dp1.fne (Worm.Autorun) -> Quarantined and deleted successfully. c:\windows\system32\internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully. c:\windows\system32\pv40f20.exe (Trojan.FlyStudi.Gen) -> Quarantined and deleted successfully. c:\windows\system32\zh262.exe (Trojan.FlyStudi.Gen) -> Quarantined and deleted successfully. c:\WINDOWS\system32\krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\og.dll (Worm.AutoRun) -> Quarantined and deleted successfully. c:\WINDOWS\system32\og.EDT (Worm.AutoRun) -> Quarantined and deleted successfully. c:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> Quarantined and deleted successfully. c:\documents and settings\Usuario\dados de aplicativos\advantage\advantage.exe (Adware.Vomba) -> Quarantined and deleted successfully. c:\documents and settings\all users\menu iniciar\programas\ardamax keylogger\ardamax keylogger.lnk (PUP.ArdamaxKeyLogger) -> Not selected for removal. c:\documents and settings\all users\menu iniciar\programas\ardamax keylogger\Help.lnk (PUP.ArdamaxKeyLogger) -> Not selected for removal. c:\documents and settings\all users\menu iniciar\programas\ardamax keylogger\log viewer.lnk (PUP.ArdamaxKeyLogger) -> Not selected for removal. Observações: Eu não deletei a pasta porque logo após verificar o Malwarebytes' Anti-Malware, não mexi em mais nada além de remover os selecionados e, como pode ser visto no log, tudo sobre o Ardamax não estava selecionado e por precaução, também não selecionei. Qualquer dúvida sobre o uso do mesmo, posso responder também, rs. Agradeço desde já. Abraços, iSombra. Compartilhar este post Link para o post Compartilhar em outros sites
Felipe_88 0 Denunciar post Postado Abril 3, 2011 Olá, iSombra! Seja Bem Vindo ao iMasters Fóruns! Equívoco não! Pode ter certeza.. e foi instalado manualmente pelo jeito... Deseja verificar se o Ardamax ainda está ativo e prosseguir com análise/remoção dos vírus? Compartilhar este post Link para o post Compartilhar em outros sites
iSombra 0 Denunciar post Postado Abril 7, 2011 Olá, obrigado pelas boas-vindas e atenção imediata ao meu problema. Parabéns. @Topic Bom.. sinceramente ele foi instalado sim manualmente. Gostaria de verificar sim e, se possível saber se eu estou sendo vigiado por ter instalado ele ou se ele está apenas para meu uso e, quais danos estou sendo exposto. Agradeço novamente, boa noite. Obrigado :D @Offtopic Bom, eu estou com um problema também, e pra ser sincero, acho que é descuido meu visto que não formato minha máquina desde o ano passado, mas qualquer pasta que eu vou abrir, ela abre a pasta "Meus Documentos" antes e, a a pasta "Meus Documentos" está um pouco... diferente. Segue a print da pasta: up? Compartilhar este post Link para o post Compartilhar em outros sites
Felipe_88 0 Denunciar post Postado Abril 12, 2011 iSombra, Faça conforme a Regra Nº2 - Utilizando o hijackthis Fico no aguardo! Compartilhar este post Link para o post Compartilhar em outros sites
iSombra 0 Denunciar post Postado Abril 14, 2011 Creio que fiz corretamente né ? Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 15:04:19, on 14/4/2011 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\TeamViewer\Version6\TeamViewer_Service.exe C:\Arquivos de programas\IObit\Game Booster\GameBox.exe C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Arquivos de programas\Real\RealPlayer\update\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\Messenger\msmsgs.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Arquivos de programas\Orbitdownloader\orbitdm.exe C:\Arquivos de programas\Orbitdownloader\orbitnet.exe C:\Downloads\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.localstrike.com.ar/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.localstrike.com.ar/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/ O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Dados de aplicativos\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll O4 - HKLM\..\Run: [avast5] C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe /nogui O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD9\Language\Language.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] C:\Arquivos de programas\NVIDIA Corporation\nView\nwiz.exe /installquiet O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Real\RealPlayer\update\realsched.exe" -osboot O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ccleaner] "C:\Arquivos de programas\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [badoo Desktop] "C:\Documents and Settings\All Users\Dados de aplicativos\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/uno1/GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Mail Scanner - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Web Scanner - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version6\TeamViewer_Service.exe -- End of file - 8944 bytes Compartilhar este post Link para o post Compartilhar em outros sites
Felipe_88 0 Denunciar post Postado Abril 16, 2011 iSombra, 1º Abra novamente o hijackthis clique em » Do a system scam only marque a(s) seguinte(s) linha(s) abaixo, clique em Fix checked: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.localstrike.com.ar/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.localstrike.com.ar/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.localstrike.com.ar/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.localstrike.com.ar/ O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 2º *Baixe o ComboFix e salve-o no desktop * Desative seu antivírus temporariamente: Clique com o botão direito do mouse no ícone do Avast ao lado do relógio > Selecione "Pausar a proteção residente" > Confirme. *Execute o Combofix e aceite o contrato *Se o console de recuperação do Windows já estiver instalado, o ComboFix continuará o processo automaticamente. Caso contrário, clique em [sIM] para a sua instalação. *Clique em [sIM] para continuar. *Aguarde a conclusão de todas as etapas *Enquanto o ComboFix estiver em execução, evite usar o mouse e o teclado!!..... Para interromper o procedimento tecle N ou 2 e depois ENTER. *O programa será fechado automaticamente e um relatório (C:\combofix.txt) será apresentado. Cole-o na próxima resposta. No Aguardo. Compartilhar este post Link para o post Compartilhar em outros sites
iSombra 0 Denunciar post Postado Abril 16, 2011 Felipe_88, Após ter feito o processo indicado nesse tópico pelo HiJackThis, fiz outro análise para ver se fiz tudo corretamente, segue o log: Logfile of Trend Micro HijackThis v2.0.4Scan saved at 13:48:22, on 16/4/2011 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\IObit\Game Booster\GameBox.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\TeamViewer\Version6\TeamViewer_Service.exe C:\Arquivos de programas\TeamViewer\Version6\TeamViewer.exe C:\Arquivos de programas\TeamViewer\Version6\tv_w32.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Arquivos de programas\Real\RealPlayer\update\realsched.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\Documents and Settings\All Users\Dados de aplicativos\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe C:\downloads\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Dados de aplicativos\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll O4 - HKLM\..\Run: [avast5] C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe /nogui O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Arquivos de programas\CyberLink\PowerDVD9\Language\Language.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] C:\Arquivos de programas\NVIDIA Corporation\nView\nwiz.exe /installquiet O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Real\RealPlayer\update\realsched.exe" -osboot O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ccleaner] "C:\Arquivos de programas\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [badoo Desktop] "C:\Documents and Settings\All Users\Dados de aplicativos\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/pt/uno1/GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Mail Scanner - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Web Scanner - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version6\TeamViewer_Service.exe -- End of file - 7884 bytes Agora o processo feito pelo ComboFix, segue o log: ComboFix 11-04-15.06 - Usuario 16/04/2011 13:23:08.1.2 - x86Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1533.976 [GMT -3:00] Executando de: c:\downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\arquivos de programas\HTV c:\arquivos de programas\HTV\akv.cfg c:\arquivos de programas\HTV\HTV.001 c:\arquivos de programas\HTV\HTV.002 c:\arquivos de programas\HTV\HTV.009 c:\arquivos de programas\HTV\HTV.chm c:\arquivos de programas\HTV\menu.gif c:\arquivos de programas\HTV\qs.html c:\arquivos de programas\HTV\tray.gif c:\arquivos de programas\HTV\Uninstall.exe c:\documents and settings\All Users\Dados de aplicativos\Adobe Systems c:\documents and settings\All Users\Dados de aplicativos\Adobe Systems\Product licenses\B2B86000.dat c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger\Ardamax Keylogger.lnk c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger\Help.lnk c:\documents and settings\All Users\Menu Iniciar\Programas\Ardamax Keylogger\Log Viewer.lnk c:\documents and settings\Usuario\Dados de aplicativos\AdVantage c:\documents and settings\Usuario\Dados de aplicativos\PriceGong c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\1.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\a.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\b.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\c.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\d.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\e.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\f.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\g.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\h.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\i.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\J.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\k.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\l.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\m.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\mru.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\n.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\o.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\p.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\q.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\r.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\s.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\t.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\u.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\v.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\w.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\x.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\y.xml c:\documents and settings\Usuario\Dados de aplicativos\PriceGong\Data\z.xml c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Cópia de Ragnarok Online\skin\default\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Cópia de Ragnarok Online\skin\default\basic_interface\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Cópia de Ragnarok Online\skin\Scribbling Kid\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Cópia de Ragnarok Online\skin\Scribbling Kid\basic_interface\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Ragnarok Online\skin\default\basic_interface\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Ragnarok Online\skin\Scribbling Kid\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\Igor\downloads e instaladores\Ragnarok Online\skin\Scribbling Kid\basic_interface\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\Cópia de Ragnarok Online\skin\default\basic_interface\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\Cópia de Ragnarok Online\skin\Scribbling Kid\_desktop.ini c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\Cópia de Ragnarok Online\skin\Scribbling Kid\basic_interface\_desktop.ini c:\documents and settings\Usuario\WINDOWS c:\windows\explorer.exe.local c:\windows\system32\AutoRun.inf . c:\windows\system32\userinit.exe . . . está infectado!! . . ((((((((((((((((((((((((((((((((((((((( Drivers/Serviços ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_UacFlt -------\Service_UacFlt . . (((((((((((((((( Arquivos/Ficheiros criados de 2011-03-16 to 2011-04-16 )))))))))))))))))))))))))))) . . 2011-04-15 16:37 . 2011-04-15 16:37 -------- d-----w- C:\ijji 2011-04-14 11:52 . 2011-04-14 11:52 -------- d-----w- c:\documents and settings\Usuario\Configurações locais\Dados de aplicativos\id Software 2011-04-14 11:48 . 2011-04-14 11:48 139152 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2011-04-14 11:48 . 2011-04-14 11:48 139152 ----a-w- c:\documents and settings\Usuario\Dados de aplicativos\PnkBstrK.sys 2011-04-14 11:48 . 2011-04-14 11:48 111928 ----a-w- c:\windows\system32\PnkBstrB.exe 2011-04-14 11:48 . 2011-04-14 11:48 794408 ----a-w- c:\windows\system32\pbsvc.exe 2011-04-14 11:48 . 2011-04-14 11:48 75064 ----a-w- c:\windows\system32\PnkBstrA.exe 2011-04-14 11:48 . 2011-04-14 11:48 -------- d-----w- c:\windows\system32\LogFiles 2011-04-14 11:09 . 2011-04-14 11:09 -------- d-----w- c:\arquivos de programas\Activision 2011-04-14 11:08 . 2011-04-14 11:08 -------- d-sh--w- c:\windows\ftpcache 2011-04-12 18:04 . 2011-04-12 18:04 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\ijjigame 2011-04-12 18:01 . 2010-07-27 19:13 27136 ----a-w- c:\arquivos de programas\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll 2011-04-12 18:01 . 2010-03-24 19:57 713312 ----a-w- c:\windows\system32\ijjiSetup.exe 2011-04-12 18:01 . 2010-03-24 19:56 62048 ----a-w- c:\windows\system32\ijjiProcessRestarter.exe 2011-04-12 18:01 . 2011-04-16 05:44 -------- d-----w- c:\arquivos de programas\REACTOR 2011-04-07 11:38 . 2011-04-07 11:38 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Sony Setup 2011-04-07 11:37 . 2011-04-07 11:37 -------- d-----w- c:\arquivos de programas\Sony Setup 2011-04-03 04:32 . 2011-04-03 04:32 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes 2011-04-03 04:32 . 2011-04-03 04:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes 2011-04-03 04:32 . 2010-12-20 21:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-04-03 04:32 . 2011-04-03 04:32 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware 2011-04-03 04:32 . 2010-12-20 21:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-03-31 08:18 . 2011-03-31 08:18 -------- d-----w- c:\arquivos de programas\FreeTime 2011-03-31 08:14 . 2011-03-31 08:14 -------- d--h--w- c:\documents and settings\Usuario\Configurações locais\Dados de aplicativos\AlterGeo 2011-03-31 08:14 . 2011-03-31 08:14 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Badoo 2011-03-26 06:38 . 2011-03-26 06:38 11776 ----a-w- c:\arquivos de programas\Mozilla Firefox\plugins\nprjplug.dll 2011-03-26 06:37 . 2011-03-26 06:37 -------- d-----w- c:\arquivos de programas\Arquivos comuns\xing shared 2011-03-26 06:37 . 2011-03-26 06:37 150712 ----a-w- c:\arquivos de programas\Mozilla Firefox\plugins\nppl3260.dll 2011-03-26 06:37 . 2011-03-26 06:37 100864 ----a-w- c:\arquivos de programas\Mozilla Firefox\plugins\nprpjplug.dll 2011-03-24 18:28 . 2011-03-24 18:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\SpieleEntwicklungsKombinat 2011-03-24 18:28 . 2011-03-24 18:28 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\SpieleEntwicklungsKombinat 2011-03-22 02:31 . 2011-03-22 02:31 -------- d-----w- C:\Ntreev USA . . . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-26 06:37 . 2010-09-30 01:41 499712 ----a-w- c:\windows\system32\msvcp71.dll 2011-03-26 06:37 . 2010-09-30 01:41 348160 ----a-w- c:\windows\system32\msvcr71.dll 2011-03-13 12:26 . 2011-03-13 12:26 2560 ----a-w- c:\windows\_MSRSTRT.EXE 2011-03-01 15:49 . 2011-03-10 07:31 4063560 ----a-w- c:\windows\system32\GameMon.des 2011-02-28 08:00 . 2011-03-17 04:00 80896 ----a-w- c:\windows\system32\ff_vfw.dll . . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080] "ccleaner"="c:\arquivos de programas\CCleaner\CCleaner.exe" [2011-01-24 2200376] "Badoo Desktop"="c:\documents and settings\All Users\Dados de aplicativos\Badoo\Badoo Desktop\1.2.22.828\Badoo.Desktop.exe" [2010-10-29 983552] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast5"="c:\arquiv~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912] "PDVD9LanguageShortcut"="c:\arquivos de programas\CyberLink\PowerDVD9\Language\Language.exe" [2008-10-13 50472] "SunJavaUpdateSched"="c:\arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2010-05-14 248552] "HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752] "nwiz"="c:\arquivos de programas\NVIDIA Corporation\nView\nwiz.exe" [2010-08-26 1753192] "TkBellExe"="c:\arquivos de programas\Real\RealPlayer\update\realsched.exe" [2011-03-26 273544] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] . [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup . [HKLM\~\startupfolder\C:^Documents and Settings^Usuario^Menu Iniciar^Programas^Inicializar^Adobe Gamma.lnk] path=c:\documents and settings\Usuario\Menu Iniciar\Programas\Inicializar\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion] 2009-02-28 22:40 75048 ----a-w- c:\arquivos de programas\CyberLink\Shared Files\brs.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-13 18:20 15360 ----a-w- c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] 2010-04-01 09:16 357696 ----a-w- c:\arquivos de programas\DAEMON Tools Lite\DTLite.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] 2009-03-28 21:11 3325952 ----a-w- c:\arquivos de programas\Electronic Arts\EADM\Core.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-10-15 19:09 136176 ----atw- c:\documents and settings\Usuario\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 01:21 1695232 ------w- c:\arquivos de programas\Messenger\msmsgs.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 14:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2010-10-16 14:04 13851752 ----a-w- c:\windows\system32\nvcpl.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2010-10-16 14:04 110696 ----a-w- c:\windows\system32\nvmctray.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9] 2009-02-16 12:55 87336 ------w- c:\arquivos de programas\CyberLink\PowerDVD9\PDVD9Serv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] 2010-09-07 22:20 19573352 ----a-w- c:\windows\RTHDCPL.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2010-05-13 19:12 26192168 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "c:\\Documents and Settings\\Usuario\\Configurações locais\\Dados de aplicativos\\Kamuse\\KCSTrayDownloader\\KCSTrayDownloaderEngine.exe"= "c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Arquivos de programas\\Ares\\Ares.exe"= "c:\\Documents and Settings\\All Users\\Dados de aplicativos\\NexonUS\\NGM\\NGM.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Arquivos de programas\\RkSoft\\Xadrez\\xadrez.exe"= "c:\\Arquivos de programas\\Steam\\Steam.exe"= "c:\\Arquivos de programas\\TeamViewer\\Version6\\TeamViewer.exe"= "c:\\Arquivos de programas\\TeamViewer\\Version6\\TeamViewer_Service.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"= "c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"= "c:\\Arquivos de programas\\Garena\\Garena.exe"= "c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"= "c:\\Arquivos de programas\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Documents and Settings\\Usuario\\Desktop\\# Igor\\Igor\\downloads e instaladores\\Combat Arms\\NMService.exe"= "c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Arquivos de programas\\Activision\\Wolfenstein\\MP\\Wolf2MP.exe"= "c:\\Arquivos de programas\\Activision\\Wolfenstein\\MP\\Wolf2MPLite.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "58204:TCP"= 58204:TCP:Pando Media Booster "58204:UDP"= 58204:UDP:Pando Media Booster . R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20/10/2010 17:58 691696] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29/9/2010 21:30 165584] R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/09/29 22:42];c:\arquivos de programas\CyberLink\PowerDVD9\000.fcl [28/2/2009 19:40 87536] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29/9/2010 21:30 17744] R2 TeamViewer6;TeamViewer 6;c:\arquivos de programas\TeamViewer\Version6\TeamViewer_Service.exe [16/12/2010 06:58 2228008] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [30/9/2010 00:25 100712] R3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23/1/2004 15:33 13952] R3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23/1/2004 15:32 28800] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [29/9/2010 21:14 1691480] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2/12/2010 14:24 16512] S3 cpuz134;cpuz134;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz134\cpuz134_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz134\cpuz134_x32.sys [?] S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?] S3 GGSAFERDriver;GGSAFER Driver;\??\c:\arquivos de programas\Garena\safedrv.sys --> c:\arquivos de programas\Garena\safedrv.sys [?] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [1/7/2010 13:21 34896] S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?] S3 XDva370;XDva370;\??\c:\windows\system32\XDva370.sys --> c:\windows\system32\XDva370.sys [?] S3 XDva374;XDva374;\??\c:\windows\system32\XDva374.sys --> c:\windows\system32\XDva374.sys [?] S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Conteúdo da pasta 'Tarefas Agendadas' . 2011-04-16 c:\windows\Tasks\Game_Booster_Startup.job - c:\arquivos de programas\IObit\Game Booster\GameBox.exe [2010-11-17 12:55] . 2011-04-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-117609710-1637723038-1801674531-1003.job - c:\arquivos de programas\Real\RealUpgrade\realupgrade.exe [2011-01-24 17:25] . 2011-04-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-117609710-1637723038-1801674531-1003.job - c:\arquivos de programas\Real\RealUpgrade\realupgrade.exe [2011-01-24 17:25] . . ------- Scan Suplementar ------- . IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202 FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\v40zmihh.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.localstrike.com.ar/?q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br/ FF - prefs.js: keyword.URL - hxxp://search.localstrike.com.ar/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - prefs.js: network.proxy.type - 0 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\arquivos de programas\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\arquivos de programas\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} FF - Ext: Orkut Manager: om.brunolm@gmail.com - %profile%\extensions\om.brunolm@gmail.com FF - Ext: Java Quick Starter: jqs@sun.com - c:\arquivos de programas\Java\jre6\lib\deploy\jqs\ff FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Dados de aplicativos\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext . - - - - ORFÃOS REMOVIDOS - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) MSConfigStartUp-WinampAgent - c:\arquivos de programas\Winamp\winampa.exe AddRemove-Combat Arms - c:\level up! games\Combat Arms\NGM.exe AddRemove-FansRO 6.0a_is1 - c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\Fansro\fansro\unins000.exe AddRemove-{87BD1A8C-9174-43A5-8C73-56327148F7BC}_is1 - c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\Cópia de Ragnarok Online\RagnaFan - Aurora\unins000.exe AddRemove-{9171DE58-8BA2-4850-B23B-A8A7498A7303}_is1 - c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\RagnaFan - Promised\unins000.exe AddRemove-{DDE3BD76-C160-4AA3-8DA7-6542CC2AC65B}_is1 - c:\documents and settings\Usuario\Desktop\# Igor\RAGNAROK\Cópia (2) de Ragnarok Online\RagnaFan - Aurora\unins000.exe AddRemove-PointBlank - c:\ongame\Pointblank\PBUnInst.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-04-16 13:36 Windows 5.1.2600 Service Pack 3 NTFS . Procurando processos ocultos ... . Procurando entradas auto inicializáveis ocultas ... . Procurando ficheiros/arquivos ocultos ... . Varredura completada com sucesso arquivos/ficheiros ocultos: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}] "ImagePath"="\??\c:\arquivos de programas\CyberLink\PowerDVD9\000.fcl" . --------------------- CHAVES DO REGISTRO BLOQUEADAS --------------------- . [HKEY_USERS\S-1-5-21-117609710-1637723038-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID] @Denied: (Full) (LocalSystem) . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Carregadas Sob os Processos em Execução --------------------- . - - - - - - - > 'explorer.exe'(3160) c:\arquiv~1\WINDOW~2\wmpband.dll c:\windows\system32\ieframe.dll c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\webcheck.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Outros Processos em Execução ------------------------ . c:\windows\system32\nvsvc32.exe c:\arquivos de programas\Alwil Software\Avast5\AvastSvc.exe c:\arquivos de programas\Java\jre6\bin\jqs.exe c:\windows\system32\PnkBstrA.exe c:\arquivos de programas\TeamViewer\Version6\TeamViewer.exe c:\arquivos de programas\TeamViewer\Version6\tv_w32.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\wscntfy.exe c:\windows\system32\RUNDLL32.EXE . ************************************************************************** . Tempo para conclusão: 2011-04-16 13:41:07 - Máquina reiniciou ComboFix-quarantined-files.txt 2011-04-16 16:41 . Pré-execução: 15 pasta(s) 20.755.750.912 bytes disponíveis Pós execução: 16 pasta(s) 20.766.785.536 bytes disponíveis . WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe [boot Loader] timeout=2 Default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [Operating Systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="USB Repair NOT to Start Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - 38448C0FE4C3EB331E834B1DA40569ED Aguardo contato, abraços. Compartilhar este post Link para o post Compartilhar em outros sites
Felipe_88 0 Denunciar post Postado Abril 17, 2011 iSombra, Sabe a procedêcia dessa pasta? C:\ijji Compartilhar este post Link para o post Compartilhar em outros sites
iSombra 0 Denunciar post Postado Abril 17, 2011 Felipe_88, Sim, é a pasta do fornecedor do jogo A.V.A (Alliance of Valiant Arms) Compartilhar este post Link para o post Compartilhar em outros sites
Felipe_88 0 Denunciar post Postado Abril 23, 2011 iSombra, Dando continuidade... *Abra o bloco de notas, selecione, copie e cole nele todo o conteúdo do código abaixo: Killall::File:: c:\windows\vtany.sys c:\windows\system32\XDva370.sys c:\windows\system32\XDva374.sys c:\windows\xhunter1.sys Drivers:: vtany XDva370 XDva374 *Salve o arquivo no desktop como CFScript.txt *Arraste o arquivo para o Combofix conforme ilustração abaixo: *Importante: enquanto o combofix estiver em execução, não use o mouse nem o teclado!! *Ao final do procedimento, o programa será fechado automaticamente e será mostrado o relatório *Cole o relatório criado em C:\combofix.txt Compartilhar este post Link para o post Compartilhar em outros sites
wings 22 Denunciar post Postado Maio 23, 2011 Tópico Arquivado Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
