Bom dia.
Gostaria que o meu log do HijackThis fosse analizado. Do nada meu mouse se mexe e abre pastas e arquivos sozinho.
Segue o log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:03, on 23/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\winmgr\winmgr.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\Arquivos de programas\Outlook Express\msimn.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,
O1 - Hosts: 200.205.55.58 216.129.112.81
O1 - Hosts: 0.0.0.1 www5.messengerfx.com
O1 - Hosts: 0.0.0.1 www.msn2go.com
O1 - Hosts: 0.0.0.1 www.researchhaven.com/Chat.htm
O1 - Hosts: 0.0.0.1 www.researchhaven.com
O1 - Hosts: 0.0.0.8 iloveim.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ExcellentAdDisplay - {F31C8969-83E7-A513-2E11-CB6D1837C2CB} - C:\Arquivos de programas\ExcellentAdDisplay\ExcellentAdDisplay.dll (file missing)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Setup Windows Media Player] C:\Arquivos de programas\Windows Media Player\Wsetup_wm.exe
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification015] C:\WINDOWS\system32\Google_Tool_Bar_Notification015.exe
O4 - HKLM\..\Run: [WinMgr] C:\WINDOWS\winmgr\winmgr.exe /auto
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Setup Windows Media Player] C:\Arquivos de programas\Windows Media Player\Wsetup_wm.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 10577 bytes
Obrigado a todos.
Versão Completa hijackThis log para analise.
Seja bem-vindo(a) à Linha Defensiva
Meu nome é José Melo,
Para que possamos ter sucesso ao final dos procedimentos, sugiro que siga estritamente o que lhe for proposto e não use qualquer ferramenta ou programa, que não seja os aqui recomendados;
Não desinstale nenhuma ferramenta que esteja sendo usada, até a finalização dos procedimentos;
Qualquer dúvida quanto a qualquer procedimento aqui indicado, não hesite em perguntar aqui no tópico ou via Mensagem Pessoal;
Caso tenha um tópico em andamento em outro fórum, recomendo que o abandone para que os procedimentos não sejam conflitantes;
Se preferir receber por e-mail um aviso toda vez que houver resposta no seu tópico, clique em
no alto da página e em Assinar este tópico.
Se tiver mais de um antivírus instalado, mantenha somente um para evitar conflitos e lentidão ao sistema. Faça o mesmo para antispyware com proteção residente.
Meu nome é José Melo,
Para que possamos ter sucesso ao final dos procedimentos, sugiro que siga estritamente o que lhe for proposto e não use qualquer ferramenta ou programa, que não seja os aqui recomendados;
Não desinstale nenhuma ferramenta que esteja sendo usada, até a finalização dos procedimentos;
Qualquer dúvida quanto a qualquer procedimento aqui indicado, não hesite em perguntar aqui no tópico ou via Mensagem Pessoal;
Caso tenha um tópico em andamento em outro fórum, recomendo que o abandone para que os procedimentos não sejam conflitantes;
Se preferir receber por e-mail um aviso toda vez que houver resposta no seu tópico, clique em
Se tiver mais de um antivírus instalado, mantenha somente um para evitar conflitos e lentidão ao sistema. Faça o mesmo para antispyware com proteção residente.
| QUOTE |
| Do nada meu mouse se mexe e abre pastas e arquivos sozinho. |
Você tem um programa de acesso remoto instalado. Pode ser esse o problema.
- Faça o download do Malwarebytes Anti-Malware
http://www.besttechie.net/tools/mbam-setup.exe
- Faça a instalação dando um duplo clique em "mbam-setup.exe";
- Marque "Atualizar Malwarebytes Anti-Malware" e "Executar Malwarebytes Anti-Malware", e clique em concluir;
- Marque "Verificação Completa" e depois clique em Verificar;
- Quando o scan terminar, clique em Ok e em "Mostrar Resultados" para ver o log;
- Se algo for detectado, veja se tudo está marcado e clique em "Remover";
- O log é automaticamente gravado e pode ser consultado clicando em "Logs" do menu principal;
- Copie e cole o conteúdo desse log na sua próxima resposta.
Obrigado por responder.
Sim, uso o logmein e o team viewer para acessar meu pc quando não estou em casa.
Segue log do MalwareBytes anti-malware
Malwarebytes' Anti-Malware 1.44
Versão do banco de dados: 3792
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
25/2/2010 14:16:50
mbam-log-2010-02-25 (14-16-50).txt
Tipo de Verificação: Completa (C:\|)
Objetos verificados: 152791
Tempo decorrido: 50 minute(s), 1 second(s)
Processos da Memória infectados: 0
Módulos de Memória Infectados: 0
Chaves do Registro infectadas: 13
Valores do Registro infectados: 3
Ítens do Registro infectados: 5
Pastas infectadas: 1
Arquivos infectados: 2
Processos da Memória infectados:
(Nenhum ítem malicioso foi detectado)
Módulos de Memória Infectados:
(Nenhum ítem malicioso foi detectado)
Chaves do Registro infectadas:
HKEY_CLASSES_ROOT\excellentaddisplay.excellentaddisplay (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\excellentaddisplay.excellentaddisplay.1 (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{418d86be-7386-4f1a-83e0-53604adbda74} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f31c8969-83e7-a513-2e11-cb6d1837c2cb} (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f31c8969-83e7-a513-2e11-cb6d1837c2cb} (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f31c8969-83e7-a513-2e11-cb6d1837c2cb} (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\ExcellentAdDisplay.dll (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ExcellentAdDisplay (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PLayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ExcellentAdDisplay (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\blazedWorm (Worm.BlazeBot) -> Quarantined and deleted successfully.
Valores do Registro infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup windows media player (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup windows media player (Trojan.Agent) -> Quarantined and deleted successfully.
Ítens do Registro infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.
Pastas infectadas:
C:\WINDOWS\system32\twain32 (Backdoor.Bot) -> Quarantined and deleted successfully.
Arquivos infectados:
C:\WINDOWS\system32\twain32\local.ds (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twain32\user.ds (Backdoor.Bot) -> Quarantined and deleted successfully.
Segue novo log do HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:23:26, on 25/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\winmgr\winmgr.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O1 - Hosts: 200.205.55.58 216.129.112.81
O1 - Hosts: 0.0.0.1 www5.messengerfx.com
O1 - Hosts: 0.0.0.1 www.msn2go.com
O1 - Hosts: 0.0.0.1 www.researchhaven.com/Chat.htm
O1 - Hosts: 0.0.0.1 www.researchhaven.com
O1 - Hosts: 0.0.0.8 iloveim.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification015] C:\WINDOWS\system32\Google_Tool_Bar_Notification015.exe
O4 - HKLM\..\Run: [WinMgr] C:\WINDOWS\winmgr\winmgr.exe /auto
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 10181 bytes
Agradeço.
Sim, uso o logmein e o team viewer para acessar meu pc quando não estou em casa.
Segue log do MalwareBytes anti-malware
Malwarebytes' Anti-Malware 1.44
Versão do banco de dados: 3792
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
25/2/2010 14:16:50
mbam-log-2010-02-25 (14-16-50).txt
Tipo de Verificação: Completa (C:\|)
Objetos verificados: 152791
Tempo decorrido: 50 minute(s), 1 second(s)
Processos da Memória infectados: 0
Módulos de Memória Infectados: 0
Chaves do Registro infectadas: 13
Valores do Registro infectados: 3
Ítens do Registro infectados: 5
Pastas infectadas: 1
Arquivos infectados: 2
Processos da Memória infectados:
(Nenhum ítem malicioso foi detectado)
Módulos de Memória Infectados:
(Nenhum ítem malicioso foi detectado)
Chaves do Registro infectadas:
HKEY_CLASSES_ROOT\excellentaddisplay.excellentaddisplay (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\excellentaddisplay.excellentaddisplay.1 (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{418d86be-7386-4f1a-83e0-53604adbda74} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f31c8969-83e7-a513-2e11-cb6d1837c2cb} (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f31c8969-83e7-a513-2e11-cb6d1837c2cb} (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f31c8969-83e7-a513-2e11-cb6d1837c2cb} (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\ExcellentAdDisplay.dll (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ExcellentAdDisplay (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PLayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ExcellentAdDisplay (Adware.PlayMP3z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\blazedWorm (Worm.BlazeBot) -> Quarantined and deleted successfully.
Valores do Registro infectados:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup windows media player (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup windows media player (Trojan.Agent) -> Quarantined and deleted successfully.
Ítens do Registro infectados:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.
Pastas infectadas:
C:\WINDOWS\system32\twain32 (Backdoor.Bot) -> Quarantined and deleted successfully.
Arquivos infectados:
C:\WINDOWS\system32\twain32\local.ds (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twain32\user.ds (Backdoor.Bot) -> Quarantined and deleted successfully.
Segue novo log do HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:23:26, on 25/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\winmgr\winmgr.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O1 - Hosts: 200.205.55.58 216.129.112.81
O1 - Hosts: 0.0.0.1 www5.messengerfx.com
O1 - Hosts: 0.0.0.1 www.msn2go.com
O1 - Hosts: 0.0.0.1 www.researchhaven.com/Chat.htm
O1 - Hosts: 0.0.0.1 www.researchhaven.com
O1 - Hosts: 0.0.0.8 iloveim.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification015] C:\WINDOWS\system32\Google_Tool_Bar_Notification015.exe
O4 - HKLM\..\Run: [WinMgr] C:\WINDOWS\winmgr\winmgr.exe /auto
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 10181 bytes
Agradeço.
- Faça o download do HostsXpert, descompacte o arquivo, abra o programa e clique em Restore MS Hosts File;
- Faça o download do ComboFix de sUBs e salve-o no desktop;
OBS: Para que a ferramenta seja executada é necessário que esteja no desktop (área de trabalho)
- Faça o download do ComboFix de sUBs e salve-o no desktop;
OBS: Para que a ferramenta seja executada é necessário que esteja no desktop (área de trabalho)
- Desative, temporariamente, o antivírus;
- Feche todas as janelas abertas;
- Dê um duplo clique no ComboFix;
- Na próxima janela clique em Executar, aceite o contrato e aguarde até que o relatório seja gerado;
OBS: Caso não queira que seja instalado o console de recuperação do Windows, clique em "Não" e depois concorde que a verificação prossiga.
Ao ser instalado o console, na inicialização do sistema será apresentada a tela para seleção dos sistemas operacionais.
Mais informações sobre o Console: http://support.microsoft.com/kb/307654/pt-br - Caso ocorra algum erro, reinicie o computador em Modo Seguro (pressione a tecla F8 intermitentemente, ou F5 em alguns casos, durante a inicialização) e repita o procedimento;
- O ComboFix "poderá" reiniciar o PC automaticamente para completar o processo de remoção.
- Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.
- Não clique na Janela do ComboFix, nem o feche clicando no X, enquanto estiver rodando, não mova o mouse e não use o teclado, pois senão irá parar e seu desktop ficará em branco.
- Para parar ou sair do ComboFix, tecle "N".
- Se perder a conexão com a internet, reinicie o computador. Caso o problema persista, abra Conexões de Rede no Painel de Controle, clique com o botão direito do mouse sobre a sua conexão com a internet e em "Reparar";
- Anexe o ComboFix.txt à sua resposta conforme as instruções abaixo
http://www.linhadefensiva.org/forum/index.php?showtopic=595
Obrigado por responder.
Segue anexado o combofix.txt
Obs: Ocorreu esse erro ao execultar o HostsXpert.
ERROR: Cannot create file: C:\WINDOWS\system32\DRIVERS\ETC\hosts
Obs1: até antes de execultar o combofix, o invasor ainda tinha acesso ao meu pc. Ele abre pastas e acessa paginas de cassino no internet explorer.
Aguardo retorno.
Segue anexado o combofix.txt
Obs: Ocorreu esse erro ao execultar o HostsXpert.
ERROR: Cannot create file: C:\WINDOWS\system32\DRIVERS\ETC\hosts
Obs1: até antes de execultar o combofix, o invasor ainda tinha acesso ao meu pc. Ele abre pastas e acessa paginas de cassino no internet explorer.
Aguardo retorno.
- Selecione o texto abaixo e copie para o bloco de notas. Salve-o como CFScript.txt;
| CODE |
| File:: c:\windows\system32\000006716.zip c:\windows\system32\000006986.zip c:\windows\system32\VIDEO-BBB-10_000003406.zip c:\windows\system32\VIDEO-BBB-10_000004794.zip c:\windows\system32\000009264.zip c:\windows\system32\000006608.zip c:\windows\system32\bbb10_000002444.zip c:\windows\system32\bbb10_0000010886.zip c:\windows\system32\Video_000004748.zip c:\windows\system32\000008886.zip c:\windows\system32\000007692.zip c:\windows\system32\Video_000003980.zip c:\windows\system32\bbb10_000001125.zip c:\windows\system32\bbb10_000001637.zip c:\windows\system32\000007773.zip c:\windows\system32\bbb10_000001062.zip c:\windows\system32\Video_000005198.zip c:\windows\system32\000008330.zip c:\windows\system32\Video_000003237.zip |
- Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:
Se solicitado pressione "Enter" para iniciar o processo de remoção;
Não use o mouse nem o teclado quando o ComboFix estiver rodando.
Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.
Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.
Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.
Obrigado por responder.
Segue logo combofix.txt
ComboFix 10-02-25.02 - AGPM 26/02/2010 17:28:14.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.479.173 [GMT -3:00]
Executando de: c:\documents and settings\Usuario\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Usuario\Desktop\CFScript.txt
FILE ::
"c:\windows\system32\000006608.zip"
"c:\windows\system32\000006716.zip"
"c:\windows\system32\000006986.zip"
"c:\windows\system32\000007692.zip"
"c:\windows\system32\000007773.zip"
"c:\windows\system32\000008330.zip"
"c:\windows\system32\000008886.zip"
"c:\windows\system32\000009264.zip"
"c:\windows\system32\bbb10_000001062.zip"
"c:\windows\system32\bbb10_0000010886.zip"
"c:\windows\system32\bbb10_000001125.zip"
"c:\windows\system32\bbb10_000001637.zip"
"c:\windows\system32\bbb10_000002444.zip"
"c:\windows\system32\VIDEO-BBB-10_000003406.zip"
"c:\windows\system32\VIDEO-BBB-10_000004794.zip"
"c:\windows\system32\Video_000003237.zip"
"c:\windows\system32\Video_000003980.zip"
"c:\windows\system32\Video_000004748.zip"
"c:\windows\system32\Video_000005198.zip"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Usuario\CONFIG~1\Temp\DZ_4.dll
c:\documents and settings\Usuario\Configurações locais\Temp\DZ_4.dll
c:\windows\system32\000006608.zip
c:\windows\system32\000006716.zip
c:\windows\system32\000006986.zip
c:\windows\system32\000007692.zip
c:\windows\system32\000007773.zip
c:\windows\system32\000008330.zip
c:\windows\system32\000008886.zip
c:\windows\system32\000009264.zip
c:\windows\system32\bbb10_000001062.zip
c:\windows\system32\bbb10_0000010886.zip
c:\windows\system32\bbb10_000001125.zip
c:\windows\system32\bbb10_000001637.zip
c:\windows\system32\bbb10_000002444.zip
c:\windows\system32\VIDEO-BBB-10_000003406.zip
c:\windows\system32\VIDEO-BBB-10_000004794.zip
c:\windows\system32\Video_000003237.zip
c:\windows\system32\Video_000003980.zip
c:\windows\system32\Video_000004748.zip
c:\windows\system32\Video_000005198.zip
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-01-26 to 2010-02-26 ))))))))))))))))))))))))))))
.
2010-02-26 20:37 . 2010-02-26 20:37 210519 ----a-w- c:\windows\system32\bbb10_000009486.zip
2010-02-26 20:16 . 2010-02-26 20:16 -------- d-----w- c:\arquivos de programas\ShowMyPCService
2010-02-25 16:14 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 16:14 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 08:58 . 2010-02-20 08:58 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-25 16:14 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-02-05 09:39 . 2010-02-05 09:39 1321472 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification018.exe
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-26 20:40 . 2009-04-17 21:10 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Skype
2010-02-26 20:39 . 2009-04-22 21:11 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\skypePM
2010-02-26 10:32 . 2009-12-31 16:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InterApp
2010-02-26 10:30 . 2009-11-19 13:20 -------- d-----w- c:\arquivos de programas\LogMeIn
2010-02-22 16:39 . 2009-11-10 10:31 -------- d-----w- c:\arquivos de programas\AIKO 82D
2010-02-10 16:08 . 2009-05-27 20:56 -------- d-----w- c:\arquivos de programas\Ares
2010-02-03 18:28 . 2010-01-19 18:51 -------- d-----w- c:\arquivos de programas\ZTEPST
2010-01-27 19:42 . 2010-01-27 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\D'Accord_Music_Software_BR
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\Conduit
2010-01-25 19:42 . 2010-01-25 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee Security Scan
2010-01-25 19:41 . 2010-01-25 19:41 -------- d-----w- c:\arquivos de programas\McAfee Security Scan
2010-01-19 18:38 . 2010-01-19 18:38 -------- d-----w- c:\arquivos de programas\AIKO 76E-m
2010-01-07 13:56 . 2009-06-15 18:44 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo
2010-01-06 10:57 . 2009-09-16 11:15 -------- d-----w- c:\arquivos de programas\VIVO INTERNET
2009-12-31 15:27 . 2009-12-31 15:27 -------- d-----w- c:\arquivos de programas\AVG
2009-12-16 17:33 . 2009-12-16 17:32 1153176 ----a-w- c:\arquivos de programas\nsvpnc_setup.exe
2009-12-14 17:39 . 2009-12-14 17:34 41099128 ----a-w- c:\arquivos de programas\setuppor.exe
2009-12-01 16:28 . 2009-12-01 16:28 995840 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification014.exe
.
------- Sigcheck -------
[-] 2009-03-18 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 15:58 333192 ----a-w- c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
2009-01-07 15:51 1880600 ----a-w- c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ToolBoxFX"="c:\arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-05-05 45056]
"DB Audio Control Panel"="c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe" [2010-02-03 492032]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"LogMeIn GUI"="c:\arquivos de programas\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Googlee Tooll Bar Notification018"="c:\windows\system32\Google_Tool_Bar_Notification018.exe" [2010-02-05 1321472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Citrix Access Gateway.lnk - c:\arquivos de programas\Citrix\Secure Access Client\nsload.exe [2009-6-12 1393304]
McAfee Security Scan.lnk - c:\arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 21:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
backup=c:\windows\pss\Citrix Access Gateway.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Launchpad.lnk
backup=c:\windows\pss\Launchpad.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 06:08 35696 ----a-w- c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 08:00 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB Audio Control Panel]
2010-02-03 10:10 492032 ----a-w- c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 00:34 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
2004-01-30 11:33 180224 ----a-r- c:\windows\system32\pctspk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 15:11 25623336 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-04-16 16:43 148888 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-23 16:22 39408 ----a-w- c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Arquivos de programas\\Citrix\\Secure Access Client\\nsload.exe"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2558:TCP"= 2558:TCP:tjhbgvaw
R2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [10/11/2009 07:30 81920]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\LogMeIn\x86\rainfo.sys [11/8/2008 11:41 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/12/2009 11:48 47640]
R2 nsverctl;Citrix Secure Access Client Service;c:\arquivos de programas\Citrix\Secure Access Client\nsverctl.exe [12/6/2009 03:51 139264]
R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [15/12/2008 14:11 185640]
R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [12/6/2009 03:53 73368]
S2 nbgwqrxr;Time Security;c:\windows\system32\svchost.exe -k netsvcs [14/4/2008 05:00 14336]
S3 cpuz129;cpuz129;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys [?]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\Drivers\usbuvt.sys --> c:\windows\system32\Drivers\usbuvt.sys [?]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\DRIVERS\GUCI_AVS.sys --> c:\windows\system32\DRIVERS\GUCI_AVS.sys [?]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [6/4/2009 13:19 23064]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [19/1/2010 15:38 98432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nbgwqrxr
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.vivo.com.br/
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride =
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A67F8549-D9A0-4F95-B264-4858CF0A3889} = 201.10.128.3,201.10.1.2
FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\
FF - prefs.js: browser.startup.homepage - hxxps://syscor1.websiteseguro.com/_sys/?id=MTI=
FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 17:38
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DB Audio Control Panel = c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe??????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nbgwqrxr]
"ServiceDll"="c:\windows\system32\clybcj.dll"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\LMIinit.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Java\jre6\bin\jqs.exe
c:\arquivos de programas\LogMeIn\x86\RaMaint.exe
c:\arquivos de programas\LogMeIn\x86\LogMeIn.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-02-26 17:42:42 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-02-26 20:42
ComboFix2.txt 2010-02-26 16:42
Pré-execução: 18 pasta(s) 19.683.815.424 bytes disponíveis
Pós execução: 19 pasta(s) 19.654.909.952 bytes disponíveis
- - End Of File - - 8102F720D69D5F2B748CC699E344EB14
Segue novo logo do HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:03:38, on 26/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 9029 bytes
Agradeço.
Segue logo combofix.txt
ComboFix 10-02-25.02 - AGPM 26/02/2010 17:28:14.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.479.173 [GMT -3:00]
Executando de: c:\documents and settings\Usuario\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Usuario\Desktop\CFScript.txt
FILE ::
"c:\windows\system32\000006608.zip"
"c:\windows\system32\000006716.zip"
"c:\windows\system32\000006986.zip"
"c:\windows\system32\000007692.zip"
"c:\windows\system32\000007773.zip"
"c:\windows\system32\000008330.zip"
"c:\windows\system32\000008886.zip"
"c:\windows\system32\000009264.zip"
"c:\windows\system32\bbb10_000001062.zip"
"c:\windows\system32\bbb10_0000010886.zip"
"c:\windows\system32\bbb10_000001125.zip"
"c:\windows\system32\bbb10_000001637.zip"
"c:\windows\system32\bbb10_000002444.zip"
"c:\windows\system32\VIDEO-BBB-10_000003406.zip"
"c:\windows\system32\VIDEO-BBB-10_000004794.zip"
"c:\windows\system32\Video_000003237.zip"
"c:\windows\system32\Video_000003980.zip"
"c:\windows\system32\Video_000004748.zip"
"c:\windows\system32\Video_000005198.zip"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Usuario\CONFIG~1\Temp\DZ_4.dll
c:\documents and settings\Usuario\Configurações locais\Temp\DZ_4.dll
c:\windows\system32\000006608.zip
c:\windows\system32\000006716.zip
c:\windows\system32\000006986.zip
c:\windows\system32\000007692.zip
c:\windows\system32\000007773.zip
c:\windows\system32\000008330.zip
c:\windows\system32\000008886.zip
c:\windows\system32\000009264.zip
c:\windows\system32\bbb10_000001062.zip
c:\windows\system32\bbb10_0000010886.zip
c:\windows\system32\bbb10_000001125.zip
c:\windows\system32\bbb10_000001637.zip
c:\windows\system32\bbb10_000002444.zip
c:\windows\system32\VIDEO-BBB-10_000003406.zip
c:\windows\system32\VIDEO-BBB-10_000004794.zip
c:\windows\system32\Video_000003237.zip
c:\windows\system32\Video_000003980.zip
c:\windows\system32\Video_000004748.zip
c:\windows\system32\Video_000005198.zip
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-01-26 to 2010-02-26 ))))))))))))))))))))))))))))
.
2010-02-26 20:37 . 2010-02-26 20:37 210519 ----a-w- c:\windows\system32\bbb10_000009486.zip
2010-02-26 20:16 . 2010-02-26 20:16 -------- d-----w- c:\arquivos de programas\ShowMyPCService
2010-02-25 16:14 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 16:14 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 08:58 . 2010-02-20 08:58 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-25 16:14 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-02-05 09:39 . 2010-02-05 09:39 1321472 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification018.exe
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-26 20:40 . 2009-04-17 21:10 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Skype
2010-02-26 20:39 . 2009-04-22 21:11 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\skypePM
2010-02-26 10:32 . 2009-12-31 16:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InterApp
2010-02-26 10:30 . 2009-11-19 13:20 -------- d-----w- c:\arquivos de programas\LogMeIn
2010-02-22 16:39 . 2009-11-10 10:31 -------- d-----w- c:\arquivos de programas\AIKO 82D
2010-02-10 16:08 . 2009-05-27 20:56 -------- d-----w- c:\arquivos de programas\Ares
2010-02-03 18:28 . 2010-01-19 18:51 -------- d-----w- c:\arquivos de programas\ZTEPST
2010-01-27 19:42 . 2010-01-27 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\D'Accord_Music_Software_BR
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\Conduit
2010-01-25 19:42 . 2010-01-25 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee Security Scan
2010-01-25 19:41 . 2010-01-25 19:41 -------- d-----w- c:\arquivos de programas\McAfee Security Scan
2010-01-19 18:38 . 2010-01-19 18:38 -------- d-----w- c:\arquivos de programas\AIKO 76E-m
2010-01-07 13:56 . 2009-06-15 18:44 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo
2010-01-06 10:57 . 2009-09-16 11:15 -------- d-----w- c:\arquivos de programas\VIVO INTERNET
2009-12-31 15:27 . 2009-12-31 15:27 -------- d-----w- c:\arquivos de programas\AVG
2009-12-16 17:33 . 2009-12-16 17:32 1153176 ----a-w- c:\arquivos de programas\nsvpnc_setup.exe
2009-12-14 17:39 . 2009-12-14 17:34 41099128 ----a-w- c:\arquivos de programas\setuppor.exe
2009-12-01 16:28 . 2009-12-01 16:28 995840 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification014.exe
.
------- Sigcheck -------
[-] 2009-03-18 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 15:58 333192 ----a-w- c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
2009-01-07 15:51 1880600 ----a-w- c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ToolBoxFX"="c:\arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-05-05 45056]
"DB Audio Control Panel"="c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe" [2010-02-03 492032]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"LogMeIn GUI"="c:\arquivos de programas\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Googlee Tooll Bar Notification018"="c:\windows\system32\Google_Tool_Bar_Notification018.exe" [2010-02-05 1321472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Citrix Access Gateway.lnk - c:\arquivos de programas\Citrix\Secure Access Client\nsload.exe [2009-6-12 1393304]
McAfee Security Scan.lnk - c:\arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 21:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
backup=c:\windows\pss\Citrix Access Gateway.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Launchpad.lnk
backup=c:\windows\pss\Launchpad.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 06:08 35696 ----a-w- c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 08:00 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB Audio Control Panel]
2010-02-03 10:10 492032 ----a-w- c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 00:34 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
2004-01-30 11:33 180224 ----a-r- c:\windows\system32\pctspk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 15:11 25623336 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-04-16 16:43 148888 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-23 16:22 39408 ----a-w- c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Arquivos de programas\\Citrix\\Secure Access Client\\nsload.exe"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2558:TCP"= 2558:TCP:tjhbgvaw
R2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [10/11/2009 07:30 81920]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\LogMeIn\x86\rainfo.sys [11/8/2008 11:41 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/12/2009 11:48 47640]
R2 nsverctl;Citrix Secure Access Client Service;c:\arquivos de programas\Citrix\Secure Access Client\nsverctl.exe [12/6/2009 03:51 139264]
R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [15/12/2008 14:11 185640]
R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [12/6/2009 03:53 73368]
S2 nbgwqrxr;Time Security;c:\windows\system32\svchost.exe -k netsvcs [14/4/2008 05:00 14336]
S3 cpuz129;cpuz129;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys [?]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\Drivers\usbuvt.sys --> c:\windows\system32\Drivers\usbuvt.sys [?]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\DRIVERS\GUCI_AVS.sys --> c:\windows\system32\DRIVERS\GUCI_AVS.sys [?]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [6/4/2009 13:19 23064]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [19/1/2010 15:38 98432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nbgwqrxr
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.vivo.com.br/
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride =
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A67F8549-D9A0-4F95-B264-4858CF0A3889} = 201.10.128.3,201.10.1.2
FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\
FF - prefs.js: browser.startup.homepage - hxxps://syscor1.websiteseguro.com/_sys/?id=MTI=
FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-26 17:38
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DB Audio Control Panel = c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe??????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nbgwqrxr]
"ServiceDll"="c:\windows\system32\clybcj.dll"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\LMIinit.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Java\jre6\bin\jqs.exe
c:\arquivos de programas\LogMeIn\x86\RaMaint.exe
c:\arquivos de programas\LogMeIn\x86\LogMeIn.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-02-26 17:42:42 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-02-26 20:42
ComboFix2.txt 2010-02-26 16:42
Pré-execução: 18 pasta(s) 19.683.815.424 bytes disponíveis
Pós execução: 19 pasta(s) 19.654.909.952 bytes disponíveis
- - End Of File - - 8102F720D69D5F2B748CC699E344EB14
Segue novo logo do HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:03:38, on 26/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 9029 bytes
Agradeço.
- Selecione o texto abaixo e copie para o bloco de notas. Salve-o como CFScript.txt;
| CODE |
| File:: c:\windows\system32\bbb10_000009486.zip |
- Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:
Se solicitado pressione "Enter" para iniciar o processo de remoção;
Não use o mouse nem o teclado quando o ComboFix estiver rodando.
Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.
Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.
Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.
Obrigado por responder.
Segue log combofix.txt
ComboFix 10-02-25.02 - AGPM 27/02/2010 10:35:24.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.479.173 [GMT -3:00]
Executando de: c:\documents and settings\Usuario\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Usuario\Desktop\CFScript.txt
FILE ::
"c:\windows\system32\bbb10_000009486.zip"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Usuario\CONFIG~1\Temp\DZ_6.dll
c:\documents and settings\Usuario\Configurações locais\Temp\DZ_6.dll
c:\windows\system32\bbb10_000009486.zip
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-01-27 to 2010-02-27 ))))))))))))))))))))))))))))
.
2010-02-27 13:44 . 2010-02-27 13:44 208951 ----a-w- c:\windows\system32\VIDEO-BBB-10_000005078.zip
2010-02-27 09:53 . 2010-02-27 09:53 209324 ----a-w- c:\windows\system32\Video_000005860.zip
2010-02-26 20:47 . 2010-02-26 20:47 -------- d-----w- c:\arquivos de programas\AIKO_PST_CUSTOM_V1.0.0
2010-02-26 20:16 . 2010-02-26 20:16 -------- d-----w- c:\arquivos de programas\ShowMyPCService
2010-02-25 16:14 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 16:14 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 08:58 . 2010-02-20 08:58 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-25 16:14 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-02-05 09:39 . 2010-02-05 09:39 1321472 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification018.exe
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 13:47 . 2009-04-17 21:10 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Skype
2010-02-27 13:46 . 2009-04-22 21:11 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\skypePM
2010-02-27 09:52 . 2009-11-19 13:20 -------- d-----w- c:\arquivos de programas\LogMeIn
2010-02-26 10:32 . 2009-12-31 16:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InterApp
2010-02-22 16:39 . 2009-11-10 10:31 -------- d-----w- c:\arquivos de programas\AIKO 82D
2010-02-10 16:08 . 2009-05-27 20:56 -------- d-----w- c:\arquivos de programas\Ares
2010-02-03 18:28 . 2010-01-19 18:51 -------- d-----w- c:\arquivos de programas\ZTEPST
2010-01-27 19:42 . 2010-01-27 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\D'Accord_Music_Software_BR
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\Conduit
2010-01-25 19:42 . 2010-01-25 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee Security Scan
2010-01-25 19:41 . 2010-01-25 19:41 -------- d-----w- c:\arquivos de programas\McAfee Security Scan
2010-01-19 18:38 . 2010-01-19 18:38 -------- d-----w- c:\arquivos de programas\AIKO 76E-m
2010-01-07 13:56 . 2009-06-15 18:44 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo
2010-01-06 10:57 . 2009-09-16 11:15 -------- d-----w- c:\arquivos de programas\VIVO INTERNET
2009-12-31 15:27 . 2009-12-31 15:27 -------- d-----w- c:\arquivos de programas\AVG
2009-12-16 17:33 . 2009-12-16 17:32 1153176 ----a-w- c:\arquivos de programas\nsvpnc_setup.exe
2009-12-14 17:39 . 2009-12-14 17:34 41099128 ----a-w- c:\arquivos de programas\setuppor.exe
2009-12-01 16:28 . 2009-12-01 16:28 995840 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification014.exe
.
------- Sigcheck -------
[-] 2009-03-18 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 15:58 333192 ----a-w- c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
2009-01-07 15:51 1880600 ----a-w- c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ToolBoxFX"="c:\arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-05-05 45056]
"DB Audio Control Panel"="c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe" [2010-02-03 492032]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"LogMeIn GUI"="c:\arquivos de programas\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Googlee Tooll Bar Notification018"="c:\windows\system32\Google_Tool_Bar_Notification018.exe" [2010-02-05 1321472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Citrix Access Gateway.lnk - c:\arquivos de programas\Citrix\Secure Access Client\nsload.exe [2009-6-12 1393304]
McAfee Security Scan.lnk - c:\arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 21:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
backup=c:\windows\pss\Citrix Access Gateway.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Launchpad.lnk
backup=c:\windows\pss\Launchpad.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 06:08 35696 ----a-w- c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 08:00 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB Audio Control Panel]
2010-02-03 10:10 492032 ----a-w- c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 00:34 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
2004-01-30 11:33 180224 ----a-r- c:\windows\system32\pctspk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 15:11 25623336 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-04-16 16:43 148888 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-23 16:22 39408 ----a-w- c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Arquivos de programas\\Citrix\\Secure Access Client\\nsload.exe"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2558:TCP"= 2558:TCP:tjhbgvaw
R2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [10/11/2009 07:30 81920]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\LogMeIn\x86\rainfo.sys [11/8/2008 11:41 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/12/2009 11:48 47640]
R2 nsverctl;Citrix Secure Access Client Service;c:\arquivos de programas\Citrix\Secure Access Client\nsverctl.exe [12/6/2009 03:51 139264]
R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [15/12/2008 14:11 185640]
R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [12/6/2009 03:53 73368]
S2 nbgwqrxr;Time Security;c:\windows\system32\svchost.exe -k netsvcs [14/4/2008 05:00 14336]
S3 cpuz129;cpuz129;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys [?]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\Drivers\usbuvt.sys --> c:\windows\system32\Drivers\usbuvt.sys [?]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\DRIVERS\GUCI_AVS.sys --> c:\windows\system32\DRIVERS\GUCI_AVS.sys [?]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [6/4/2009 13:19 23064]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [19/1/2010 15:38 98432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nbgwqrxr
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.vivo.com.br/
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride =
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A67F8549-D9A0-4F95-B264-4858CF0A3889} = 201.10.128.3,201.10.1.2
FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\
FF - prefs.js: browser.startup.homepage - hxxps://syscor1.websiteseguro.com/_sys/?id=MTI=
FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 10:44
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DB Audio Control Panel = c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe??????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nbgwqrxr]
"ServiceDll"="c:\windows\system32\clybcj.dll"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\LMIinit.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Java\jre6\bin\jqs.exe
c:\arquivos de programas\LogMeIn\x86\RaMaint.exe
c:\arquivos de programas\LogMeIn\x86\LogMeIn.exe
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-02-27 10:49:53 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-02-27 13:49
ComboFix2.txt 2010-02-26 20:42
ComboFix3.txt 2010-02-26 16:42
Pré-execução: 18 pasta(s) 19.639.296.000 bytes disponíveis
Pós execução: 19 pasta(s) 19.606.962.176 bytes disponíveis
- - End Of File - - 0BA395935F03ABB9F29220C64D572A5C
Segue novo log HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:58, on 27/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 8975 bytes
Agradeço.
Segue log combofix.txt
ComboFix 10-02-25.02 - AGPM 27/02/2010 10:35:24.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.479.173 [GMT -3:00]
Executando de: c:\documents and settings\Usuario\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Usuario\Desktop\CFScript.txt
FILE ::
"c:\windows\system32\bbb10_000009486.zip"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Usuario\CONFIG~1\Temp\DZ_6.dll
c:\documents and settings\Usuario\Configurações locais\Temp\DZ_6.dll
c:\windows\system32\bbb10_000009486.zip
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-01-27 to 2010-02-27 ))))))))))))))))))))))))))))
.
2010-02-27 13:44 . 2010-02-27 13:44 208951 ----a-w- c:\windows\system32\VIDEO-BBB-10_000005078.zip
2010-02-27 09:53 . 2010-02-27 09:53 209324 ----a-w- c:\windows\system32\Video_000005860.zip
2010-02-26 20:47 . 2010-02-26 20:47 -------- d-----w- c:\arquivos de programas\AIKO_PST_CUSTOM_V1.0.0
2010-02-26 20:16 . 2010-02-26 20:16 -------- d-----w- c:\arquivos de programas\ShowMyPCService
2010-02-25 16:14 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 16:14 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 08:58 . 2010-02-20 08:58 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-25 16:14 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-02-05 09:39 . 2010-02-05 09:39 1321472 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification018.exe
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 13:47 . 2009-04-17 21:10 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Skype
2010-02-27 13:46 . 2009-04-22 21:11 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\skypePM
2010-02-27 09:52 . 2009-11-19 13:20 -------- d-----w- c:\arquivos de programas\LogMeIn
2010-02-26 10:32 . 2009-12-31 16:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InterApp
2010-02-22 16:39 . 2009-11-10 10:31 -------- d-----w- c:\arquivos de programas\AIKO 82D
2010-02-10 16:08 . 2009-05-27 20:56 -------- d-----w- c:\arquivos de programas\Ares
2010-02-03 18:28 . 2010-01-19 18:51 -------- d-----w- c:\arquivos de programas\ZTEPST
2010-01-27 19:42 . 2010-01-27 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\D'Accord_Music_Software_BR
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\Conduit
2010-01-25 19:42 . 2010-01-25 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee Security Scan
2010-01-25 19:41 . 2010-01-25 19:41 -------- d-----w- c:\arquivos de programas\McAfee Security Scan
2010-01-19 18:38 . 2010-01-19 18:38 -------- d-----w- c:\arquivos de programas\AIKO 76E-m
2010-01-07 13:56 . 2009-06-15 18:44 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo
2010-01-06 10:57 . 2009-09-16 11:15 -------- d-----w- c:\arquivos de programas\VIVO INTERNET
2009-12-31 15:27 . 2009-12-31 15:27 -------- d-----w- c:\arquivos de programas\AVG
2009-12-16 17:33 . 2009-12-16 17:32 1153176 ----a-w- c:\arquivos de programas\nsvpnc_setup.exe
2009-12-14 17:39 . 2009-12-14 17:34 41099128 ----a-w- c:\arquivos de programas\setuppor.exe
2009-12-01 16:28 . 2009-12-01 16:28 995840 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification014.exe
.
------- Sigcheck -------
[-] 2009-03-18 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 15:58 333192 ----a-w- c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
2009-01-07 15:51 1880600 ----a-w- c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ToolBoxFX"="c:\arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-05-05 45056]
"DB Audio Control Panel"="c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe" [2010-02-03 492032]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"LogMeIn GUI"="c:\arquivos de programas\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Googlee Tooll Bar Notification018"="c:\windows\system32\Google_Tool_Bar_Notification018.exe" [2010-02-05 1321472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Citrix Access Gateway.lnk - c:\arquivos de programas\Citrix\Secure Access Client\nsload.exe [2009-6-12 1393304]
McAfee Security Scan.lnk - c:\arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 21:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
backup=c:\windows\pss\Citrix Access Gateway.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Launchpad.lnk
backup=c:\windows\pss\Launchpad.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 06:08 35696 ----a-w- c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 08:00 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB Audio Control Panel]
2010-02-03 10:10 492032 ----a-w- c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 00:34 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
2004-01-30 11:33 180224 ----a-r- c:\windows\system32\pctspk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 15:11 25623336 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-04-16 16:43 148888 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-23 16:22 39408 ----a-w- c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Arquivos de programas\\Citrix\\Secure Access Client\\nsload.exe"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2558:TCP"= 2558:TCP:tjhbgvaw
R2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [10/11/2009 07:30 81920]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\LogMeIn\x86\rainfo.sys [11/8/2008 11:41 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/12/2009 11:48 47640]
R2 nsverctl;Citrix Secure Access Client Service;c:\arquivos de programas\Citrix\Secure Access Client\nsverctl.exe [12/6/2009 03:51 139264]
R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [15/12/2008 14:11 185640]
R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [12/6/2009 03:53 73368]
S2 nbgwqrxr;Time Security;c:\windows\system32\svchost.exe -k netsvcs [14/4/2008 05:00 14336]
S3 cpuz129;cpuz129;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys [?]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\Drivers\usbuvt.sys --> c:\windows\system32\Drivers\usbuvt.sys [?]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\DRIVERS\GUCI_AVS.sys --> c:\windows\system32\DRIVERS\GUCI_AVS.sys [?]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [6/4/2009 13:19 23064]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [19/1/2010 15:38 98432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nbgwqrxr
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.vivo.com.br/
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride =
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A67F8549-D9A0-4F95-B264-4858CF0A3889} = 201.10.128.3,201.10.1.2
FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\
FF - prefs.js: browser.startup.homepage - hxxps://syscor1.websiteseguro.com/_sys/?id=MTI=
FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-27 10:44
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DB Audio Control Panel = c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe??????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nbgwqrxr]
"ServiceDll"="c:\windows\system32\clybcj.dll"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\LMIinit.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Java\jre6\bin\jqs.exe
c:\arquivos de programas\LogMeIn\x86\RaMaint.exe
c:\arquivos de programas\LogMeIn\x86\LogMeIn.exe
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-02-27 10:49:53 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-02-27 13:49
ComboFix2.txt 2010-02-26 20:42
ComboFix3.txt 2010-02-26 16:42
Pré-execução: 18 pasta(s) 19.639.296.000 bytes disponíveis
Pós execução: 19 pasta(s) 19.606.962.176 bytes disponíveis
- - End Of File - - 0BA395935F03ABB9F29220C64D572A5C
Segue novo log HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:58, on 27/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Arquivos de programas\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 8975 bytes
Agradeço.
- Selecione o texto abaixo e copie para o bloco de notas. Salve-o como CFScript.txt;
| CODE |
| File:: c:\windows\system32\VIDEO-BBB-10_000005078.zip c:\windows\system32\Video_000005860.zip Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LogMeIn GUI"=- |
- Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:
Se solicitado pressione "Enter" para iniciar o processo de remoção;
Não use o mouse nem o teclado quando o ComboFix estiver rodando.
Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.
Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.
Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.
Obrigado por reponder.
Só uma observaçao: tenho o kaspersky licenciado mais não está instalado no meu pc, achei melhor não instala-lo até terminar-mos.
Segue log combofix.txt
ComboFix 10-03-01.01 - AGPM 01/03/2010 14:14:05.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.479.162 [GMT -3:00]
Executando de: c:\documents and settings\Usuario\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Usuario\Desktop\CFScript.txt
FILE ::
"c:\windows\system32\VIDEO-BBB-10_000005078.zip"
"c:\windows\system32\Video_000005860.zip"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Usuario\CONFIG~1\Temp\DZ_B.dll
c:\documents and settings\Usuario\Configurações locais\Temp\DZ_B.dll
c:\windows\system32\VIDEO-BBB-10_000005078.zip
c:\windows\system32\Video_000005860.zip
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-02-01 to 2010-03-01 ))))))))))))))))))))))))))))
.
2010-03-01 17:23 . 2010-03-01 17:23 210066 ----a-w- c:\windows\system32\VIDEO-BBB-10_000007933.zip
2010-03-01 10:48 . 2010-03-01 10:48 209586 ----a-w- c:\windows\system32\000006564.zip
2010-02-26 20:47 . 2010-02-26 20:47 -------- d-----w- c:\arquivos de programas\AIKO_PST_CUSTOM_V1.0.0
2010-02-26 20:16 . 2010-02-26 20:16 -------- d-----w- c:\arquivos de programas\ShowMyPCService
2010-02-25 16:14 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 16:14 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 08:58 . 2010-02-20 08:58 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-25 16:14 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-02-05 09:39 . 2010-02-05 09:39 1321472 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification018.exe
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 17:26 . 2009-04-17 21:10 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Skype
2010-03-01 17:25 . 2009-04-22 21:11 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\skypePM
2010-03-01 10:30 . 2009-11-19 13:20 -------- d-----w- c:\arquivos de programas\LogMeIn
2010-02-26 10:32 . 2009-12-31 16:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InterApp
2010-02-22 16:39 . 2009-11-10 10:31 -------- d-----w- c:\arquivos de programas\AIKO 82D
2010-02-10 16:08 . 2009-05-27 20:56 -------- d-----w- c:\arquivos de programas\Ares
2010-02-03 18:28 . 2010-01-19 18:51 -------- d-----w- c:\arquivos de programas\ZTEPST
2010-01-27 19:42 . 2010-01-27 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\D'Accord_Music_Software_BR
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\Conduit
2010-01-25 19:42 . 2010-01-25 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee Security Scan
2010-01-25 19:41 . 2010-01-25 19:41 -------- d-----w- c:\arquivos de programas\McAfee Security Scan
2010-01-19 18:38 . 2010-01-19 18:38 -------- d-----w- c:\arquivos de programas\AIKO 76E-m
2010-01-07 13:56 . 2009-06-15 18:44 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo
2010-01-06 10:57 . 2009-09-16 11:15 -------- d-----w- c:\arquivos de programas\VIVO INTERNET
2009-12-16 17:33 . 2009-12-16 17:32 1153176 ----a-w- c:\arquivos de programas\nsvpnc_setup.exe
2009-12-14 17:39 . 2009-12-14 17:34 41099128 ----a-w- c:\arquivos de programas\setuppor.exe
.
------- Sigcheck -------
[-] 2009-03-18 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 15:58 333192 ----a-w- c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
2009-01-07 15:51 1880600 ----a-w- c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ToolBoxFX"="c:\arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-05-05 45056]
"DB Audio Control Panel"="c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe" [2010-02-03 492032]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Googlee Tooll Bar Notification018"="c:\windows\system32\Google_Tool_Bar_Notification018.exe" [2010-02-05 1321472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Citrix Access Gateway.lnk - c:\arquivos de programas\Citrix\Secure Access Client\nsload.exe [2009-6-12 1393304]
McAfee Security Scan.lnk - c:\arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 21:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
backup=c:\windows\pss\Citrix Access Gateway.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Launchpad.lnk
backup=c:\windows\pss\Launchpad.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 06:08 35696 ----a-w- c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 08:00 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB Audio Control Panel]
2010-02-03 10:10 492032 ----a-w- c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 00:34 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
2004-01-30 11:33 180224 ----a-r- c:\windows\system32\pctspk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 15:11 25623336 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-04-16 16:43 148888 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-23 16:22 39408 ----a-w- c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Arquivos de programas\\Citrix\\Secure Access Client\\nsload.exe"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2558:TCP"= 2558:TCP:tjhbgvaw
R2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [10/11/2009 07:30 81920]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\LogMeIn\x86\rainfo.sys [11/8/2008 11:41 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/12/2009 11:48 47640]
R2 nsverctl;Citrix Secure Access Client Service;c:\arquivos de programas\Citrix\Secure Access Client\nsverctl.exe [12/6/2009 03:51 139264]
R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [15/12/2008 14:11 185640]
R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [12/6/2009 03:53 73368]
S2 nbgwqrxr;Time Security;c:\windows\system32\svchost.exe -k netsvcs [14/4/2008 05:00 14336]
S3 cpuz129;cpuz129;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys [?]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\Drivers\usbuvt.sys --> c:\windows\system32\Drivers\usbuvt.sys [?]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\DRIVERS\GUCI_AVS.sys --> c:\windows\system32\DRIVERS\GUCI_AVS.sys [?]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [6/4/2009 13:19 23064]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [19/1/2010 15:38 98432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nbgwqrxr
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.vivo.com.br/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride =
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A67F8549-D9A0-4F95-B264-4858CF0A3889} = 201.10.128.3,201.10.1.2
FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\
FF - prefs.js: browser.startup.homepage - hxxps://syscor1.websiteseguro.com/_sys/?id=MTI=
FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 14:23
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DB Audio Control Panel = c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe??????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nbgwqrxr]
"ServiceDll"="c:\windows\system32\clybcj.dll"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\LMIinit.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Java\jre6\bin\jqs.exe
c:\arquivos de programas\LogMeIn\x86\RaMaint.exe
c:\arquivos de programas\LogMeIn\x86\LogMeIn.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-03-01 14:30:08 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-03-01 17:30
ComboFix2.txt 2010-02-27 13:49
ComboFix3.txt 2010-02-26 20:42
ComboFix4.txt 2010-02-26 16:42
Pré-execução: 18 pasta(s) 19.561.549.824 bytes disponíveis
Pós execução: 19 pasta(s) 19.537.629.184 bytes disponíveis
- - End Of File - - F4587CDB1B27BC22DF7546B50384CB11
Segue novo log HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:40:20, on 1/3/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 8715 bytes
Agradeço.
Só uma observaçao: tenho o kaspersky licenciado mais não está instalado no meu pc, achei melhor não instala-lo até terminar-mos.
Segue log combofix.txt
ComboFix 10-03-01.01 - AGPM 01/03/2010 14:14:05.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.479.162 [GMT -3:00]
Executando de: c:\documents and settings\Usuario\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Usuario\Desktop\CFScript.txt
FILE ::
"c:\windows\system32\VIDEO-BBB-10_000005078.zip"
"c:\windows\system32\Video_000005860.zip"
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Usuario\CONFIG~1\Temp\DZ_B.dll
c:\documents and settings\Usuario\Configurações locais\Temp\DZ_B.dll
c:\windows\system32\VIDEO-BBB-10_000005078.zip
c:\windows\system32\Video_000005860.zip
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-02-01 to 2010-03-01 ))))))))))))))))))))))))))))
.
2010-03-01 17:23 . 2010-03-01 17:23 210066 ----a-w- c:\windows\system32\VIDEO-BBB-10_000007933.zip
2010-03-01 10:48 . 2010-03-01 10:48 209586 ----a-w- c:\windows\system32\000006564.zip
2010-02-26 20:47 . 2010-02-26 20:47 -------- d-----w- c:\arquivos de programas\AIKO_PST_CUSTOM_V1.0.0
2010-02-26 20:16 . 2010-02-26 20:16 -------- d-----w- c:\arquivos de programas\ShowMyPCService
2010-02-25 16:14 . 2010-01-07 19:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 16:14 . 2010-01-07 19:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-20 08:58 . 2010-02-20 08:58 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-19 16:58 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-02-19 16:58 . 2010-02-25 16:14 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-02-05 09:39 . 2010-02-05 09:39 1321472 ----a-w- c:\windows\system32\Google_Tool_Bar_Notification018.exe
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-01 17:26 . 2009-04-17 21:10 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\Skype
2010-03-01 17:25 . 2009-04-22 21:11 -------- d-----w- c:\documents and settings\Usuario\Dados de aplicativos\skypePM
2010-03-01 10:30 . 2009-11-19 13:20 -------- d-----w- c:\arquivos de programas\LogMeIn
2010-02-26 10:32 . 2009-12-31 16:32 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\InterApp
2010-02-22 16:39 . 2009-11-10 10:31 -------- d-----w- c:\arquivos de programas\AIKO 82D
2010-02-10 16:08 . 2009-05-27 20:56 -------- d-----w- c:\arquivos de programas\Ares
2010-02-03 18:28 . 2010-01-19 18:51 -------- d-----w- c:\arquivos de programas\ZTEPST
2010-01-27 19:42 . 2010-01-27 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\D'Accord_Music_Software_BR
2010-01-27 19:29 . 2010-01-27 19:29 -------- d-----w- c:\arquivos de programas\Conduit
2010-01-25 19:42 . 2010-01-25 19:42 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\McAfee Security Scan
2010-01-25 19:41 . 2010-01-25 19:41 -------- d-----w- c:\arquivos de programas\McAfee Security Scan
2010-01-19 18:38 . 2010-01-19 18:38 -------- d-----w- c:\arquivos de programas\AIKO 76E-m
2010-01-07 13:56 . 2009-06-15 18:44 -------- d-----w- c:\arquivos de programas\InstallAffixationInfo
2010-01-06 10:57 . 2009-09-16 11:15 -------- d-----w- c:\arquivos de programas\VIVO INTERNET
2009-12-16 17:33 . 2009-12-16 17:32 1153176 ----a-w- c:\arquivos de programas\nsvpnc_setup.exe
2009-12-14 17:39 . 2009-12-14 17:34 41099128 ----a-w- c:\arquivos de programas\setuppor.exe
.
------- Sigcheck -------
[-] 2009-03-18 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 15:58 333192 ----a-w- c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
2009-01-07 15:51 1880600 ----a-w- c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\arquivos de programas\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}"= "c:\arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll" [2009-01-07 1880600]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CLASSES_ROOT\clsid\{c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\arquivos de programas\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ToolBoxFX"="c:\arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-05-05 45056]
"DB Audio Control Panel"="c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe" [2010-02-03 492032]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"Googlee Tooll Bar Notification018"="c:\windows\system32\Google_Tool_Bar_Notification018.exe" [2010-02-05 1321472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Citrix Access Gateway.lnk - c:\arquivos de programas\Citrix\Secure Access Client\nsload.exe [2009-6-12 1393304]
McAfee Security Scan.lnk - c:\arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-28 21:34 87352 ----a-w- c:\windows\system32\LMIinit.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
backup=c:\windows\pss\Citrix Access Gateway.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Launchpad.lnk
backup=c:\windows\pss\Launchpad.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 06:08 35696 ----a-w- c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 08:00 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB Audio Control Panel]
2010-02-03 10:10 492032 ----a-w- c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 00:34 49152 ----a-w- c:\arquivos de programas\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
2004-01-30 11:33 180224 ----a-r- c:\windows\system32\pctspk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 15:11 25623336 ----a-r- c:\arquivos de programas\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-04-16 16:43 148888 ----a-w- c:\arquivos de programas\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-23 16:22 39408 ----a-w- c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Arquivos de programas\\Citrix\\Secure Access Client\\nsload.exe"=
"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2558:TCP"= 2558:TCP:tjhbgvaw
R2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [10/11/2009 07:30 81920]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\arquivos de programas\LogMeIn\x86\rainfo.sys [11/8/2008 11:41 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2/12/2009 11:48 47640]
R2 nsverctl;Citrix Secure Access Client Service;c:\arquivos de programas\Citrix\Secure Access Client\nsverctl.exe [12/6/2009 03:51 139264]
R2 TeamViewer4;TeamViewer 4;c:\arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe [15/12/2008 14:11 185640]
R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [12/6/2009 03:53 73368]
S2 nbgwqrxr;Time Security;c:\windows\system32\svchost.exe -k netsvcs [14/4/2008 05:00 14336]
S3 cpuz129;cpuz129;\??\c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys --> c:\docume~1\Usuario\CONFIG~1\Temp\cpuz_x32.sys [?]
S3 DCamUSBUVT;ICM532A;c:\windows\system32\Drivers\usbuvt.sys --> c:\windows\system32\Drivers\usbuvt.sys [?]
S3 GUCI_AVS;USB2.0 VGA Video Device;c:\windows\system32\DRIVERS\GUCI_AVS.sys --> c:\windows\system32\DRIVERS\GUCI_AVS.sys [?]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [6/4/2009 13:19 23064]
S3 zteusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys [19/1/2010 15:38 98432]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nbgwqrxr
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.vivo.com.br/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer =
uInternet Settings,ProxyOverride =
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {A67F8549-D9A0-4F95-B264-4858CF0A3889} = 201.10.128.3,201.10.1.2
FF - ProfilePath - c:\documents and settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\
FF - prefs.js: browser.startup.homepage - hxxps://syscor1.websiteseguro.com/_sys/?id=MTI=
FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 14:23
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DB Audio Control Panel = c:\arquivos de programas\Windows Media Player\RtHDVCpl.exe??????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nbgwqrxr]
"ServiceDll"="c:\windows\system32\clybcj.dll"
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\LMIinit.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Java\jre6\bin\jqs.exe
c:\arquivos de programas\LogMeIn\x86\RaMaint.exe
c:\arquivos de programas\LogMeIn\x86\LogMeIn.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
c:\arquivos de programas\LogMeIn\x86\LMIGuardian.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\arquivos de programas\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wscntfy.exe
c:\arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-03-01 14:30:08 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-03-01 17:30
ComboFix2.txt 2010-02-27 13:49
ComboFix3.txt 2010-02-26 20:42
ComboFix4.txt 2010-02-26 16:42
Pré-execução: 18 pasta(s) 19.561.549.824 bytes disponíveis
Pós execução: 19 pasta(s) 19.537.629.184 bytes disponíveis
- - End Of File - - F4587CDB1B27BC22DF7546B50384CB11
Segue novo log HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:40:20, on 1/3/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
C:\Arquivos de programas\Skype\Phone\Skype.exe
C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Usuario\Meus documentos\Downloads\HiJackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R3 - URLSearchHook: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: D'Accord Music Software BR Toolbar - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
O4 - HKCU\..\Run: [Skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A67F8549-D9A0-4F95-B264-4858CF0A3889}: NameServer = 201.10.128.3,201.10.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
O23 - Service: Citrix Secure Access Client Service (nsverctl) - Citrix Systems, Inc - C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
--
End of file - 8715 bytes
Agradeço.
- Faça o download do OTL e salve-o no desktop:
http://oldtimer.geekstogo.com/OTL.exe
http://oldtimer.geekstogo.com/OTL.exe
- Duplo clique no OTL.exe e clique em "Executar";
- Marque os quadros LOP check e Purity check
- Copie o texto abaixo, dentro do "code" e cole no campo
- Clique em Run Scan
- Poste o conteúdo do Bloco de Notas que será aberto ao final do scan.
| CODE |
| netsvcs msconfig safebootminimal safebootnetwork activex drivers32 hijackthisbackups %SYSTEMDRIVE%\*.* %PROGRAMFILES%\*.* %PROGRAMFILES%\Internet Explorer\*.* |
OK.
Bom, foi gerado dois logs, segue o log: OTL.txt
Caso seja necessario, posto o outro log, o nome dele é Extras.txt
OTL logfile created on: 1/3/2010 17:10:23 - Run 1
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Documents and Settings\Usuario\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy
479,00 Mb Total Physical Memory | 170,00 Mb Available Physical Memory | 35,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas
Drive C: | 37,30 Gb Total Space | 18,21 Gb Free Space | 48,81% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: FRENTE02
Current User Name: AGPM
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/03/01 17:08:03 | 000,551,424 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
PRC - [2010/03/01 17:04:39 | 001,226,648 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\ShowMyPC3005.exe
PRC - [2010/02/05 06:39:22 | 001,321,472 | ---- | M] (Google.inc) -- C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
PRC - [2009/11/10 14:21:56 | 002,766,232 | ---- | M] (ShowMyPC) -- C:\Documents and Settings\Usuario\Configurações locais\Temp\IXP000.TMP\SMPCSetup.exe
PRC - [2009/10/09 12:11:12 | 025,623,336 | R--- | M] (Skype Technologies S.A.) -- C:\Arquivos de programas\Skype\Phone\Skype.exe
PRC - [2009/10/09 12:11:12 | 000,078,008 | R--- | M] (Skype Technologies) -- C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
PRC - [2009/09/28 18:34:22 | 000,116,032 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\ramaint.exe
PRC - [2009/09/28 18:34:16 | 000,378,176 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
PRC - [2009/07/27 21:19:10 | 000,199,184 | ---- | M] (McAfee, Inc.) -- C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
PRC - [2009/06/12 03:53:20 | 001,393,304 | ---- | M] (Citrix Systems, Inc) -- C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
PRC - [2009/06/12 03:51:22 | 000,139,264 | ---- | M] (Citrix Systems, Inc) -- C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/12/15 14:30:32 | 003,956,520 | ---- | M] (TeamViewer GmbH) -- C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
PRC - [2008/12/15 14:11:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
PRC - [2008/10/16 21:38:56 | 000,336,792 | ---- | M] (Simon Tatham) -- C:\Documents and Settings\Usuario\Configurações locais\Temp\IXP000.TMP\sps.exe
PRC - [2008/08/11 11:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
PRC - [2008/04/14 05:00:00 | 001,035,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/30 07:31:56 | 000,081,920 | R--- | M] () -- C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
PRC - [2007/11/05 00:04:14 | 000,573,440 | ---- | M] (TightVNC Group) -- C:\Documents and Settings\Usuario\Configurações locais\Temp\IXP000.TMP\smwinvnc.exe
PRC - [2006/09/13 12:25:00 | 000,069,632 | ---- | M] (Software 2000 Limited) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1005MC.EXE
PRC - [2006/05/05 09:49:46 | 000,045,056 | ---- | M] (HP) -- C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
PRC - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
========== Modules (SafeList) ==========
MOD - [2010/03/01 17:08:03 | 000,551,424 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2009/09/28 18:34:22 | 000,116,032 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2009/06/12 03:51:22 | 000,139,264 | ---- | M] (Citrix Systems, Inc) [Auto | Running] -- C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe -- (nsverctl)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/12/15 14:11:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4)
SRV - [2008/08/11 11:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2008/01/30 07:31:56 | 000,081,920 | R--- | M] () [Auto | Running] -- C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe -- (Autorun CDROM Monitor)
SRV - [2003/07/28 20:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2009/09/28 18:34:48 | 000,083,288 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2009/06/12 03:53:18 | 000,073,368 | ---- | M] (Citrix Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\net6im51.sys -- (Net6IM)
DRV - [2009/04/06 13:19:46 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2009/03/30 08:39:10 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009/03/30 08:39:06 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009/03/30 08:38:48 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008/12/13 10:26:38 | 000,102,400 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2008/08/11 11:41:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2008/08/11 11:41:00 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2008/08/11 11:40:34 | 000,010,144 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lmimirr.sys -- (lmimirr)
DRV - [2008/05/18 19:51:31 | 000,009,216 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32)
DRV - [2008/04/14 05:00:00 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008/04/14 05:00:00 | 000,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2008/04/13 11:45:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) Driver de áudio USB (WDM)
DRV - [2008/04/13 06:34:34 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB)
DRV - [2007/04/10 09:34:50 | 000,098,432 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\zteusbser.sys -- (zteusbser)
DRV - [2006/05/05 09:51:40 | 000,009,344 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK)
DRV - [2004/07/22 17:17:08 | 000,042,496 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fetnd5b.sys -- (FETNDISB)
DRV - [2004/05/24 20:54:10 | 000,362,878 | R--- | M] (PCTEL, INC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ptserial.sys -- (Ptserial)
DRV - [2004/03/20 09:55:02 | 000,070,384 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvoice.sys -- (Vvoice)
DRV - [2004/03/20 09:54:18 | 000,703,737 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmodem.sys -- (Vmodem)
DRV - [2004/03/20 09:52:20 | 000,804,754 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpctcom.sys -- (Vpctcom)
DRV - [2003/08/19 18:27:40 | 000,073,984 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viaudio.sys -- (VIAudio) VIA AC'97 Audio Controller (WDM)
DRV - [2003/07/17 16:10:06 | 000,007,040 | ---- | M] (VIA Networking Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\ntsim.sys -- (NTSIM)
DRV - [2003/07/02 04:42:00 | 000,027,904 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2001/08/17 21:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)
DRV - [2001/08/17 17:13:08 | 000,027,165 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fetnd5.sys -- (FETNDIS)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
IE - HKCU\..\URLSearchHook: {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "https://syscor1.websiteseguro.com/_sys/?id=MTI="
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..network.proxy.ftp: " "
FF - prefs.js..network.proxy.gopher: " "
FF - prefs.js..network.proxy.http: " "
FF - prefs.js..network.proxy.no_proxies_on: " "
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: " "
FF - prefs.js..network.proxy.ssl: " "
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Arquivos de programas\Mozilla Firefox\components [2010/02/27 08:28:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Arquivos de programas\Mozilla Firefox\plugins [2010/02/27 08:28:03 | 000,000,000 | ---D | M]
[2009/12/18 06:28:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Extensions
[2009/05/27 18:21:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Extensions\mozswing@mozswing.org
[2010/03/01 08:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\extensions
[2009/12/18 06:30:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/18 06:27:55 | 000,000,000 | ---D | M] -- C:\Arquivos de programas\Mozilla Firefox\extensions
[2010/02/27 08:27:54 | 000,001,027 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\buscape.xml
[2010/02/27 08:27:54 | 000,001,212 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\mercadolivre.xml
[2010/02/27 08:27:54 | 000,001,168 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\wikipedia-br.xml
[2010/02/27 08:27:54 | 000,000,648 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\yahoo-br.xml
O1 HOSTS File: ([2010/03/01 14:23:04 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (D'Accord Music Software BR Toolbar) - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll ()
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (D'Accord Music Software BR Toolbar) - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe ()
O4 - HKLM..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe (Google.inc)
O4 - HKLM..\Run: [ToolBoxFX] C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - HKCU..\Run: [Skype] C:\Arquivos de programas\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKLM..\RunOnce: [wextract_cleanup0] C:\WINDOWS\System32\advpack.DLL (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe (Citrix Systems, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\McAfee Security Scan.lnk = C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2...78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Arquivos de programas\Arquivos comuns\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop Components:0 (Minha página inicial atual) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Alegria.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Alegria.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/16 12:53:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/04/16 12:52:59 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk - C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe - (Citrix Systems, Inc)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk - C:\ARQUIV~1\ICMEDI~1\ICM532\LAUNCH~1.EXE - File not found
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= - File not found
MsConfig - StartUpReg: DB Audio Control Panel - hkey= - key= - C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe ()
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Arquivos de programas\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
MsConfig - StartUpReg: PCTVOICE - hkey= - key= - File not found
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Arquivos de programas\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Arquivos de programas\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0CBADDF4-2CF6-4CDB-B4F5-29B8FCA7FE07} - .NET Framework
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Processamento de gráficos vetoriais (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Ligação de dados de HTML dinâmico para Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Cancelar inscrição
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Criação avançada
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes DirectAnimation para Java
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Atualização de Segurança para Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Pastas da Web
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Agendador de tarefas
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
========== Files/Folders - Created Within 30 Days ==========
[2099/01/01 12:00:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\LogMeIn
[2010/03/01 17:07:37 | 000,551,424 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
[2010/03/01 17:03:39 | 001,226,648 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\ShowMyPC3005.exe
[2010/02/26 17:47:36 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\AIKO_PST_CUSTOM_V1.0.0
[2010/02/26 17:16:06 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\ShowMyPCService
[2010/02/26 13:25:42 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/02/26 13:24:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/02/26 13:24:20 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/02/26 13:24:20 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/02/26 13:24:20 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/02/26 13:24:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/02/26 13:23:59 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/02/26 13:19:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Usuario\Desktop\HostsXpert
[2010/02/25 13:14:27 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/25 13:14:22 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/22 13:41:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Usuario\Meus documentos\Downloads
[2010/02/22 13:30:03 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dados de aplicativos\Microsoft
[2010/02/22 13:30:02 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dados de aplicativos\Microsoft
[2010/02/20 07:00:01 | 001,153,176 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\nsvpnc_setup.exe
[2010/02/19 13:58:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Malwarebytes
[2010/02/19 13:58:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes
[2010/02/19 13:58:25 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Malwarebytes' Anti-Malware
[2010/02/05 06:39:40 | 001,321,472 | ---- | C] (Google.inc) -- C:\WINDOWS\System32\Google_Tool_Bar_Notification018.exe
[2010/02/03 16:40:42 | 000,608,567 | ---- | C] (ZTEMT ) -- C:\Documents and Settings\Usuario\Desktop\76E_76Em_PST_CUSTOM_V1.0.0setup.exe
[2009/12/31 13:20:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Configurações locais\Dados de aplicativos\Microsoft
[2009/12/31 13:20:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\Microsoft
[2009/12/16 14:32:39 | 001,153,176 | ---- | C] (Microsoft Corporation) -- C:\Arquivos de programas\nsvpnc_setup.exe
[2009/12/02 11:48:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\ICS
[2009/08/12 08:00:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dados de aplicativos\TeamViewer
[2009/08/10 16:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dados de aplicativos\Help
[2009/08/10 16:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\Help
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/03/01 17:08:03 | 000,551,424 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
[2010/03/01 17:04:39 | 001,226,648 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\ShowMyPC3005.exe
[2010/03/01 14:23:35 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/01 14:23:23 | 000,210,066 | ---- | M] () -- C:\WINDOWS\System32\VIDEO-BBB-10_000007933.zip
[2010/03/01 14:23:04 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/01 14:22:43 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/01 14:22:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/01 14:22:39 | 502,820,864 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/01 14:21:34 | 006,029,312 | ---- | M] () -- C:\Documents and Settings\Usuario\ntuser.dat
[2010/03/01 14:21:34 | 000,000,330 | -HS- | M] () -- C:\Documents and Settings\Usuario\ntuser.ini
[2010/03/01 14:11:33 | 003,875,750 | R--- | M] () -- C:\Documents and Settings\Usuario\Desktop\ComboFix.exe
[2010/03/01 11:14:59 | 000,048,128 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM.xls
[2010/03/01 07:48:36 | 000,209,586 | ---- | M] () -- C:\WINDOWS\System32\000006564.zip
[2010/03/01 07:30:12 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/27 08:40:29 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM FEVEREIRO 2010.xls
[2010/02/26 14:20:02 | 001,629,696 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 26.02.2010 Aparelhos..xls
[2010/02/26 13:25:48 | 000,000,303 | RHS- | M] () -- C:\boot.ini
[2010/02/25 13:14:30 | 000,000,772 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/20 06:14:19 | 000,001,861 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
[2010/02/20 06:13:10 | 001,153,176 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\nsvpnc_setup.exe
[2010/02/19 11:52:58 | 000,184,320 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\Simulador de Salario Agpm.xls
[2010/02/09 16:02:27 | 001,396,736 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 21.01.2010 Modens.xls
[2010/02/08 17:00:45 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA TABELA DE RECARGA.doc
[2010/02/05 06:39:22 | 001,321,472 | ---- | M] (Google.inc) -- C:\WINDOWS\System32\drivers\etc\tarantila_85.exe
[2010/02/05 06:39:22 | 001,321,472 | ---- | M] (Google.inc) -- C:\WINDOWS\System32\Google_Tool_Bar_Notification018.exe
[2010/02/04 12:50:08 | 000,043,520 | ---- | M] () -- C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/03 16:40:50 | 000,608,567 | ---- | M] (ZTEMT ) -- C:\Documents and Settings\Usuario\Desktop\76E_76Em_PST_CUSTOM_V1.0.0setup.exe
[2010/02/03 15:28:05 | 000,000,746 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ZTEPST.lnk
[2010/02/03 09:16:20 | 000,000,052 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/02/03 07:10:04 | 000,492,032 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\index_brc26.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/03/01 14:23:23 | 000,210,066 | ---- | C] () -- C:\WINDOWS\System32\VIDEO-BBB-10_000007933.zip
[2010/03/01 08:13:57 | 000,048,128 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM.xls
[2010/03/01 07:48:36 | 000,209,586 | ---- | C] () -- C:\WINDOWS\System32\000006564.zip
[2010/02/26 14:19:16 | 001,629,696 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 26.02.2010 Aparelhos..xls
[2010/02/26 13:25:48 | 000,000,233 | ---- | C] () -- C:\Boot.bak
[2010/02/26 13:25:44 | 000,261,856 | ---- | C] () -- C:\cmldr
[2010/02/26 13:24:20 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/02/26 13:24:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/02/26 13:24:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/02/26 13:24:20 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/02/26 13:24:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/02/26 13:21:50 | 003,875,750 | R--- | C] () -- C:\Documents and Settings\Usuario\Desktop\ComboFix.exe
[2010/02/25 13:14:30 | 000,000,772 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 12:13:59 | 006,029,312 | ---- | C] () -- C:\Documents and Settings\Usuario\ntuser.dat
[2010/02/10 13:12:51 | 000,032,256 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM FEVEREIRO 2010.xls
[2010/02/09 16:00:57 | 001,396,736 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 21.01.2010 Modens.xls
[2010/02/08 09:19:08 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA TABELA DE RECARGA.doc
[2010/02/03 09:16:52 | 000,000,746 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ZTEPST.lnk
[2010/02/01 14:29:53 | 000,184,320 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\Simulador de Salario Agpm.xls
[2010/01/20 08:31:18 | 000,000,052 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/12/14 14:34:51 | 041,099,128 | ---- | C] () -- C:\Arquivos de programas\setuppor.exe
[2009/10/01 16:31:53 | 000,000,178 | ---- | C] () -- C:\WINDOWS\VPersonalityPlus.INI
[2009/09/16 09:24:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\webica.ini
[2009/05/28 11:48:50 | 000,043,520 | ---- | C] () -- C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/22 15:55:15 | 000,000,140 | ---- | C] () -- C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\fusioncache.dat
[2009/05/15 12:04:42 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\SDGLYBMPWPP.SYS
[2009/04/17 15:53:05 | 000,106,583 | ---- | C] () -- C:\WINDOWS\System32\fwnetcfg.dll
[2009/04/17 15:52:59 | 000,004,133 | ---- | C] () -- C:\WINDOWS\entrust.ini
[2009/04/17 15:40:49 | 000,000,283 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2009/04/17 15:40:38 | 000,001,259 | ---- | C] () -- C:\WINDOWS\hpbvnstp.ini
[2009/04/17 15:17:21 | 000,002,170 | ---- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\hpzinstall.log
[2009/04/17 10:32:27 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/17 10:19:12 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2009/04/17 10:08:58 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll
[2006/09/13 12:26:08 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\HPMLVS.dll
[2006/05/05 09:51:40 | 000,241,664 | ---- | C] () -- C:\WINDOWS\System32\hppapr04.DLL
[2003/04/07 11:30:02 | 000,005,383 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/12 03:49:00 | 000,708,608 | ---- | C] () -- C:\WINDOWS\System32\ltcry13n.dll
[2001/07/06 16:30:02 | 000,003,277 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
========== LOP Check ==========
[2009/11/18 11:05:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Citrix
[2009/06/29 14:15:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\IM
[2009/06/29 14:13:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\IncrediMail
[2010/02/26 07:32:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\InterApp
[2009/12/02 11:48:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\LogMeIn
[2009/06/15 15:17:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\TEMP
[2009/06/06 10:10:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Foxit
[2009/10/05 12:20:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\GrabPro
[2009/04/17 16:21:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\ICAClient
[2009/05/30 12:56:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\LimeWire
[2009/10/07 14:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Orbit
[2009/10/01 16:42:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Screaming Bee
[2009/06/15 16:00:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\SecondLife
[2009/08/11 09:07:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\TeamViewer
[2009/06/26 12:14:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\WinNT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2009/12/02 11:48:19 | 000,001,024 | ---- | M] () -- C:\.rnd
[2009/10/28 17:03:18 | 007,767,004 | ---- | M] () -- C:\Atualizacaohuaweie156.zip
[2009/04/16 12:53:47 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/11/18 13:51:55 | 000,000,233 | ---- | M] () -- C:\Boot.bak
[2010/02/26 13:25:48 | 000,000,303 | RHS- | M] () -- C:\boot.ini
[2008/04/14 05:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin
[2004/08/03 23:00:16 | 000,261,856 | ---- | M] () -- C:\cmldr
[2010/03/01 14:30:09 | 000,014,483 | ---- | M] () -- C:\ComboFix.txt
[2009/04/16 12:53:47 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/01/09 08:39:08 | 010,939,342 | ---- | M] () -- C:\Dealers.exe
[2006/04/25 23:00:00 | 000,053,248 | ---- | M] () -- C:\gendel32.exe
[2010/03/01 14:22:39 | 502,820,864 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/16 12:53:47 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/04/16 12:53:47 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 05:00:00 | 000,024,448 | RHS- | M] (Microsoft Corporation) -- C:\NTBOOTDD.SYS
[2008/04/14 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 05:00:00 | 000,251,696 | RHS- | M] () -- C:\ntldr
[2010/03/01 14:22:37 | 754,974,720 | -HS- | M] () -- C:\pagefile.sys
[2009/10/28 17:05:51 | 000,000,915 | ---- | M] () -- C:\SoftUpdateLog.txt
[2009/04/16 15:11:02 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/04/17 09:41:01 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/04/16 15:11:02 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/04/17 09:41:01 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/07/09 14:52:32 | 000,000,378 | ---- | M] () -- C:\VIVO SCORE.url
< %PROGRAMFILES%\*.* >
[2009/12/16 14:33:20 | 001,153,176 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\nsvpnc_setup.exe
[2009/12/14 14:39:38 | 041,099,128 | ---- | M] () -- C:\Arquivos de programas\setuppor.exe
< %PROGRAMFILES%\Internet Explorer\*.* >
[2009/03/18 07:48:08 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\HMMAPI.DLL
[2009/03/18 07:48:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\iedw.exe
[2009/03/18 07:48:22 | 000,287,744 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\ieproxy.dll
[2009/04/25 02:27:50 | 000,636,088 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\iexplore.exe
========== Alternate Data Streams ==========
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:AE9A5120
< End of report >
Agradeço.
Bom, foi gerado dois logs, segue o log: OTL.txt
Caso seja necessario, posto o outro log, o nome dele é Extras.txt
OTL logfile created on: 1/3/2010 17:10:23 - Run 1
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Documents and Settings\Usuario\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy
479,00 Mb Total Physical Memory | 170,00 Mb Available Physical Memory | 35,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas
Drive C: | 37,30 Gb Total Space | 18,21 Gb Free Space | 48,81% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: FRENTE02
Current User Name: AGPM
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/03/01 17:08:03 | 000,551,424 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
PRC - [2010/03/01 17:04:39 | 001,226,648 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\ShowMyPC3005.exe
PRC - [2010/02/05 06:39:22 | 001,321,472 | ---- | M] (Google.inc) -- C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe
PRC - [2009/11/10 14:21:56 | 002,766,232 | ---- | M] (ShowMyPC) -- C:\Documents and Settings\Usuario\Configurações locais\Temp\IXP000.TMP\SMPCSetup.exe
PRC - [2009/10/09 12:11:12 | 025,623,336 | R--- | M] (Skype Technologies S.A.) -- C:\Arquivos de programas\Skype\Phone\Skype.exe
PRC - [2009/10/09 12:11:12 | 000,078,008 | R--- | M] (Skype Technologies) -- C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe
PRC - [2009/09/28 18:34:22 | 000,116,032 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\ramaint.exe
PRC - [2009/09/28 18:34:16 | 000,378,176 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LMIGuardian.exe
PRC - [2009/07/27 21:19:10 | 000,199,184 | ---- | M] (McAfee, Inc.) -- C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe
PRC - [2009/06/12 03:53:20 | 001,393,304 | ---- | M] (Citrix Systems, Inc) -- C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe
PRC - [2009/06/12 03:51:22 | 000,139,264 | ---- | M] (Citrix Systems, Inc) -- C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/12/15 14:30:32 | 003,956,520 | ---- | M] (TeamViewer GmbH) -- C:\Arquivos de programas\TeamViewer\Version4\TeamViewer.exe
PRC - [2008/12/15 14:11:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) -- C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe
PRC - [2008/10/16 21:38:56 | 000,336,792 | ---- | M] (Simon Tatham) -- C:\Documents and Settings\Usuario\Configurações locais\Temp\IXP000.TMP\sps.exe
PRC - [2008/08/11 11:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe
PRC - [2008/04/14 05:00:00 | 001,035,776 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/30 07:31:56 | 000,081,920 | R--- | M] () -- C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe
PRC - [2007/11/05 00:04:14 | 000,573,440 | ---- | M] (TightVNC Group) -- C:\Documents and Settings\Usuario\Configurações locais\Temp\IXP000.TMP\smwinvnc.exe
PRC - [2006/09/13 12:25:00 | 000,069,632 | ---- | M] (Software 2000 Limited) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1005MC.EXE
PRC - [2006/05/05 09:49:46 | 000,045,056 | ---- | M] (HP) -- C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe
PRC - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
========== Modules (SafeList) ==========
MOD - [2010/03/01 17:08:03 | 000,551,424 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2009/09/28 18:34:22 | 000,116,032 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2009/06/12 03:51:22 | 000,139,264 | ---- | M] (Citrix Systems, Inc) [Auto | Running] -- C:\Arquivos de programas\Citrix\Secure Access Client\nsverctl.exe -- (nsverctl)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Arquivos de programas\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/12/15 14:11:44 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Arquivos de programas\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4)
SRV - [2008/08/11 11:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2008/01/30 07:31:56 | 000,081,920 | R--- | M] () [Auto | Running] -- C:\WINDOWS\system32\SupportAppXL\cdrom_mon.exe -- (Autorun CDROM Monitor)
SRV - [2003/07/28 20:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2009/09/28 18:34:48 | 000,083,288 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2009/06/12 03:53:18 | 000,073,368 | ---- | M] (Citrix Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\net6im51.sys -- (Net6IM)
DRV - [2009/04/06 13:19:46 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2009/03/30 08:39:10 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009/03/30 08:39:06 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009/03/30 08:38:48 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008/12/13 10:26:38 | 000,102,400 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2008/08/11 11:41:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2008/08/11 11:41:00 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Arquivos de programas\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2008/08/11 11:40:34 | 000,010,144 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lmimirr.sys -- (lmimirr)
DRV - [2008/05/18 19:51:31 | 000,009,216 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32)
DRV - [2008/04/14 05:00:00 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2008/04/14 05:00:00 | 000,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2008/04/13 11:45:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) Driver de áudio USB (WDM)
DRV - [2008/04/13 06:34:34 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB)
DRV - [2007/04/10 09:34:50 | 000,098,432 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\zteusbser.sys -- (zteusbser)
DRV - [2006/05/05 09:51:40 | 000,009,344 | ---- | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hpfxbulk.sys -- (HPFXBULK)
DRV - [2004/07/22 17:17:08 | 000,042,496 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fetnd5b.sys -- (FETNDISB)
DRV - [2004/05/24 20:54:10 | 000,362,878 | R--- | M] (PCTEL, INC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ptserial.sys -- (Ptserial)
DRV - [2004/03/20 09:55:02 | 000,070,384 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vvoice.sys -- (Vvoice)
DRV - [2004/03/20 09:54:18 | 000,703,737 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vmodem.sys -- (Vmodem)
DRV - [2004/03/20 09:52:20 | 000,804,754 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpctcom.sys -- (Vpctcom)
DRV - [2003/08/19 18:27:40 | 000,073,984 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viaudio.sys -- (VIAudio) VIA AC'97 Audio Controller (WDM)
DRV - [2003/07/17 16:10:06 | 000,007,040 | ---- | M] (VIA Networking Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\ntsim.sys -- (NTSIM)
DRV - [2003/07/02 04:42:00 | 000,027,904 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2001/08/17 21:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)
DRV - [2001/08/17 17:13:08 | 000,027,165 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fetnd5.sys -- (FETNDIS)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.vivo.com.br/
IE - HKCU\..\URLSearchHook: {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "https://syscor1.websiteseguro.com/_sys/?id=MTI="
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..network.proxy.ftp: " "
FF - prefs.js..network.proxy.gopher: " "
FF - prefs.js..network.proxy.http: " "
FF - prefs.js..network.proxy.no_proxies_on: " "
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: " "
FF - prefs.js..network.proxy.ssl: " "
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Arquivos de programas\Mozilla Firefox\components [2010/02/27 08:28:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Arquivos de programas\Mozilla Firefox\plugins [2010/02/27 08:28:03 | 000,000,000 | ---D | M]
[2009/12/18 06:28:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Extensions
[2009/05/27 18:21:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Extensions\mozswing@mozswing.org
[2010/03/01 08:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\extensions
[2009/12/18 06:30:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Usuario\Dados de aplicativos\Mozilla\Firefox\Profiles\gmfx7183.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/18 06:27:55 | 000,000,000 | ---D | M] -- C:\Arquivos de programas\Mozilla Firefox\extensions
[2010/02/27 08:27:54 | 000,001,027 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\buscape.xml
[2010/02/27 08:27:54 | 000,001,212 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\mercadolivre.xml
[2010/02/27 08:27:54 | 000,001,168 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\wikipedia-br.xml
[2010/02/27 08:27:54 | 000,000,648 | ---- | M] () -- C:\Arquivos de programas\Mozilla Firefox\searchplugins\yahoo-br.xml
O1 HOSTS File: ([2010/03/01 14:23:04 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (D'Accord Music Software BR Toolbar) - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll ()
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Arquivos de programas\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Arquivos de programas\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (D'Accord Music Software BR Toolbar) - {c6684bb3-d1ce-4c5e-be04-62e5ec0d85ad} - C:\Arquivos de programas\D'Accord_Music_Software_BR\tbD'Ac.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DB Audio Control Panel] C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe ()
O4 - HKLM..\Run: [Googlee Tooll Bar Notification018] C:\WINDOWS\system32\Google_Tool_Bar_Notification018.exe (Google.inc)
O4 - HKLM..\Run: [ToolBoxFX] C:\Arquivos de programas\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - HKCU..\Run: [Skype] C:\Arquivos de programas\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKLM..\RunOnce: [wextract_cleanup0] C:\WINDOWS\System32\advpack.DLL (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk = C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe (Citrix Systems, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\McAfee Security Scan.lnk = C:\Arquivos de programas\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2...78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Arquivos de programas\Arquivos comuns\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Arquivos de programas\Arquivos comuns\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop Components:0 (Minha página inicial atual) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Alegria.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Alegria.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/16 12:53:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/04/16 12:52:59 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Citrix Access Gateway.lnk - C:\Arquivos de programas\Citrix\Secure Access Client\nsload.exe - (Citrix Systems, Inc)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Launchpad.lnk - C:\ARQUIV~1\ICMEDI~1\ICM532\LAUNCH~1.EXE - File not found
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= - File not found
MsConfig - StartUpReg: DB Audio Control Panel - hkey= - key= - C:\Arquivos de programas\Windows Media Player\RtHDVCpl.exe ()
MsConfig - StartUpReg: HP Software Update - hkey= - key= - C:\Arquivos de programas\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
MsConfig - StartUpReg: PCTVOICE - hkey= - key= - File not found
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Arquivos de programas\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Arquivos de programas\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0CBADDF4-2CF6-4CDB-B4F5-29B8FCA7FE07} - .NET Framework
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Processamento de gráficos vetoriais (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Ligação de dados de HTML dinâmico para Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Cancelar inscrição
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Criação avançada
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes DirectAnimation para Java
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Atualização de Segurança para Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Pastas da Web
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Agendador de tarefas
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
========== Files/Folders - Created Within 30 Days ==========
[2099/01/01 12:00:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\LogMeIn
[2010/03/01 17:07:37 | 000,551,424 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
[2010/03/01 17:03:39 | 001,226,648 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\ShowMyPC3005.exe
[2010/02/26 17:47:36 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\AIKO_PST_CUSTOM_V1.0.0
[2010/02/26 17:16:06 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\ShowMyPCService
[2010/02/26 13:25:42 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/02/26 13:24:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/02/26 13:24:20 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/02/26 13:24:20 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/02/26 13:24:20 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/02/26 13:24:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/02/26 13:23:59 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/02/26 13:19:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Usuario\Desktop\HostsXpert
[2010/02/25 13:14:27 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/25 13:14:22 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/22 13:41:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Usuario\Meus documentos\Downloads
[2010/02/22 13:30:03 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dados de aplicativos\Microsoft
[2010/02/22 13:30:02 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dados de aplicativos\Microsoft
[2010/02/20 07:00:01 | 001,153,176 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\nsvpnc_setup.exe
[2010/02/19 13:58:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Malwarebytes
[2010/02/19 13:58:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes
[2010/02/19 13:58:25 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\Malwarebytes' Anti-Malware
[2010/02/05 06:39:40 | 001,321,472 | ---- | C] (Google.inc) -- C:\WINDOWS\System32\Google_Tool_Bar_Notification018.exe
[2010/02/03 16:40:42 | 000,608,567 | ---- | C] (ZTEMT ) -- C:\Documents and Settings\Usuario\Desktop\76E_76Em_PST_CUSTOM_V1.0.0setup.exe
[2009/12/31 13:20:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Configurações locais\Dados de aplicativos\Microsoft
[2009/12/31 13:20:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\Microsoft
[2009/12/16 14:32:39 | 001,153,176 | ---- | C] (Microsoft Corporation) -- C:\Arquivos de programas\nsvpnc_setup.exe
[2009/12/02 11:48:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\ICS
[2009/08/12 08:00:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dados de aplicativos\TeamViewer
[2009/08/10 16:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dados de aplicativos\Help
[2009/08/10 16:55:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Configurações locais\Dados de aplicativos\Help
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/03/01 17:08:03 | 000,551,424 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Usuario\Desktop\OTL.exe
[2010/03/01 17:04:39 | 001,226,648 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\ShowMyPC3005.exe
[2010/03/01 14:23:35 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/01 14:23:23 | 000,210,066 | ---- | M] () -- C:\WINDOWS\System32\VIDEO-BBB-10_000007933.zip
[2010/03/01 14:23:04 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/01 14:22:43 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/01 14:22:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/01 14:22:39 | 502,820,864 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/01 14:21:34 | 006,029,312 | ---- | M] () -- C:\Documents and Settings\Usuario\ntuser.dat
[2010/03/01 14:21:34 | 000,000,330 | -HS- | M] () -- C:\Documents and Settings\Usuario\ntuser.ini
[2010/03/01 14:11:33 | 003,875,750 | R--- | M] () -- C:\Documents and Settings\Usuario\Desktop\ComboFix.exe
[2010/03/01 11:14:59 | 000,048,128 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM.xls
[2010/03/01 07:48:36 | 000,209,586 | ---- | M] () -- C:\WINDOWS\System32\000006564.zip
[2010/03/01 07:30:12 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/27 08:40:29 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM FEVEREIRO 2010.xls
[2010/02/26 14:20:02 | 001,629,696 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 26.02.2010 Aparelhos..xls
[2010/02/26 13:25:48 | 000,000,303 | RHS- | M] () -- C:\boot.ini
[2010/02/25 13:14:30 | 000,000,772 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/20 06:14:19 | 000,001,861 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Citrix Access Gateway.lnk
[2010/02/20 06:13:10 | 001,153,176 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Usuario\Desktop\nsvpnc_setup.exe
[2010/02/19 11:52:58 | 000,184,320 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\Simulador de Salario Agpm.xls
[2010/02/09 16:02:27 | 001,396,736 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 21.01.2010 Modens.xls
[2010/02/08 17:00:45 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA TABELA DE RECARGA.doc
[2010/02/05 06:39:22 | 001,321,472 | ---- | M] (Google.inc) -- C:\WINDOWS\System32\drivers\etc\tarantila_85.exe
[2010/02/05 06:39:22 | 001,321,472 | ---- | M] (Google.inc) -- C:\WINDOWS\System32\Google_Tool_Bar_Notification018.exe
[2010/02/04 12:50:08 | 000,043,520 | ---- | M] () -- C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/03 16:40:50 | 000,608,567 | ---- | M] (ZTEMT ) -- C:\Documents and Settings\Usuario\Desktop\76E_76Em_PST_CUSTOM_V1.0.0setup.exe
[2010/02/03 15:28:05 | 000,000,746 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ZTEPST.lnk
[2010/02/03 09:16:20 | 000,000,052 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/02/03 07:10:04 | 000,492,032 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\index_brc26.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/03/01 14:23:23 | 000,210,066 | ---- | C] () -- C:\WINDOWS\System32\VIDEO-BBB-10_000007933.zip
[2010/03/01 08:13:57 | 000,048,128 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM.xls
[2010/03/01 07:48:36 | 000,209,586 | ---- | C] () -- C:\WINDOWS\System32\000006564.zip
[2010/02/26 14:19:16 | 001,629,696 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 26.02.2010 Aparelhos..xls
[2010/02/26 13:25:48 | 000,000,233 | ---- | C] () -- C:\Boot.bak
[2010/02/26 13:25:44 | 000,261,856 | ---- | C] () -- C:\cmldr
[2010/02/26 13:24:20 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/02/26 13:24:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/02/26 13:24:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/02/26 13:24:20 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/02/26 13:24:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/02/26 13:21:50 | 003,875,750 | R--- | C] () -- C:\Documents and Settings\Usuario\Desktop\ComboFix.exe
[2010/02/25 13:14:30 | 000,000,772 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 12:13:59 | 006,029,312 | ---- | C] () -- C:\Documents and Settings\Usuario\ntuser.dat
[2010/02/10 13:12:51 | 000,032,256 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA DE PONTO AGPM FEVEREIRO 2010.xls
[2010/02/09 16:00:57 | 001,396,736 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\Matriz de Preços Agpm 21.01.2010 Modens.xls
[2010/02/08 09:19:08 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\FOLHA TABELA DE RECARGA.doc
[2010/02/03 09:16:52 | 000,000,746 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ZTEPST.lnk
[2010/02/01 14:29:53 | 000,184,320 | ---- | C] () -- C:\Documents and Settings\Usuario\Desktop\Simulador de Salario Agpm.xls
[2010/01/20 08:31:18 | 000,000,052 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/12/14 14:34:51 | 041,099,128 | ---- | C] () -- C:\Arquivos de programas\setuppor.exe
[2009/10/01 16:31:53 | 000,000,178 | ---- | C] () -- C:\WINDOWS\VPersonalityPlus.INI
[2009/09/16 09:24:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\webica.ini
[2009/05/28 11:48:50 | 000,043,520 | ---- | C] () -- C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/22 15:55:15 | 000,000,140 | ---- | C] () -- C:\Documents and Settings\Usuario\Configurações locais\Dados de aplicativos\fusioncache.dat
[2009/05/15 12:04:42 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\SDGLYBMPWPP.SYS
[2009/04/17 15:53:05 | 000,106,583 | ---- | C] () -- C:\WINDOWS\System32\fwnetcfg.dll
[2009/04/17 15:52:59 | 000,004,133 | ---- | C] () -- C:\WINDOWS\entrust.ini
[2009/04/17 15:40:49 | 000,000,283 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2009/04/17 15:40:38 | 000,001,259 | ---- | C] () -- C:\WINDOWS\hpbvnstp.ini
[2009/04/17 15:17:21 | 000,002,170 | ---- | C] () -- C:\Documents and Settings\All Users\Dados de aplicativos\hpzinstall.log
[2009/04/17 10:32:27 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/17 10:19:12 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2009/04/17 10:08:58 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll
[2006/09/13 12:26:08 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\HPMLVS.dll
[2006/05/05 09:51:40 | 000,241,664 | ---- | C] () -- C:\WINDOWS\System32\hppapr04.DLL
[2003/04/07 11:30:02 | 000,005,383 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/12 03:49:00 | 000,708,608 | ---- | C] () -- C:\WINDOWS\System32\ltcry13n.dll
[2001/07/06 16:30:02 | 000,003,277 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
========== LOP Check ==========
[2009/11/18 11:05:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\Citrix
[2009/06/29 14:15:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\IM
[2009/06/29 14:13:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\IncrediMail
[2010/02/26 07:32:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\InterApp
[2009/12/02 11:48:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\LogMeIn
[2009/06/15 15:17:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dados de aplicativos\TEMP
[2009/06/06 10:10:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Foxit
[2009/10/05 12:20:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\GrabPro
[2009/04/17 16:21:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\ICAClient
[2009/05/30 12:56:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\LimeWire
[2009/10/07 14:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Orbit
[2009/10/01 16:42:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\Screaming Bee
[2009/06/15 16:00:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\SecondLife
[2009/08/11 09:07:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\TeamViewer
[2009/06/26 12:14:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Usuario\Dados de aplicativos\WinNT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.* >
[2009/12/02 11:48:19 | 000,001,024 | ---- | M] () -- C:\.rnd
[2009/10/28 17:03:18 | 007,767,004 | ---- | M] () -- C:\Atualizacaohuaweie156.zip
[2009/04/16 12:53:47 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/11/18 13:51:55 | 000,000,233 | ---- | M] () -- C:\Boot.bak
[2010/02/26 13:25:48 | 000,000,303 | RHS- | M] () -- C:\boot.ini
[2008/04/14 05:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin
[2004/08/03 23:00:16 | 000,261,856 | ---- | M] () -- C:\cmldr
[2010/03/01 14:30:09 | 000,014,483 | ---- | M] () -- C:\ComboFix.txt
[2009/04/16 12:53:47 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/01/09 08:39:08 | 010,939,342 | ---- | M] () -- C:\Dealers.exe
[2006/04/25 23:00:00 | 000,053,248 | ---- | M] () -- C:\gendel32.exe
[2010/03/01 14:22:39 | 502,820,864 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/16 12:53:47 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/04/16 12:53:47 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 05:00:00 | 000,024,448 | RHS- | M] (Microsoft Corporation) -- C:\NTBOOTDD.SYS
[2008/04/14 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 05:00:00 | 000,251,696 | RHS- | M] () -- C:\ntldr
[2010/03/01 14:22:37 | 754,974,720 | -HS- | M] () -- C:\pagefile.sys
[2009/10/28 17:05:51 | 000,000,915 | ---- | M] () -- C:\SoftUpdateLog.txt
[2009/04/16 15:11:02 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/04/17 09:41:01 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/04/16 15:11:02 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/04/17 09:41:01 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/07/09 14:52:32 | 000,000,378 | ---- | M] () -- C:\VIVO SCORE.url
< %PROGRAMFILES%\*.* >
[2009/12/16 14:33:20 | 001,153,176 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\nsvpnc_setup.exe
[2009/12/14 14:39:38 | 041,099,128 | ---- | M] () -- C:\Arquivos de programas\setuppor.exe
< %PROGRAMFILES%\Internet Explorer\*.* >
[2009/03/18 07:48:08 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\HMMAPI.DLL
[2009/03/18 07:48:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\iedw.exe
[2009/03/18 07:48:22 | 000,287,744 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\ieproxy.dll
[2009/04/25 02:27:50 | 000,636,088 | ---- | M] (Microsoft Corporation) -- C:\Arquivos de programas\Internet Explorer\iexplore.exe
========== Alternate Data Streams ==========
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Dados de aplicativos\TEMP:AE9A5120
< End of report >
Agradeço.
| QUOTE |
| C:\WINDOWS\System32\VIDEO-BBB-10_000007933.zip |
Você sabe de que se trata esse arquivo?
não, não sei do que se trata esse arquivo.
na verdade aparece dois arquivos:
VIDEO-BBB-10_000007933
VIDEO-BBB-10_000009718
Agradeço.
na verdade aparece dois arquivos:
VIDEO-BBB-10_000007933
VIDEO-BBB-10_000009718
Agradeço.
Esta é uma versão "lo-fi" do conteúdo. Para acessar a versão completa com mais informações, formatação e imagens, por favor clique aqui .