Ir ao conteúdo
  • Comunicados

    • diego_moicano

      Gostaria de se tornar um analista em Remoção de Malware?   07-12-2015

      Gostaria de se tornar um analista em Remoção de Malware? O Fórum Clube do Hardware deu início a um programa de treinamento em análises de log. Os interessados deverão enviar um email para aprendizes (arroba) clubedohardware (ponto) com (ponto) br respondendo as seguintes perguntas: Por que você gostaria de aprender a analisar logs? Possui tempo hábil para o treinamento? Tem conhecimentos em informática? Se sim descreva-os. Possui inglês para leitura? Qual seu objetivo após completar o treinamento?   Não se esqueça de incluir no e-mail o seu nome de usuário (fornecer o link também), idade e cidade onde vive. Adicione também qualquer experiência e/ou razão sobre o porquê você seria um bom Analista. É digno de nota que apenas os que forem selecionados receberão resposta por MP (Mensagem Pessoal), não existe um padrão na escolha dos futuros aprendizes, todos os e-mails serão lidos e serão analisados de forma imparcial, portanto não será permitido reclamações neste aspecto. O treinamento é dado no próprio fórum. Quando um aprendiz é selecionado ele é movido para um novo grupo, onde terá acesso a fóruns fechados para os demais usuários onde poderá dar inicio ao seu treinamento. Importante: A cada 30 dias os e-mails não selecionados serão apagados, portanto você pode enviar um novo e-mail após 1 mês, e-mails enviados antes serão desconsiderados.  
    • Gabriel Torres

      Seja um moderador do Clube do Hardware!   12-02-2016

      Prezados membros do Clube do Hardware, Está aberto o processo de seleção de novos moderadores para diversos setores ou áreas do Clube do Hardware. Os requisitos são:   Pelo menos 500 posts e um ano de cadastro; Boa frequência de participação; Ser respeitoso, cordial e educado com os demais membros; Ter bom nível de português; Ter razoável conhecimento da área em que pretende atuar; Saber trabalhar em equipe (com os moderadores, coordenadores e administradores).   Os interessados deverão enviar uma mensagem privada para o usuário @Equipe Clube do Hardware com o título "Candidato a moderador". A mensagem deverá conter respostas às perguntas abaixo:   Qual o seu nome completo? Qual sua data de nascimento? Qual sua formação/profissão? Já atuou como moderador em algo outro fórum, se sim, qual? De forma sucinta, explique o porquê de querer ser moderador do fórum e conte-nos um pouco sobre você.   OBS: Não se trata de função remunerada. Todos que fazem parte do staff são voluntários.
Marcelotronic

Pc infectado?

Recommended Posts

Dae galera se esse pc tiver muito bichado acho que o jeito era formatar mas o pc não é meu e fazer backup é um saco por favor analizem meus logs.

Logfile of HijackThis v1.99.1

Scan saved at 12:26:11, on 13/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\pctspk.exe

C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\ARQUIV~1\iGv6\sysbrand.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Silvana Rita\Desktop\HijackThis.exe

C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orkut.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://farejador.ig.com.br/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: (no name) - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - (no file)

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [bM67e53e50] Rundll32.exe "C:\WINDOWS\system32\itgmkemf.dll",s

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [sysBrand] "C:\ARQUIV~1\iGv6\sysbrand.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [TheSpyBot] C:\Program Files\TheSpyBot\TheSpyBot.exe

O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra button: Barra do iG - {FD1672E0-AE0D-465B-B345-F7B0944A121D} - (no file)

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - Unknown owner - C:\WINDOWS\system32\pctspk.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

ComboFix 08-07-12.4 - Silvana Rita 2008-07-13 12:02:15.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.133 [GMT -3:00]

Executando de: C:\Documents and Settings\Silvana Rita\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Autorun.inf

C:\Documents and Settings\All Users\Menu Iniciar\Programas\SpyMaxx

C:\Documents and Settings\All Users\Menu Iniciar\Programas\SpyMaxx\SpyMaxx.lnk

C:\Documents and Settings\All Users\Menu Iniciar\Programas\SpyMaxx\Uninstall SpyMaxx.lnk

C:\ffojc.com

C:\WINDOWS\BM67e53e50.txt

C:\WINDOWS\cookies.ini

C:\WINDOWS\cpan.dll

C:\WINDOWS\ctfmon32.exe

C:\WINDOWS\ctrlpan.dll

C:\WINDOWS\directx32.exe

C:\WINDOWS\dnsrelay.dll

C:\WINDOWS\editpad.exe

C:\WINDOWS\explore.exe

C:\WINDOWS\explorer32.exe

C:\WINDOWS\funniest.exe

C:\WINDOWS\funny.exe

C:\WINDOWS\gfmnaaa.dll

C:\WINDOWS\helpcvs.exe

C:\WINDOWS\inetinf.exe

C:\WINDOWS\internet.exe

C:\WINDOWS\msconfd.dll

C:\WINDOWS\msspi.dll

C:\WINDOWS\mswsc10.dll

C:\WINDOWS\mswsc20.dll

C:\WINDOWS\qttasks.exe

C:\WINDOWS\quicken.exe

C:\WINDOWS\rundll16.exe

C:\WINDOWS\rundll32.vbe

C:\WINDOWS\searchword.dll

C:\WINDOWS\sistem.exe

C:\WINDOWS\svchost32.exe

C:\WINDOWS\svcinit.exe

C:\WINDOWS\system32\aicbutjn.ini

C:\WINDOWS\system32\amtolmdh.dll

C:\WINDOWS\system32\bskledfl.dll

C:\WINDOWS\system32\ckvo.exe

C:\WINDOWS\system32\ckvo0.dll

C:\WINDOWS\system32\cxuvugly.ini

C:\WINDOWS\system32\dcwmol.dll

C:\WINDOWS\system32\dlymbxmq.ini

C:\WINDOWS\system32\drdbhjkc.dll

C:\WINDOWS\system32\efcDTLBr.dll

C:\WINDOWS\system32\geBqPIcc.dll

C:\WINDOWS\system32\geBroMDW.dll

C:\WINDOWS\system32\gxledroc.ini

C:\WINDOWS\system32\hljwugsf.bin

C:\WINDOWS\system32\kavo.exe

C:\WINDOWS\system32\kridkgwp.ini

C:\WINDOWS\system32\kxevav.dll

C:\WINDOWS\system32\ljJBtsqr.dll

C:\WINDOWS\system32\lvjiem.dll

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\mringtwp.ini

C:\WINDOWS\system32\MSINET.oca

C:\WINDOWS\system32\nfqkbwdk.dll

C:\WINDOWS\system32\pac.txt

C:\WINDOWS\system32\pmnnKDwv.dll

C:\WINDOWS\system32\qeeycqfk.dll

C:\WINDOWS\system32\qmcbtphq.dll

C:\WINDOWS\system32\qmxbmyld.dll

C:\WINDOWS\system32\rycuje.dll

C:\WINDOWS\system32\sknjvy.dll

C:\WINDOWS\system32\tCIlUvut.ini

C:\WINDOWS\system32\tCIlUvut.ini2

C:\WINDOWS\system32\tovqwlvl.dll

C:\WINDOWS\system32\tudltmht.ini

C:\WINDOWS\system32\vpbcwy.dll

C:\WINDOWS\system32\wfrdscmc.ini

C:\WINDOWS\system32\xbifijnn.dll

C:\WINDOWS\system32\xbwhurlc.ini

C:\WINDOWS\system32\xxyxYppq.dll

C:\WINDOWS\system32\xxyyxwtU.dll

C:\WINDOWS\system32\ybinpned.dll

C:\WINDOWS\system32\YJmmnqss.ini

C:\WINDOWS\system32\YJmmnqss.ini2

C:\WINDOWS\system32\zoimpd.dll

C:\WINDOWS\time.exe

E:\Autorun.inf

.

((((((((((((((((((((((( Ficheiros criados de 2008-06-13 to 2008-07-13 ))))))))))))))))))))))))))))))))

.

2008-07-13 09:50 . 2008-07-13 09:51 251 --a------ C:\WINDOWS\wininit.ini

2008-07-12 16:29 . 2008-07-12 16:29 197 --a------ C:\WINDOWS\system32\MRT.INI

2008-07-10 18:41 . 2008-07-12 14:51 133,983 -r-hs---- C:\k6wkwon2.exe

2008-07-09 19:42 . 2008-07-12 14:51 77,312 -r-hs---- C:\WINDOWS\system32\ckvo1.dll

2008-07-08 18:07 . 2008-07-09 19:12 132,745 -r-hs---- C:\n6j6pc0.com

2008-07-07 20:01 . 2008-07-13 09:51 110,415 --a------ C:\WINDOWS\BM67e53e50.xml

2008-07-06 14:40 . 2008-07-13 04:00 <DIR> d-------- C:\Program Files

2008-07-06 10:55 . 2008-07-13 10:43 <DIR> d-------- C:\WINDOWS\system32\olixds18

2008-07-02 21:11 . 2008-07-12 21:28 <DIR> d-------- C:\WINDOWS\system32\vi

2008-07-02 21:11 . 2008-07-12 21:27 <DIR> d-------- C:\WINDOWS\system32\modtrux18

2008-07-02 21:11 . 2008-07-12 21:27 <DIR> d-------- C:\WINDOWS\system32\gI5

2008-07-02 20:43 . 2008-07-13 11:47 <DIR> d-------- C:\Arquivos de programas\FBrowsingAdvisor

2008-07-02 20:43 . 2008-07-02 20:43 <DIR> d-------- C:\Arquivos de programas\FBrowserAdvisor

2008-07-02 20:43 . 2008-07-05 14:46 <DIR> d-------- C:\Arquivos de programas\AdvancedAdvisor

2008-06-29 19:03 . 2008-06-29 19:03 <DIR> d-------- C:\Documents and Settings\Silvana Rita\Dados de aplicativos\Ulead Systems

2008-06-29 19:03 . 2008-06-29 19:03 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Ulead Systems

2008-06-29 13:58 . 2008-07-06 12:59 <DIR> d-------- C:\Arquivos de programas\Deadhunt Demo

2008-06-29 13:44 . 2008-06-29 13:44 <DIR> d-------- C:\Arquivos de programas\Ulead Systems

2008-06-29 13:41 . 2008-06-29 13:41 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\snpstd

2008-06-29 13:40 . 2008-06-29 13:40 <DIR> d-------- C:\Arquivos de programas\CamView

2008-06-26 21:38 . 2008-06-26 21:38 <DIR> d-------- C:\WINDOWS\system32\Adobe

2008-06-22 16:24 . 2008-06-22 16:24 <DIR> d-------- C:\Arquivos de programas\Photo!

2008-06-22 16:19 . 2008-06-22 16:19 <DIR> d-------- C:\Games

2008-06-22 15:42 . 2008-07-02 21:09 <DIR> d-------- C:\Arquivos de programas\Champions World Class Soccer

2008-06-22 15:29 . 2008-06-25 20:10 <DIR> d-------- C:\Arquivos de programas\Web Photo Album

2008-06-22 15:29 . 2008-06-22 16:33 <DIR> d-------- C:\Arquivos de programas\Cartoonist

2008-06-15 18:37 . 2001-09-05 23:50 99,328 --a------ C:\WINDOWS\system32\srusd.dll

2008-06-15 18:37 . 2001-09-05 23:50 99,328 --a--c--- C:\WINDOWS\system32\dllcache\srusd.dll

2008-06-15 18:37 . 2001-09-05 23:50 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll

2008-06-15 18:37 . 2001-09-05 23:50 71,680 --a--c--- C:\WINDOWS\system32\dllcache\fnfilter.dll

2008-06-15 18:37 . 2001-09-05 23:27 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys

2008-06-15 18:37 . 2001-09-05 23:27 6,912 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys

2008-06-15 18:33 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys

2008-06-15 18:33 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

2008-06-15 18:33 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys

2008-06-15 18:33 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-13 13:05 --------- d-----w C:\Documents and Settings\Silvana Rita\Dados de aplicativos\LimeWire

2008-07-13 12:01 --------- d-----w C:\Arquivos de programas\iGv6

2008-07-13 06:57 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-06-29 16:44 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-06-29 16:43 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2008-06-16 23:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2008-06-14 17:59 272,384 ------w C:\WINDOWS\system32\drivers\bthport.sys

2008-06-08 21:17 --------- d-----w C:\Arquivos de programas\GameTop.com

2008-06-08 21:04 --------- d-----w C:\Arquivos de programas\FreeGamePick.com

2008-06-08 20:26 --------- d-----w C:\Documents and Settings\Silvana Rita\Dados de aplicativos\Leadertech

2008-06-08 20:06 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2008-06-08 20:04 --------- d-----w C:\Arquivos de programas\RPhoto

2008-06-07 00:03 203,264 ----a-w C:\WINDOWS\system32\Barbie as Island Princess 2.scr

2008-06-07 00:03 203,264 ----a-w C:\WINDOWS\system32\Barbie as Island Princess 1.scr

2008-05-23 01:11 --------- d-----w C:\Arquivos de programas\De Blob

2008-05-18 21:27 936 ----a-w C:\logMX500.dat

2008-05-18 21:25 --------- d-----w C:\Arquivos de programas\LG SyncAgent

2008-05-18 21:11 --------- d-----w C:\Arquivos de programas\LG Link

2008-05-07 05:15 1,292,288 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-23 07:14 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456]

"SysBrand"="C:\ARQUIV~1\iGv6\sysbrand.exe" [2004-12-08 19:23 36864]

"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-10-13 13:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"GrooveMonitor"="C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

"SoundMAXPnP"="C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 10:52 1368064]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]

"Adobe Photo Downloader"="C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 20:19 79224]

"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:45 159744]

"VTTimer"="VTTimer.exe" [2005-03-08 19:33 53248 C:\WINDOWS\system32\VTTimer.exe]

"VTTrayp"="VTtrayp.exe" [2005-03-12 09:33 147456 C:\WINDOWS\system32\VTTrayp.exe]

"PCTVOICE"="pctspk.exe" [2004-08-11 02:42 176128 C:\WINDOWS\system32\pctspk.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

"DWQueuedReporting"="C:\ARQUIV~1\ARQUIV~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 19:48 434528]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Gamma Loader.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-21 10:00:09 113664]

Verificador de Calend rio Ulead Photo Express.lnk - C:\Arquivos de programas\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2008-06-29 13:44:59 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"BM67e53e50"=Rundll32.exe "C:\WINDOWS\system32\itgmkemf.dll",s

"64d60dcc"=rundll32.exe "C:\WINDOWS\system32\qmxbmyld.dll",b

"LSA Shellu"=C:\Documents and Settings\Silvana Rita\lsass.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 20:20]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 20:16]

R2 NwSapAgent;Agente SAP;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:45]

S2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2004-08-11 02:42]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Arquivos de programas\Lavalys\EVEREST Corporate + Ultimate Edition\kerneld.wnt [2007-12-14 02:09]

S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 21:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14948c6a-27ff-11dd-8d4f-0015f27ee9ff}]

\Shell\Auto\command - G:\Start.exe

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

.

Conte£do da pasta 'Tarefas Agendadas'

"2008-07-13 15:08:58 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

.

- - - - ORPHANS REMOVED - - - -

BHO-{4ED6817D-6388-49C1-8029-455224BF3E02} - C:\WINDOWS\system32\tuvUlICt.dll

BHO-{628FC977-CF28-44CC-8EEF-BED91EFEDD57} - C:\WINDOWS\system32\ssqnmmJY.dll

HKLM-Run-Windows Logon Applicationedc - C:\Documents and Settings\Silvana Rita\winlogon.exe

HKLM-Run-PV92TRAY - PV92Tray.exe

Notify-jkkHWQgh - jkkHWQgh.dll

Notify-rqRHxvSI - rqRHxvSI.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-13 12:06:01

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\C:\Arquivos de programas\Lavalys\EVEREST Corporate + Ultimate Edition\kerneld.wnt"

.

------------------------ Other Running Processes ------------------------

.

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

.

**************************************************************************

.

Tempo para conclusÆo: 2008-07-13 12:13:51 - machine was rebooted

ComboFix-quarantined-files.txt 2008-07-13 15:12:46

Pre-Run: 16,756,142,080 bytes disponíveis

Post-Run: 16,728,735,744 bytes dispon¡veis

240 --- E O F --- 2008-07-13 11:50:55

Editado por Marcelotronic

Compartilhar este post


Link para o post
Compartilhar em outros sites
Dae galera se esse pc tiver muito bichado acho que o jeito era formatar mas o pc não é meu e fazer backup é um saco por favor analizem meus logs.

Logfile of HijackThis v1.99.1

Scan saved at 12:26:11, on 13/7/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\pctspk.exe

C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\ARQUIV~1\iGv6\sysbrand.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Silvana Rita\Desktop\HijackThis.exe

C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orkut.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://farejador.ig.com.br/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: (no name) - {7EEF1E3D-FD97-4401-BCDB-5827F2D11709} - (no file)

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [bM67e53e50] Rundll32.exe "C:\WINDOWS\system32\itgmkemf.dll",s

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [sysBrand] "C:\ARQUIV~1\iGv6\sysbrand.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [TheSpyBot] C:\Program Files\TheSpyBot\TheSpyBot.exe

O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra button: Barra do iG - {FD1672E0-AE0D-465B-B345-F7B0944A121D} - (no file)

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\ARQUIV~1\ARQUIV~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - Unknown owner - C:\WINDOWS\system32\pctspk.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

ComboFix 08-07-12.4 - Silvana Rita 2008-07-13 12:02:15.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.133 [GMT -3:00]

Executando de: C:\Documents and Settings\Silvana Rita\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Autorun.inf

C:\Documents and Settings\All Users\Menu Iniciar\Programas\SpyMaxx

C:\Documents and Settings\All Users\Menu Iniciar\Programas\SpyMaxx\SpyMaxx.lnk

C:\Documents and Settings\All Users\Menu Iniciar\Programas\SpyMaxx\Uninstall SpyMaxx.lnk

C:\ffojc.com

C:\WINDOWS\BM67e53e50.txt

C:\WINDOWS\cookies.ini

C:\WINDOWS\cpan.dll

C:\WINDOWS\ctfmon32.exe

C:\WINDOWS\ctrlpan.dll

C:\WINDOWS\directx32.exe

C:\WINDOWS\dnsrelay.dll

C:\WINDOWS\editpad.exe

C:\WINDOWS\explore.exe

C:\WINDOWS\explorer32.exe

C:\WINDOWS\funniest.exe

C:\WINDOWS\funny.exe

C:\WINDOWS\gfmnaaa.dll

C:\WINDOWS\helpcvs.exe

C:\WINDOWS\inetinf.exe

C:\WINDOWS\internet.exe

C:\WINDOWS\msconfd.dll

C:\WINDOWS\msspi.dll

C:\WINDOWS\mswsc10.dll

C:\WINDOWS\mswsc20.dll

C:\WINDOWS\qttasks.exe

C:\WINDOWS\quicken.exe

C:\WINDOWS\rundll16.exe

C:\WINDOWS\rundll32.vbe

C:\WINDOWS\searchword.dll

C:\WINDOWS\sistem.exe

C:\WINDOWS\svchost32.exe

C:\WINDOWS\svcinit.exe

C:\WINDOWS\system32\aicbutjn.ini

C:\WINDOWS\system32\amtolmdh.dll

C:\WINDOWS\system32\bskledfl.dll

C:\WINDOWS\system32\ckvo.exe

C:\WINDOWS\system32\ckvo0.dll

C:\WINDOWS\system32\cxuvugly.ini

C:\WINDOWS\system32\dcwmol.dll

C:\WINDOWS\system32\dlymbxmq.ini

C:\WINDOWS\system32\drdbhjkc.dll

C:\WINDOWS\system32\efcDTLBr.dll

C:\WINDOWS\system32\geBqPIcc.dll

C:\WINDOWS\system32\geBroMDW.dll

C:\WINDOWS\system32\gxledroc.ini

C:\WINDOWS\system32\hljwugsf.bin

C:\WINDOWS\system32\kavo.exe

C:\WINDOWS\system32\kridkgwp.ini

C:\WINDOWS\system32\kxevav.dll

C:\WINDOWS\system32\ljJBtsqr.dll

C:\WINDOWS\system32\lvjiem.dll

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\mringtwp.ini

C:\WINDOWS\system32\MSINET.oca

C:\WINDOWS\system32\nfqkbwdk.dll

C:\WINDOWS\system32\pac.txt

C:\WINDOWS\system32\pmnnKDwv.dll

C:\WINDOWS\system32\qeeycqfk.dll

C:\WINDOWS\system32\qmcbtphq.dll

C:\WINDOWS\system32\qmxbmyld.dll

C:\WINDOWS\system32\rycuje.dll

C:\WINDOWS\system32\sknjvy.dll

C:\WINDOWS\system32\tCIlUvut.ini

C:\WINDOWS\system32\tCIlUvut.ini2

C:\WINDOWS\system32\tovqwlvl.dll

C:\WINDOWS\system32\tudltmht.ini

C:\WINDOWS\system32\vpbcwy.dll

C:\WINDOWS\system32\wfrdscmc.ini

C:\WINDOWS\system32\xbifijnn.dll

C:\WINDOWS\system32\xbwhurlc.ini

C:\WINDOWS\system32\xxyxYppq.dll

C:\WINDOWS\system32\xxyyxwtU.dll

C:\WINDOWS\system32\ybinpned.dll

C:\WINDOWS\system32\YJmmnqss.ini

C:\WINDOWS\system32\YJmmnqss.ini2

C:\WINDOWS\system32\zoimpd.dll

C:\WINDOWS\time.exe

E:\Autorun.inf

.

((((((((((((((((((((((( Ficheiros criados de 2008-06-13 to 2008-07-13 ))))))))))))))))))))))))))))))))

.

2008-07-13 09:50 . 2008-07-13 09:51 251 --a------ C:\WINDOWS\wininit.ini

2008-07-12 16:29 . 2008-07-12 16:29 197 --a------ C:\WINDOWS\system32\MRT.INI

2008-07-10 18:41 . 2008-07-12 14:51 133,983 -r-hs---- C:\k6wkwon2.exe

2008-07-09 19:42 . 2008-07-12 14:51 77,312 -r-hs---- C:\WINDOWS\system32\ckvo1.dll

2008-07-08 18:07 . 2008-07-09 19:12 132,745 -r-hs---- C:\n6j6pc0.com

2008-07-07 20:01 . 2008-07-13 09:51 110,415 --a------ C:\WINDOWS\BM67e53e50.xml

2008-07-06 14:40 . 2008-07-13 04:00 <DIR> d-------- C:\Program Files

2008-07-06 10:55 . 2008-07-13 10:43 <DIR> d-------- C:\WINDOWS\system32\olixds18

2008-07-02 21:11 . 2008-07-12 21:28 <DIR> d-------- C:\WINDOWS\system32\vi

2008-07-02 21:11 . 2008-07-12 21:27 <DIR> d-------- C:\WINDOWS\system32\modtrux18

2008-07-02 21:11 . 2008-07-12 21:27 <DIR> d-------- C:\WINDOWS\system32\gI5

2008-07-02 20:43 . 2008-07-13 11:47 <DIR> d-------- C:\Arquivos de programas\FBrowsingAdvisor

2008-07-02 20:43 . 2008-07-02 20:43 <DIR> d-------- C:\Arquivos de programas\FBrowserAdvisor

2008-07-02 20:43 . 2008-07-05 14:46 <DIR> d-------- C:\Arquivos de programas\AdvancedAdvisor

2008-06-29 19:03 . 2008-06-29 19:03 <DIR> d-------- C:\Documents and Settings\Silvana Rita\Dados de aplicativos\Ulead Systems

2008-06-29 19:03 . 2008-06-29 19:03 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Ulead Systems

2008-06-29 13:58 . 2008-07-06 12:59 <DIR> d-------- C:\Arquivos de programas\Deadhunt Demo

2008-06-29 13:44 . 2008-06-29 13:44 <DIR> d-------- C:\Arquivos de programas\Ulead Systems

2008-06-29 13:41 . 2008-06-29 13:41 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\snpstd

2008-06-29 13:40 . 2008-06-29 13:40 <DIR> d-------- C:\Arquivos de programas\CamView

2008-06-26 21:38 . 2008-06-26 21:38 <DIR> d-------- C:\WINDOWS\system32\Adobe

2008-06-22 16:24 . 2008-06-22 16:24 <DIR> d-------- C:\Arquivos de programas\Photo!

2008-06-22 16:19 . 2008-06-22 16:19 <DIR> d-------- C:\Games

2008-06-22 15:42 . 2008-07-02 21:09 <DIR> d-------- C:\Arquivos de programas\Champions World Class Soccer

2008-06-22 15:29 . 2008-06-25 20:10 <DIR> d-------- C:\Arquivos de programas\Web Photo Album

2008-06-22 15:29 . 2008-06-22 16:33 <DIR> d-------- C:\Arquivos de programas\Cartoonist

2008-06-15 18:37 . 2001-09-05 23:50 99,328 --a------ C:\WINDOWS\system32\srusd.dll

2008-06-15 18:37 . 2001-09-05 23:50 99,328 --a--c--- C:\WINDOWS\system32\dllcache\srusd.dll

2008-06-15 18:37 . 2001-09-05 23:50 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll

2008-06-15 18:37 . 2001-09-05 23:50 71,680 --a--c--- C:\WINDOWS\system32\dllcache\fnfilter.dll

2008-06-15 18:37 . 2001-09-05 23:27 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys

2008-06-15 18:37 . 2001-09-05 23:27 6,912 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys

2008-06-15 18:33 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys

2008-06-15 18:33 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

2008-06-15 18:33 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys

2008-06-15 18:33 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-13 13:05 --------- d-----w C:\Documents and Settings\Silvana Rita\Dados de aplicativos\LimeWire

2008-07-13 12:01 --------- d-----w C:\Arquivos de programas\iGv6

2008-07-13 06:57 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy

2008-06-29 16:44 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-06-29 16:43 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2008-06-16 23:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help

2008-06-14 17:59 272,384 ------w C:\WINDOWS\system32\drivers\bthport.sys

2008-06-08 21:17 --------- d-----w C:\Arquivos de programas\GameTop.com

2008-06-08 21:04 --------- d-----w C:\Arquivos de programas\FreeGamePick.com

2008-06-08 20:26 --------- d-----w C:\Documents and Settings\Silvana Rita\Dados de aplicativos\Leadertech

2008-06-08 20:06 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2008-06-08 20:04 --------- d-----w C:\Arquivos de programas\RPhoto

2008-06-07 00:03 203,264 ----a-w C:\WINDOWS\system32\Barbie as Island Princess 2.scr

2008-06-07 00:03 203,264 ----a-w C:\WINDOWS\system32\Barbie as Island Princess 1.scr

2008-05-23 01:11 --------- d-----w C:\Arquivos de programas\De Blob

2008-05-18 21:27 936 ----a-w C:\logMX500.dat

2008-05-18 21:25 --------- d-----w C:\Arquivos de programas\LG SyncAgent

2008-05-18 21:11 --------- d-----w C:\Arquivos de programas\LG Link

2008-05-07 05:15 1,292,288 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-23 07:14 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456]

"SysBrand"="C:\ARQUIV~1\iGv6\sysbrand.exe" [2004-12-08 19:23 36864]

"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-10-13 13:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"GrooveMonitor"="C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

"SoundMAXPnP"="C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 10:52 1368064]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]

"Adobe Photo Downloader"="C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 20:19 79224]

"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 00:45 159744]

"VTTimer"="VTTimer.exe" [2005-03-08 19:33 53248 C:\WINDOWS\system32\VTTimer.exe]

"VTTrayp"="VTtrayp.exe" [2005-03-12 09:33 147456 C:\WINDOWS\system32\VTTrayp.exe]

"PCTVOICE"="pctspk.exe" [2004-08-11 02:42 176128 C:\WINDOWS\system32\pctspk.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

"DWQueuedReporting"="C:\ARQUIV~1\ARQUIV~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 19:48 434528]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Gamma Loader.lnk - C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-21 10:00:09 113664]

Verificador de Calend rio Ulead Photo Express.lnk - C:\Arquivos de programas\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2008-06-29 13:44:59 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"BM67e53e50"=Rundll32.exe "C:\WINDOWS\system32\itgmkemf.dll",s

"64d60dcc"=rundll32.exe "C:\WINDOWS\system32\qmxbmyld.dll",b

"LSA Shellu"=C:\Documents and Settings\Silvana Rita\lsass.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 20:20]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 20:16]

R2 NwSapAgent;Agente SAP;C:\WINDOWS\system32\svchost.exe [2004-08-04 00:45]

S2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2004-08-11 02:42]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Arquivos de programas\Lavalys\EVEREST Corporate + Ultimate Edition\kerneld.wnt [2007-12-14 02:09]

S3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys [2001-08-17 21:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14948c6a-27ff-11dd-8d4f-0015f27ee9ff}]

\Shell\Auto\command - G:\Start.exe

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

.

Conte£do da pasta 'Tarefas Agendadas'

"2008-07-13 15:08:58 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Arquivos de programas\Windows Defender\MpCmdRun.exe

.

- - - - ORPHANS REMOVED - - - -

BHO-{4ED6817D-6388-49C1-8029-455224BF3E02} - C:\WINDOWS\system32\tuvUlICt.dll

BHO-{628FC977-CF28-44CC-8EEF-BED91EFEDD57} - C:\WINDOWS\system32\ssqnmmJY.dll

HKLM-Run-Windows Logon Applicationedc - C:\Documents and Settings\Silvana Rita\winlogon.exe

HKLM-Run-PV92TRAY - PV92Tray.exe

Notify-jkkHWQgh - jkkHWQgh.dll

Notify-rqRHxvSI - rqRHxvSI.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-13 12:06:01

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\C:\Arquivos de programas\Lavalys\EVEREST Corporate + Ultimate Edition\kerneld.wnt"

.

------------------------ Other Running Processes ------------------------

.

C:\Arquivos de programas\Windows Defender\MsMpEng.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

.

**************************************************************************

.

Tempo para conclusÆo: 2008-07-13 12:13:51 - machine was rebooted

ComboFix-quarantined-files.txt 2008-07-13 15:12:46

Pre-Run: 16,756,142,080 bytes disponíveis

Post-Run: 16,728,735,744 bytes dispon¡veis

240 --- E O F --- 2008-07-13 11:50:55

Po galera ajuda ae.

Compartilhar este post


Link para o post
Compartilhar em outros sites
Visitante
Este tópico está impedido de receber novos posts.





Sobre o Clube do Hardware

No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

Direitos autorais

Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

×