Ir ao conteúdo
  • Cadastre-se
Entre para seguir isso  
dimmuandre

log RSITE

Recommended Posts

pc aparentemente infectado

Logfile of random's system information tool 1.04 (written by random/random)

Run by Administrador at 2008-11-08 15:18:20

Microsoft Windows XP Professional Service Pack 3

System drive D: has 18 GB (73%) free of 25 GB

Total RAM: 383 MB (35% free)

HijackThis download failed

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]

Yahoo! Toolbar Helper - D:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

Click-to-Call BHO - D:\Arquivos de programas\Windows Live\Messenger\wlchtc.dll [2008-09-02 75272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]

Search Helper - D:\Arquivos de programas\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2008-08-21 94736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - D:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live Sign-in Helper - D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2008-02-22 401968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

Windows Live Toolbar Beta - D:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll [2008-09-02 953360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Barra de Ferramentas do Yahoo! com bloqueador de pop-up - D:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

{07B18EA9-A523-4961-B6BB-170DE4475CCA}

{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar Beta - D:\Arquivos de programas\Windows Live\Toolbar\wltcore.dll [2008-09-02 953360]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"nod32kui"=D:\Arquivos de programas\Eset\nod32kui.exe [2008-08-31 949376]

"NvCplDaemon"=D:\WINDOWS\system32\NvCpl.dll [2006-08-16 7630848]

"nwiz"=nwiz.exe /install []

"NvMediaCenter"=D:\WINDOWS\system32\NvMcTray.dll [2006-08-16 86016]

"RTHDCPL"=D:\WINDOWS\RTHDCPL.EXE [2006-09-06 16262656]

"Alcmtr"=D:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

"MSConfig"=D:\WINDOWS\system32\msconfig.exe [2008-04-14 171520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

D:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexStoreSvr.exe [2008-06-24 1840424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]

D:\ARQUIV~1\MYWEBS~1\bar\5.bin\mwsoemon.exe [2008-10-14 32838]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]

D:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-06-08 2221352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

D:\Arquivos de programas\Arquivos comuns\Nero\Lib\NeroCheck.exe [2008-06-19 570664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NitroPC]

D:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\RarSFX0\NitroPC.exe [2008-08-19 3477504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

D:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

D:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"DisableStatusMessages"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

"NoSMHelp"=1

"ForceClassicControlPanel"=1

"NoResolveTrack"=1

"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HideRunAsVerb"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"D:\Arquivos de programas\ADPHONE3\ADPHONE.exe"="D:\Arquivos de programas\ADPHONE3\ADPHONE.exe:*:Enabled:ADPHONE"

"D:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe"="D:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe"="D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"D:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe"="D:\Arquivos de programas\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe"="D:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2008-11-08 15:18:21 ----D---- D:\Arquivos de programas\trend micro

2008-11-08 15:18:20 ----D---- D:\rsit

2008-11-08 15:08:43 ----A---- D:\WINDOWS\gmer.ini

2008-11-08 15:08:42 ----A---- D:\WINDOWS\gmer_uninstall.cmd

2008-11-08 15:08:42 ----A---- D:\WINDOWS\gmer.exe

2008-11-08 15:08:42 ----A---- D:\WINDOWS\gmer.dll

2008-11-08 14:36:15 ----D---- D:\WINDOWS\pss

2008-11-08 14:33:46 ----D---- D:\WINDOWS\system32\SoftwareDistribution

2008-11-08 14:33:43 ----D---- D:\WINDOWS\LastGood

2008-10-24 18:11:52 ----D---- D:\WINDOWS\system32\appmgmt

2008-10-22 10:14:36 ----D---- D:\Documents and Settings\All Users\Dados de aplicativos\NOS

2008-10-22 10:14:36 ----D---- D:\Arquivos de programas\NOS

2008-10-14 19:30:27 ----D---- D:\Arquivos de programas\Atrativa Games

2008-10-12 12:22:21 ----A---- D:\WINDOWS\NeroDigital.ini

2008-10-10 21:16:19 ----DC---- D:\WINDOWS\system32\DRVSTORE

2008-10-10 21:13:05 ----RSD---- D:\WINDOWS\assembly

2008-10-10 21:11:59 ----D---- D:\WINDOWS\Microsoft.NET

2008-10-10 21:11:21 ----A---- D:\WINDOWS\system32\d3dx9_32.dll

2008-10-10 21:10:24 ----D---- D:\Arquivos de programas\Microsoft SQL Server Compact Edition

2008-10-10 21:08:31 ----D---- D:\Arquivos de programas\Microsoft

2008-10-10 20:25:15 ----D---- D:\Arquivos de programas\Arquivos comuns\Windows Live

======List of files/folders modified in the last 1 months======

2008-11-08 15:18:21 ----RD---- D:\Arquivos de programas

2008-11-08 15:11:01 ----D---- D:\WINDOWS\Prefetch

2008-11-08 15:08:43 ----D---- D:\WINDOWS

2008-11-08 15:08:42 ----D---- D:\WINDOWS\system32\drivers

2008-11-08 15:06:07 ----D---- D:\WINDOWS\Temp

2008-11-08 14:45:13 ----A---- D:\WINDOWS\win.ini

2008-11-08 14:45:13 ----A---- D:\WINDOWS\system.ini

2008-11-08 14:37:14 ----D---- D:\Arquivos de programas\Mozilla Firefox

2008-11-08 14:33:52 ----RSHDC---- D:\WINDOWS\system32\dllcache

2008-11-08 14:33:49 ----D---- D:\WINDOWS\system32

2008-11-08 14:33:49 ----D---- D:\WINDOWS\SoftwareDistribution

2008-11-08 14:33:49 ----D---- D:\WINDOWS\Help

2008-11-08 14:33:47 ----D---- D:\WINDOWS\inf

2008-11-08 14:30:57 ----SD---- D:\WINDOWS\Downloaded Program Files

2008-11-08 11:24:53 ----D---- D:\WINDOWS\system32\CatRoot2

2008-11-08 00:21:08 ----N---- D:\WINDOWS\SchedLgU.Txt

2008-10-30 11:05:10 ----D---- D:\WINDOWS\Network Diagnostic

2008-10-24 18:28:06 ----D---- D:\Documents and Settings\Administrador\Dados de aplicativos\Mozilla

2008-10-24 18:13:40 ----D---- D:\WINDOWS\Debug

2008-10-24 18:11:52 ----SHD---- D:\WINDOWS\Installer

2008-10-24 18:11:43 ----D---- D:\Documents and Settings\Administrador\Dados de aplicativos\ADPHONE

2008-10-19 07:55:15 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI

2008-10-14 10:23:09 ----D---- D:\Arquivos de programas\Internet Explorer

2008-10-14 10:11:10 ----SD---- D:\Documents and Settings\Administrador\Dados de aplicativos\Microsoft

2008-10-10 21:16:17 ----D---- D:\Arquivos de programas\Windows Live

2008-10-10 21:13:06 ----D---- D:\WINDOWS\WinSxS

2008-10-10 21:11:24 ----D---- D:\WINDOWS\system32\DirectX

2008-10-10 21:09:57 ----SD---- D:\Documents and Settings\All Users\Dados de aplicativos\Microsoft

2008-10-10 21:08:20 ----D---- D:\Arquivos de programas\Arquivos comuns\Microsoft Shared

2008-10-10 21:07:49 ----RSD---- D:\WINDOWS\Fonts

2008-10-10 20:25:15 ----D---- D:\Arquivos de programas\Arquivos comuns

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Processor Driver; D:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]

R1 nod32drv;nod32drv; D:\WINDOWS\system32\drivers\nod32drv.sys [2008-08-31 15424]

R1 WS2IFSL;Ambiente de suporte a provedores de serviços não-IFS do Windows Socket 2.0; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

R2 AMON;AMON; D:\WINDOWS\system32\drivers\amon.sys [2008-08-31 512096]

R2 fssfltr;FssFltr; D:\WINDOWS\system32\DRIVERS\fssfltr.sys [2008-09-04 56344]

R3 HDAudBus;Driver de Barramento Microsoft UAA para High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]

R3 hidusb;Driver de classe HID da Microsoft; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-09-06 4377600]

R3 mouhid;Mouse HID Driver; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-05-05 12288]

R3 nv;nv; D:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-08-16 3959712]

R3 nvnetbus;NVIDIA Network Bus Enumerator; D:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-07-11 20480]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]

R3 usbhub;USB2 Enabled Hub; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]

R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; D:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]

S3 gmer;gmer; D:\WINDOWS\System32\DRIVERS\gmer.sys [2008-11-08 85969]

S3 GMSIPCI;GMSIPCI; \??\G:\INSTALL\GMSIPCI.SYS []

S3 NTACCESS;NTACCESS; \??\G:\NTACCESS.sys []

S3 NVENETFD;NVIDIA nForce Networking Controller Driver; D:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-07-11 57856]

S3 SetupNTGLM7X;SetupNTGLM7X; \??\G:\NTGLM7X.sys []

S3 usbccgp;Microsoft USB Generic Parent Driver; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

S3 usbscan;USB Scanner Driver; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

S3 USBSTOR;USB Mass Storage Driver; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; D:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe [2008-06-08 877864]

R2 NOD32krn;NOD32 Kernel Service; D:\Arquivos de programas\Eset\nod32krn.exe [2008-08-31 552064]

R2 NVSvc;NVIDIA Display Driver Service; D:\WINDOWS\system32\nvsvc32.exe [2006-08-16 155715]

R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; D:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]

R2 UMWdf;Windows User Mode Driver Framework; D:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]

R3 NMIndexingService;NMIndexingService; D:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe [2008-06-24 537896]

S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]

S3 fsssvc;Windows Live Family Safety; D:\Arquivos de programas\Windows Live\Family Safety\fsssvc.exe [2008-09-04 512536]

S3 getPlus® Helper;getPlus® Helper; D:\Arquivos de programas\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]

S3 ose;Office Source Engine; D:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

Compartilhar este post


Link para o post
Compartilhar em outros sites

De acordo com as regras deste fórum, tópicos inativos são arquivados, isto é, fechados e movidos para um fórum de "tópicos arquivados". Caso o autor do tópico necessite poderá entrar em contato com a moderação solicitando a reabertura deste tópico.

Compartilhar este post


Link para o post
Compartilhar em outros sites
Visitante
Este tópico está impedido de receber novos posts.
Entre para seguir isso  





Sobre o Clube do Hardware

No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

Direitos autorais

Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

×