ComboFix 08-06-05.3 - Ana Helena 2008-06-06 1:23:03.2 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.124 [GMT -3:00] Executando de: C:\Documents and Settings\Ana Helena\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((( Outras Excluses ))))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\WINDOWS\hosts C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\gmsywcjqd.dat C:\WINDOWS\system32\gmsywcjqd_nav.dat C:\WINDOWS\system32\gmsywcjqd_navps.dat C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\pthreadVC.dll C:\WINDOWS\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF -------\Service_NPF ((((((((((((((((((((((( Ficheiros criados de 2008-05-06 to 2008-06-06 )))))))))))))))))))))))))))))))) . 2008-06-06 00:20 . 2008-06-06 00:20 d-------- C:\VundoFix Backups 2008-06-06 00:10 . 2008-06-06 00:14 1,904 --a------ C:\WINDOWS\system32\tmp.reg 2008-06-06 00:09 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-06-06 00:09 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-06-06 00:09 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-06-06 00:09 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-06-06 00:09 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-06-06 00:09 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-06-06 00:09 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-06-06 00:09 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-06-05 20:15 . 2008-06-04 22:14 316,700 -ra------ C:\WINDOWS\hosts.20080605-201516.backup 2008-06-05 01:44 . 2008-06-05 07:13 d-------- C:\MSNCleaner 2008-06-05 00:35 . 2008-06-05 07:13 d-------- C:\Arquivos de programas\a-squared Free 2008-06-04 23:35 . 2008-06-05 07:13 d-------- C:\LinhaDefensiva 2008-06-04 23:09 . 2008-06-05 07:13 d-------- C:\SDFix 2008-06-01 20:54 . 2008-06-01 20:54 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avg7 2008-06-01 19:17 . 2008-06-01 19:17 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avira 2008-06-01 19:17 . 2008-06-01 19:17 d-------- C:\Arquivos de programas\Avira 2008-05-21 15:33 . 2008-06-04 23:13 d-------- C:\Arquivos de programas\CNPJ2008 2008-05-21 15:33 . 2008-05-21 15:33 39 --a------ C:\WINDOWS\cnpj010.INI 2008-05-18 17:29 . 2008-05-18 17:30 d-------- C:\Arquivos de programas\Interbank FX Trader 4 2008-05-17 19:36 . 2008-05-17 19:36 d-------- C:\Documents and Settings\Ana Helena\advfn 2008-05-06 12:11 . 2008-05-06 12:11 d-------- C:\Documents and Settings\Ana Helena\Dados de aplicativos\LocalLow 2008-05-06 12:06 . 2008-05-06 12:06 d-------- C:\Arquivos de programas\Softrun . ((((((((((((((((((((((((((((((((((((( Relatrio Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-06 04:32 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Lightcomm 2008-06-06 04:31 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Orbit 2008-06-06 03:42 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy 2008-06-05 21:50 --------- d-----w C:\Arquivos de programas\Google 2008-06-05 20:42 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Skype 2008-06-05 15:10 --------- d-----w C:\Arquivos de programas\SpeedFan 2008-06-05 02:13 --------- d-----w C:\Arquivos de programas\Orbitdownloader 2008-06-04 20:49 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\skypePM 2008-05-06 17:21 --------- d-----w C:\Arquivos de programas\Oi Internet 2008-05-06 17:16 --------- d-----w C:\Arquivos de programas\eMule 2008-05-05 22:40 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Auslogics 2008-05-05 14:53 --------- d-----w C:\Arquivos de programas\Auto-Escola 2008-05-05 14:52 --------- d-----w C:\Arquivos de programas\PC Tools Firewall Plus 2008-05-04 21:09 --------- dcsh--w C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller 2008-05-04 21:09 --------- d-----w C:\Arquivos de programas\Optimik 2008-05-04 21:09 --------- d-----w C:\Arquivos de programas\Ahead 2008-04-28 00:17 --------- d-----w C:\Arquivos de programas\GCI Demo 2008-04-26 02:31 7,727,880 ----a-w C:\Arquivos de programas\GoogleEarthWin.exe 2008-04-20 23:13 --------- d-----w C:\Arquivos de programas\VIG 2008-04-20 20:46 --------- d-----w C:\Arquivos de programas\LG mobile 2008-04-20 20:45 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information 2008-04-20 20:45 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield 2008-04-20 18:15 --------- d-----w C:\Arquivos de programas\Spyware Doctor 2008-04-20 18:14 --------- d-----w C:\Arquivos de programas\Norton Security Scan 2008-04-20 18:14 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Symantec Shared 2008-04-20 18:13 --------- d---a-w C:\Documents and Settings\All Users\Dados de aplicativos\TEMP 2008-03-16 19:31 32 ----a-w C:\Documents and Settings\All Users\Dados de aplicativos\ezsid.dat 2008-03-08 01:47 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2007-05-23 21:35 609,648 ----a-w C:\Arquivos de programas\Install.exe 2006-02-20 12:08 5,120 ----a-w C:\Arquivos de programas\tclpipe.exe 2006-02-20 12:08 26,624 ----a-w C:\Arquivos de programas\tclsh.exe 1999-06-01 03:00 74,752 ----a-w C:\Arquivos de programas\ST6UNST.EXE 2004-08-04 03:45 73,728 --sha-w C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe 2007-10-15 19:30 56 --sh--r C:\WINDOWS\system32\2D21F2C887.sys 2007-10-15 19:30 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Nota* entradas vazias & legtimas por defeito no so mostradas. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Conexo Oi Velox"="C:\Arquivos de programas\Oi Velox\Conexo\pppoe.exe" [ ] "SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2004-05-12 01:03 1038336] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360] "msnmsgr"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "desp2k"="C:\Arquivos de programas\Oi Velox\Manager\desp2k.exe" [2006-08-03 15:05 65536] "QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2008-02-11 23:46 385024] C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\ Orbit.lnk - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe [2007-11-05 00:31:14 1678536] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Orbit.lnk] backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Orbit.lnk [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Photags AutoDetect.lnk.disabled] backup=C:\WINDOWS\pss\Photags AutoDetect.lnk.disabledCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ana Helena^Menu Iniciar^Programas^Inicializar^Pserver.lnk] backup=C:\WINDOWS\pss\Pserver.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt] --a------ 2008-02-12 10:06 262401 C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2007-10-18 11:34 5724184 C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RAM Idle Professional] --a------ 2006-01-17 04:38 135168 C:\Arquivos de programas\RAM Idle LE\RAM_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] --a------ 2004-05-12 01:03 1038336 C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Skype"="C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized "msnmsgr"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "SMSERIAL"=sm56hlpr.exe "SoundMan"=SOUNDMAN.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Arquivos de programas\\eMule\\emule.exe"= "C:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"= "C:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"= "C:\\Audaces Vestuario\\Suporte\\Suporte.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"= "C:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"= R2 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2000-05-12 14:48] R2 cmpe;Context Manager Process Extension;C:\WINDOWS\system32\cmpe.exe [2007-02-26 10:11] R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-06-09 23:09] S3 RISKEMA;Riskema;C:\WINDOWS\system32\Drivers\Audaproc.sys [2006-11-21 15:30] . Contedo da pasta 'Tarefas Agendadas' "2008-04-25 18:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Arquivos de programas\Norton Security Scan\Nss.exe "2008-06-05 01:26:48 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job" - C:\Arquivos de programas\Spybot - Search & Destroy\SpybotSD.exe "2008-04-28 21:00:35 C:\WINDOWS\Tasks\User_Feed_Synchronization-{5A597035-58CF-4897-841A-85E82D4E62DA}.job" - C:\WINDOWS\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-06 01:28:52 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializveis ocultas ... Procurando ficheiros ocultos ... C:\SYZ_DAT C:\WINDOWS\system32\drivers\MFX.sys 49580 bytes executable Varredura completada com sucesso Ficheiros ocultos: 2 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\wdfmgr.exe C:\Arquivos de programas\Orbitdownloader\orbitnet.exe . ************************************************************************** . Tempo para concluso: 2008-06-06 1:38:46 - machine was rebooted [Ana Helena] ComboFix-quarantined-files.txt 2008-06-06 04:38:35 Pre-Run: 34,920,718,336 bytes disponveis Post-Run: 34,910,044,160 bytes disponveis 178 --- E O F --- 2008-05-20 05:56:23