ComboFix 08-10-19.04 - Marco 2008-10-21 1:21:14.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.710 [GMT -3:00] Executando de: C:\Documents and Settings\Marco\Desktop\ComboFix.exe Comandos utilizados :: C:\Documents and Settings\Marco\Desktop\CFScript.txt * Criado um novo ponto de restauro FILE :: C:\.security C:\WINDOWS\.security C:\WINDOWS\[u]0[/u]01.scr C:\WINDOWS\gscr.dll C:\WINDOWS\system32\cbXqQKed.dll C:\WINDOWS\system32\cbXrSKAQ.dll C:\WINDOWS\system32\drivers\pcantispy.sys C:\WINDOWS\system32\gfwdezwz.exe C:\WINDOWS\system32\iifEvwvs.dll C:\WINDOWS\system32\mfojijqt.exe C:\WINDOWS\system32\qfuhejyd.exe C:\WINDOWS\system32\sfcbshsn.exe C:\WINDOWS\system32\xxywWQjG.dll C:\Documents and Settings\Marco\Menu Iniciar\Programas\Inicializar\ :#: . ((((((((((((((((((((((((((((((((((((( Outras Excluses ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\.security C:\Documents and Settings\All Users\Dados de aplicativos\ebubevsp C:\Documents and Settings\All Users\Dados de aplicativos\ebubevsp\ifizwfgb.exe C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy\config.xml C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy\logs\1224530722.log C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy\Sites.bl C:\WINDOWS\.security C:\WINDOWS\[u]0[/u]01.scr C:\WINDOWS\gscr.dll C:\WINDOWS\system32\gfwdezwz.exe C:\WINDOWS\system32\mfojijqt.exe C:\WINDOWS\system32\qfuhejyd.exe C:\WINDOWS\system32\sfcbshsn.exe C:\WINDOWS\privacy_danger . . . . falha na excluso . ((((((((((((((((((((((((((((((((((((((( Drivers/Servios ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_PCANTISPY (((((((((((((((( Arquivos/Ficheiros criados de 2008-09-21 to 2008-10-21 )))))))))))))))))))))))))))) . 2008-12-12 11:25 . 2008-12-12 11:25 554 --a------ C:\WINDOWS\eReg.dat 2008-12-12 11:19 . 2008-12-12 11:22 d-------- C:\Arquivos de programas\EA GAMES 2008-12-12 11:18 . 2008-12-12 11:18 d-------- C:\Arquivos de programas\DAEMON Tools Lite 2008-12-12 11:16 . 2008-12-12 11:16 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-12-12 11:15 . 2008-12-12 11:15 d-------- C:\Documents and Settings\Marco\Dados de aplicativos\DAEMON Tools 2008-12-12 11:06 . 2008-10-10 22:24 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\NFS Underground 2008-12-12 11:05 . 2008-12-12 11:05 d-------- C:\Arquivos de programas\Arquivos comuns\DirectX 2008-10-20 20:50 . 2008-10-20 20:50 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-10-20 20:41 . 2008-10-20 20:42 d-------- C:\Documents and Settings\Administrador 2008-10-20 16:13 . 2008-10-20 16:13 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Yahoo! Companion 2008-10-20 13:52 . 2008-10-20 13:52 d-------- C:\WINDOWS\system32\xircom 2008-10-20 13:52 . 2008-10-20 13:52 d-------- C:\Arquivos de programas\microsoft frontpage 2008-10-20 13:24 . 2008-10-20 13:24 d-------- C:\Arquivos de programas\Yahoo! 2008-10-20 13:23 . 2008-10-20 13:24 d-------- C:\Arquivos de programas\CCleaner 2008-10-20 00:35 . 2008-10-20 22:20 d--h----- C:\$AVG8.VAULT$ 2008-10-20 00:30 . 2008-10-20 08:40 d-------- C:\WINDOWS\system32\drivers\Avg 2008-10-20 00:30 . 2008-10-20 00:30 d-------- C:\Arquivos de programas\AVG 2008-10-20 00:30 . 2008-10-20 00:30 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-10-20 00:30 . 2008-10-20 00:30 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-10-20 00:30 . 2008-10-20 00:30 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-10-19 23:55 . 2008-10-20 01:39 d-a------ C:\Documents and Settings\All Users\Dados de aplicativos\TEMP 2008-10-19 23:55 . 2008-10-19 23:55 d-------- C:\Arquivos de programas\NitroPC 2008-10-19 23:24 . 2008-10-19 23:24 d-------- C:\Arquivos de programas\Panda Security 2008-10-18 23:17 . 2008-10-20 00:30 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avg8 2008-10-18 12:59 . 2008-10-18 12:59 d-------- C:\WINDOWS\privacy_danger 2008-10-17 14:24 . 2008-10-17 14:24 d-------- C:\Arquivos de programas\VSO 2008-10-17 14:24 . 2004-05-04 11:53 1,645,320 --a------ C:\WINDOWS\gdiplus.dll 2008-10-17 14:24 . 2006-05-20 16:16 1,184,984 --a------ C:\WINDOWS\system32\wvc1dmod.dll 2008-10-17 14:24 . 2006-05-11 19:21 626,688 --a------ C:\WINDOWS\system32\vp7vfw.dll 2008-10-17 14:24 . 2006-09-29 12:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll 2008-10-17 14:24 . 2006-09-29 12:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll 2008-10-17 14:24 . 2006-09-29 12:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll 2008-10-17 14:24 . 2007-03-18 20:37 65,602 --a------ C:\WINDOWS\system32\cook3260.dll 2008-10-17 14:24 . 2008-10-17 14:24 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2008-10-17 08:47 . 2004-08-04 00:45 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-10-17 08:47 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-10-17 08:47 . 2001-09-05 23:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-10-16 18:56 . 2008-10-16 18:56 d-------- C:\Program Files 2008-10-16 18:56 . 2008-10-16 18:56 d-------- C:\Arquivos de programas\Arquivos comuns\xing shared 2008-10-15 12:25 . 2008-09-15 12:40 1,846,144 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 12:24 . 2008-08-14 10:45 2,184,576 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-15 12:24 . 2008-08-14 10:45 2,140,160 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-15 12:24 . 2008-08-14 10:45 2,061,952 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-15 12:24 . 2008-08-14 10:45 2,019,840 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-15 12:22 . 2008-08-28 07:04 333,056 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-14 10:39 . 2008-10-14 10:39 dr-h----- C:\MSOCache 2008-10-14 09:18 . 2008-10-16 03:48 d-------- C:\WINDOWS\SHELLNEW 2008-10-14 09:17 . 2008-10-14 10:45 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help 2008-10-12 23:23 . 2008-10-12 23:23 d-------- C:\Arquivos de programas\Arquivos comuns\Adobe 2008-10-09 16:35 . 2008-10-09 16:35 d-------- C:\World of Warcraft 2008-10-09 11:58 . 2008-10-20 03:28 49 --a------ C:\WINDOWS\NeroDigital.ini 2008-10-09 11:57 . 2008-10-18 06:57 d-------- C:\Arquivos de programas\TVSuper3 2008-10-09 11:57 . 2002-12-20 12:02 1,077,336 --a------ C:\WINDOWS\system32\Mscomctl.ocx 2008-10-09 11:57 . 2000-12-06 00:00 209,608 --a------ C:\WINDOWS\system32\Tabctl32.ocx 2008-10-09 11:57 . 2000-05-22 00:00 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-10-09 11:55 . 2008-10-09 11:55 d-------- C:\Documents and Settings\Marco\Dados de aplicativos\ppStream 2008-10-09 11:55 . 2008-10-09 11:56 d-------- C:\Arquivos de programas\SuperTV 2008-10-09 11:55 . 2008-10-09 11:56 129 --a------ C:\WINDOWS\psnetwork.ini 2008-10-09 11:55 . 2008-10-09 11:56 95 --a------ C:\Iotmrd.sys 2008-10-09 11:47 . 2008-10-09 11:47 d-------- C:\Arquivos de programas\GameVicio 2008-10-09 11:46 . 2008-10-09 11:46 295 --a------ C:\WINDOWS\game.ini 2008-10-09 11:41 . 2008-10-09 11:41 d-------- C:\Arquivos de programas\Activision 2008-10-08 22:26 . 2008-10-08 22:26 268 --ah----- C:\sqmdata00.sqm 2008-10-08 22:26 . 2008-10-08 22:26 244 --ah----- C:\sqmnoopt00.sqm 2008-10-08 19:00 . 2008-10-08 19:00 d-------- C:\WINDOWS\Cache 2008-10-08 18:40 . 2008-10-10 16:34 d-------- C:\UT2004 2008-10-08 18:09 . 2008-10-08 18:09 d--hs---- C:\WINDOWS\ftpcache 2008-10-08 15:22 . 2008-04-11 15:51 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-10-08 15:22 . 2008-05-01 11:32 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll . ((((((((((((((((((((((((((((((((((((( Relatrio Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-12 14:19 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield 2008-10-16 21:56 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Real 2008-10-10 19:31 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-10-09 14:38 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information 2008-10-09 01:01 --------- d-----w C:\Arquivos de programas\MSN Messenger 2008-10-08 21:54 --------- d-----w C:\Arquivos de programas\Discador Digerati 2008-10-08 21:10 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-09-15 15:40 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-20 05:37 661,504 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:45 2,184,576 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:45 2,061,952 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legtimas por defeito no so mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-10-20 1234712] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^.security] path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\.security backup=C:\WINDOWS\pss\.securityCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^MyVitalAgent.lnk] path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\MyVitalAgent.lnk backup=C:\WINDOWS\pss\MyVitalAgent.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Marco^Menu Iniciar^Programas^Inicializar^.security] path=C:\Documents and Settings\Marco\Menu Iniciar\Programas\Inicializar\.security backup=C:\WINDOWS\pss\.securityStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 12:54 5674352 C:\Arquivos de programas\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] -ra------ 2001-07-09 07:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NitroPC] --a------ 2008-04-08 21:40 3434000 C:\Arquivos de programas\NitroPC\NitroPC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-10-16 18:56 185872 C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) "AntiVirService"=2 (0x2) "AntiVirScheduler"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Arquivos de programas\\EA GAMES\\Battlefield Vietnam\\bfvietnam.exe"= "C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"= "C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"= "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-10-20 97928] R2 0VsNdis08;VitalAgent Network Driver 8.1;C:\Arquivos de programas\INS\VitalAgent\Program\VsNdis08.sys [2001-02-07 31671] R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-10-20 76040] S3 0VsComm12;VitalAgent Serial Port Driver 12.4;C:\Arquivos de programas\INS\VitalAgent\Program\VsComm12.sys [2001-02-07 15443] . - - - - ORFOS REMOVIDOS - - - - MSConfigStartUp-ShApiInfo - C:\WINDOWS\system32\gfwdezwz.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 01:25:18 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . ------------------------ Outros Processos em Execuo ------------------------ . C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe C:\ARQUIV~1\AVG\AVG8\avgemc.exe C:\ARQUIV~1\AVG\AVG8\avgscanx.exe C:\Arquivos de programas\AVG\AVG8\avgrsx.exe C:\Arquivos de programas\AVG\AVG8\avgrsx.exe . ************************************************************************** . Tempo para concluso: 2008-10-21 1:30:35 - Mquina reiniciou ComboFix-quarantined-files.txt 2008-10-21 04:30:20 ComboFix2.txt 2008-10-20 21:03:45 Pr-execuo: 17 pasta(s) 42.988.847.104 bytes disponveis Ps execuo: 17 pasta(s) 42,981,453,824 bytes disponveis 205 --- E O F --- 2008-10-16 06:02:25