ComboFix 08-04-12.7 - Administrador 2008-04-13 11:43:00.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.185 [GMT -3:00] Executando de: C:\Downloads\ComboFix.exe * Criado um novo ponto de restauro [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((( Ficheiros criados de 2008-03-13 to 2008-04-13 )))))))))))))))))))))))))))))))) . 2008-04-12 23:13 . 2002-12-25 05:21 900,299 -ra------ C:\WINDOWS\system32\sisgl.dll 2008-04-12 23:13 . 2002-12-25 05:21 334,720 -ra------ C:\WINDOWS\system32\sisgrv.dll 2008-04-12 23:13 . 2002-12-25 05:21 221,184 -ra------ C:\WINDOWS\system32\SiSParse.dll 2008-04-12 23:13 . 2002-12-25 05:21 216,448 -ra------ C:\WINDOWS\system32\drivers\sisgrp.sys 2008-04-12 23:13 . 2002-12-25 05:21 151,552 -ra------ C:\WINDOWS\system32\SiSInst.dll 2008-04-12 23:13 . 2002-12-25 05:21 98,304 -ra------ C:\WINDOWS\system32\SiSApCom.dll 2008-04-12 23:13 . 2002-12-25 05:21 49,152 -ra------ C:\WINDOWS\system32\sis740.bin 2008-04-12 23:13 . 2002-12-25 05:21 49,152 -ra------ C:\WINDOWS\system32\sis650.bin 2008-04-12 23:05 . 2008-04-12 23:05 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-04-12 22:49 . 2008-04-12 22:49 d-------- C:\Arquivos de programas\sisagp 2008-04-12 22:49 . 2008-04-12 22:59 d--h----- C:\Arquivos de programas\InstallShield Installation Information 2008-04-12 22:49 . 2002-12-25 05:21 98,304 --a------ C:\WINDOWS\system32\SET21.tmp 2008-04-12 22:48 . 2008-04-12 23:00 2 --a------ C:\WINDOWS\~sisRslt 2008-04-12 22:26 . 2008-04-12 22:29 d-------- C:\Arquivos de programas\Crazy Taxi 2008-04-12 11:36 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-04-12 11:34 . 2008-04-12 11:36 d-------- C:\Arquivos de programas\Java 2008-04-12 11:33 . 2008-04-12 11:33 d-------- C:\Arquivos de programas\Arquivos comuns\Java 2008-04-12 11:31 . 2008-04-12 11:31 d-------- C:\Arquivos de programas\Programas RFB 2008-04-11 16:09 . 2008-04-11 16:55 d-------- C:\Arquivos de programas\BitComet 2008-04-09 12:09 . 2008-04-09 12:09 268 --ah----- C:\sqmdata19.sqm 2008-04-09 12:09 . 2008-04-09 12:09 244 --ah----- C:\sqmnoopt19.sqm 2008-04-09 11:19 . 2008-04-09 11:47 d-------- C:\Documents and Settings\Babih\Modelos 2008-04-09 11:19 . 2008-04-09 11:47 d-------- C:\Documents and Settings\Babih\Favoritos 2008-04-09 11:19 . 2008-04-09 11:47 d-------- C:\Documents and Settings\Babih\Dados de aplicativos 2008-04-09 11:19 . 2008-04-09 11:47 d-------- C:\Documents and Settings\Babih\Configurações locais 2008-04-08 21:25 . 2008-04-09 11:47 d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\MegauploadToolbar 2008-04-03 15:28 . 2008-04-03 15:28 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com 2008-04-03 15:28 . 2008-04-03 15:28 d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\SUPERAntiSpyware.com 2008-04-03 15:28 . 2008-04-09 11:54 d-------- C:\Arquivos de programas\SUPERAntiSpyware 2008-04-03 15:27 . 2008-04-03 15:27 d-------- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard 2008-04-03 15:19 . 2008-04-03 15:19 d-------- C:\Arquivos de programas\Electronic Arts 2008-04-03 15:19 . 1998-10-01 12:50 33,792 --a------ C:\WINDOWS\system32\NPSExec.exe 2008-04-02 14:55 . 2008-04-02 14:57 d-------- C:\Arquivos de programas\NEED_FOR_SPEED_3__HOT_PURSU 2008-04-01 12:36 . 2008-04-01 12:36 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\flag ace stupid data 2008-04-01 12:35 . 2008-04-01 12:36 d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\meta license face 2008-04-01 12:35 . 2008-04-01 12:35 d-------- C:\Arquivos de programas\meta license face 2008-04-01 12:35 . 2008-04-01 12:35 d-------- C:\Arquivos de programas\Circle Developement 2008-03-30 11:29 . 2008-03-30 11:29 d-------- C:\Arquivos de programas\Sega 2008-03-28 20:16 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-03-28 20:16 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-03-28 20:16 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-03-23 15:14 . 2008-03-23 15:14 268 --ah----- C:\sqmdata18.sqm 2008-03-23 15:14 . 2008-03-23 15:14 244 --ah----- C:\sqmnoopt18.sqm 2008-03-23 12:33 . 2008-03-23 12:33 268 --ah----- C:\sqmdata17.sqm 2008-03-23 12:33 . 2008-03-23 12:33 244 --ah----- C:\sqmnoopt17.sqm 2008-03-22 20:40 . 2008-04-12 21:44 d-------- C:\Arquivos de programas\DreaMule 2008-03-22 18:52 . 2003-07-17 15:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd 2008-03-22 18:52 . 2005-01-01 06:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys 2008-03-21 21:21 . 2008-03-21 21:21 d-------- C:\Arquivos de programas\OnGame 2008-03-20 21:45 . 2008-03-20 21:45 d-------- C:\Arquivos de programas\Real 2008-03-20 21:45 . 2008-03-20 21:45 d-------- C:\Arquivos de programas\Arquivos comuns\xing shared 2008-03-20 21:45 . 2008-03-20 21:45 d-------- C:\Arquivos de programas\Arquivos comuns\Real 2008-03-20 21:45 . 2008-03-20 21:45 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-03-20 21:45 . 2008-03-20 21:45 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-03-20 20:07 . 2008-03-20 20:07 0 --a------ C:\WINDOWS\nsreg.dat 2008-03-19 15:12 . 2008-03-19 15:12 d-------- C:\Arquivos de programas\Arquivos comuns\SWF Studio 2008-03-18 11:01 . 2008-03-18 11:01 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Messenger Plus! 2008-03-18 10:15 . 2008-03-18 11:49 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WildTangent 2008-03-18 09:53 . 2008-04-01 12:35 d-------- C:\Arquivos de programas\Messenger Plus! Live 2008-03-18 09:34 . 2008-03-18 09:34 d-------- C:\Arquivos de programas\Windows Live Favorites 2008-03-18 09:33 . 2008-03-18 09:34 d-------- C:\Arquivos de programas\Windows Live Toolbar 2008-03-18 09:08 . 2008-03-18 09:26 d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller 2008-03-18 09:07 . 2008-03-18 09:11 d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller 2008-03-18 09:07 . 2008-03-18 09:27 d-------- C:\Arquivos de programas\Windows Live . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-13 14:45 --------- d-----w C:\Documents and Settings\Administrador\Dados de aplicativos\Free Download Manager 2008-04-13 03:00 --------- d-----w C:\Arquivos de programas\Game Boy 2008-04-13 01:48 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield 2008-03-17 18:04 --------- d-----w C:\Arquivos de programas\Snes9x 2008-03-17 14:35 --------- d-----w C:\Arquivos de programas\Mega Drive 2008-03-11 23:48 --------- d-----w C:\Arquivos de programas\Yahoo! 2008-03-11 23:38 --------- d-----w C:\Arquivos de programas\C-Media Audio 2008-03-10 20:04 --------- d-----w C:\Arquivos de programas\Reality Bytes 2008-03-07 13:35 --------- d-----w C:\Arquivos de programas\Pumpkin Studios 2008-02-29 20:05 --------- d-----w C:\Arquivos de programas\System16 2008-01-15 23:32 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2006-07-10 17:46 27,179 ----a-w C:\WINDOWS\Media\vistasounds.reg 2002-12-25 08:19 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2002-01-01 10:31 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\index.dat 2002-01-01 10:31 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Configurações locais\Histórico\History.IE5\MSHist012002010120020102\index.dat 2002-01-01 10:31 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5\index.dat 2002-01-01 10:31 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat . ------- Sigcheck ------- 2007-02-13 22:54 1405440 43a1c4b69b358556c54ea17e93c6a203 C:\WINDOWS\explorer.exe 2007-06-13 10:21 1035264 dccbf18e94d651393a3ffa060f88e0a0 C:\WINDOWS\SoftwareDistribution\Download\ded860808e92d18393ff7e54f31e0110\sp2gdr\explorer.exe 2007-06-13 10:10 1035264 45d521506825a10b80833b4e9621ccf6 C:\WINDOWS\SoftwareDistribution\Download\ded860808e92d18393ff7e54f31e0110\sp2qfe\explorer.exe . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Nota* entradas vazias & legítimas por defeito não são mostradas. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:45 15360] "traydefy"="C:\DOCUME~1\ADMINI~1\DADOSD~1\METALI~1\sizewipetons.exe" [2008-04-01 12:35 443392] "SUPERAntiSpyware"="C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Arquivos de programas\Eset\nod32kui.exe" [2002-01-01 07:28 949376] "SiS Tray"="C:\WINDOWS\system32\sistray.EXE" [2002-05-09 03:19 303104] "SiS KHooker"="C:\WINDOWS\system32\khooker.exe" [ ] "SiSUSBRG"="C:\WINDOWS\sisUSBrg.exe" [2002-12-25 05:20 32768] "Cmaudio"="cmicnfg.cpl" [] "TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2008-03-20 21:45 185896] "Stupid Data Dart Wave"="C:\Documents and Settings\All Users\Dados de aplicativos\flag ace stupid data\Jugs Stupid.exe" [2008-04-13 00:01 1141760] "SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Arquivos de programas\Windows Sidebar\sidebar.exe" [ ] "MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2007-02-03 22:20 123904 C:\WINDOWS\system32\advpack.dll] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Arquivos de programas\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AeroGlass] --a------ 2002-02-20 07:10 106496 C:\WINDOWS\system32\AeroGlass.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vistadrv] --a------ 2006-07-30 02:37 121089 C:\Arquivos de programas\VistaDrives\vsdrv.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Arquivos de programas\\Raven\\SOF GOLD\\SoF.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"= "C:\\Arquivos de programas\\OnGame\\GunBoundWC\\GunBound.gme"= "C:\\Arquivos de programas\\DreaMule\\emule.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8226:TCP"= 8226:TCP:BitComet 8226 TCP "8226:UDP"= 8226:UDP:BitComet 8226 UDP S3 SiSV;SiSV;C:\WINDOWS\system32\DRIVERS\SiSV.sys [2001-08-17 20:50] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2b98af8-6174-11dc-8cea-000c6e8d049a}] \Shell\Auto\command - F:\fun.xls.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe *Newly Created Service* - CATCHME . Conteúdo da pasta 'Tarefas Agendadas' "2008-04-13 03:00:00 C:\WINDOWS\Tasks\A660BB8391873523.job" - c:\docume~1\admini~1\dadosd~1\metali~1\Chin Link Name.exe "2008-04-13 14:42:00 C:\WINDOWS\Tasks\Verificar Atualizações para a Barra de Ferramentas do Windows Live.job" - C:\Arquivos de programas\Windows Live Toolbar\MSNTBUP.EXE . ************************************************************************** catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-13 11:46:17 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros ocultos ... Varredura completada com sucesso Ficheiros ocultos: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Arquivos de programas\Eset\pr_imon.dll . Tempo para conclusão: 2008-04-13 11:47:25 ComboFix-quarantined-files.txt 2008-04-13 14:47:09 Pre-Run: 2,428,588,032 bytes disponíveis Post-Run: 2,449,735,680 bytes disponíveis