rendered paste bodyComboFix 08-06-05.3 - Ana Helena 2008-06-06 1:23:03.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.124 [GMT -3:00]
Executando de: C:\Documents and Settings\Ana Helena\Desktop\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((( Outras Excluses )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\hosts
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\gmsywcjqd.dat
C:\WINDOWS\system32\gmsywcjqd_nav.dat
C:\WINDOWS\system32\gmsywcjqd_navps.dat
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((( Ficheiros criados de 2008-05-06 to 2008-06-06 ))))))))))))))))))))))))))))))))
.
2008-06-06 00:20 . 2008-06-06 00:20 <DIR> d-------- C:\VundoFix Backups
2008-06-06 00:10 . 2008-06-06 00:14 1,904 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-06 00:09 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-06 00:09 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-06 00:09 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-06 00:09 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-06 00:09 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-06 00:09 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-06 00:09 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-06 00:09 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-05 20:15 . 2008-06-04 22:14 316,700 -ra------ C:\WINDOWS\hosts.20080605-201516.backup
2008-06-05 01:44 . 2008-06-05 07:13 <DIR> d-------- C:\MSNCleaner
2008-06-05 00:35 . 2008-06-05 07:13 <DIR> d-------- C:\Arquivos de programas\a-squared Free
2008-06-04 23:35 . 2008-06-05 07:13 <DIR> d-------- C:\LinhaDefensiva
2008-06-04 23:09 . 2008-06-05 07:13 <DIR> d-------- C:\SDFix
2008-06-01 20:54 . 2008-06-01 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avg7
2008-06-01 19:17 . 2008-06-01 19:17 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avira
2008-06-01 19:17 . 2008-06-01 19:17 <DIR> d-------- C:\Arquivos de programas\Avira
2008-05-21 15:33 . 2008-06-04 23:13 <DIR> d-------- C:\Arquivos de programas\CNPJ2008
2008-05-21 15:33 . 2008-05-21 15:33 39 --a------ C:\WINDOWS\cnpj010.INI
2008-05-18 17:29 . 2008-05-18 17:30 <DIR> d-------- C:\Arquivos de programas\Interbank FX Trader 4
2008-05-17 19:36 . 2008-05-17 19:36 <DIR> d-------- C:\Documents and Settings\Ana Helena\advfn
2008-05-06 12:11 . 2008-05-06 12:11 <DIR> d-------- C:\Documents and Settings\Ana Helena\Dados de aplicativos\LocalLow
2008-05-06 12:06 . 2008-05-06 12:06 <DIR> d-------- C:\Arquivos de programas\Softrun
.
((((((((((((((((((((((((((((((((((((( Relatrio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 04:32 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Lightcomm
2008-06-06 04:31 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Orbit
2008-06-06 03:42 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Spybot - Search & Destroy
2008-06-05 21:50 --------- d-----w C:\Arquivos de programas\Google
2008-06-05 20:42 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Skype
2008-06-05 15:10 --------- d-----w C:\Arquivos de programas\SpeedFan
2008-06-05 02:13 --------- d-----w C:\Arquivos de programas\Orbitdownloader
2008-06-04 20:49 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\skypePM
2008-05-06 17:21 --------- d-----w C:\Arquivos de programas\Oi Internet
2008-05-06 17:16 --------- d-----w C:\Arquivos de programas\eMule
2008-05-05 22:40 --------- d-----w C:\Documents and Settings\Ana Helena\Dados de aplicativos\Auslogics
2008-05-05 14:53 --------- d-----w C:\Arquivos de programas\Auto-Escola
2008-05-05 14:52 --------- d-----w C:\Arquivos de programas\PC Tools Firewall Plus
2008-05-04 21:09 --------- dcsh--w C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller
2008-05-04 21:09 --------- d-----w C:\Arquivos de programas\Optimik
2008-05-04 21:09 --------- d-----w C:\Arquivos de programas\Ahead
2008-04-28 00:17 --------- d-----w C:\Arquivos de programas\GCI Demo
2008-04-26 02:31 7,727,880 ----a-w C:\Arquivos de programas\GoogleEarthWin.exe
2008-04-20 23:13 --------- d-----w C:\Arquivos de programas\VIG
2008-04-20 20:46 --------- d-----w C:\Arquivos de programas\LG mobile
2008-04-20 20:45 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information
2008-04-20 20:45 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield
2008-04-20 18:15 --------- d-----w C:\Arquivos de programas\Spyware Doctor
2008-04-20 18:14 --------- d-----w C:\Arquivos de programas\Norton Security Scan
2008-04-20 18:14 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Symantec Shared
2008-04-20 18:13 --------- d---a-w C:\Documents and Settings\All Users\Dados de aplicativos\TEMP
2008-03-16 19:31 32 ----a-w C:\Documents and Settings\All Users\Dados de aplicativos\ezsid.dat
2008-03-08 01:47 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-05-23 21:35 609,648 ----a-w C:\Arquivos de programas\Install.exe
2006-02-20 12:08 5,120 ----a-w C:\Arquivos de programas\tclpipe.exe
2006-02-20 12:08 26,624 ----a-w C:\Arquivos de programas\tclsh.exe
1999-06-01 03:00 74,752 ----a-w C:\Arquivos de programas\ST6UNST.EXE
2004-08-04 03:45 73,728 --sha-w C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
2007-10-15 19:30 56 --sh--r C:\WINDOWS\system32\2D21F2C887.sys
2007-10-15 19:30 1,682 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & legtimas por defeito no so mostradas.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Conexo Oi Velox"="C:\Arquivos de programas\Oi Velox\Conexo\pppoe.exe" [ ]
"SpybotSD TeaTimer"="C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe" [2004-05-12 01:03 1038336]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]
"msnmsgr"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"desp2k"="C:\Arquivos de programas\Oi Velox\Manager\desp2k.exe" [2006-08-03 15:05 65536]
"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2008-02-11 23:46 385024]
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\
Orbit.lnk - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe [2007-11-05 00:31:14 1678536]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Orbit.lnk]
backup=C:\WINDOWS\pss\Orbit.lnkCommon Startup
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Orbit.lnk
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Photags AutoDetect.lnk.disabled]
backup=C:\WINDOWS\pss\Photags AutoDetect.lnk.disabledCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Ana Helena^Menu Iniciar^Programas^Inicializar^Pserver.lnk]
backup=C:\WINDOWS\pss\Pserver.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
--a------ 2008-02-12 10:06 262401 C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RAM Idle Professional]
--a------ 2006-01-17 04:38 135168 C:\Arquivos de programas\RAM Idle LE\RAM_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--a------ 2004-05-12 01:03 1038336 C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized
"msnmsgr"="C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SMSERIAL"=sm56hlpr.exe
"SoundMan"=SOUNDMAN.EXE
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Arquivos de programas\\eMule\\emule.exe"=
"C:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=
"C:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=
"C:\\Audaces Vestuario\\Suporte\\Suporte.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=
R2 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2000-05-12 14:48]
R2 cmpe;Context Manager Process Extension;C:\WINDOWS\system32\cmpe.exe [2007-02-26 10:11]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-06-09 23:09]
S3 RISKEMA;Riskema;C:\WINDOWS\system32\Drivers\Audaproc.sys [2006-11-21 15:30]
.
Contedo da pasta 'Tarefas Agendadas'
"2008-04-25 18:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Arquivos de programas\Norton Security Scan\Nss.exe
"2008-06-05 01:26:48 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Arquivos de programas\Spybot - Search & Destroy\SpybotSD.exe
"2008-04-28 21:00:35 C:\WINDOWS\Tasks\User_Feed_Synchronization-{5A597035-58CF-4897-841A-85E82D4E62DA}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 01:28:52
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializveis ocultas ...
Procurando ficheiros ocultos ...
C:\SYZ_DAT
C:\WINDOWS\system32\drivers\MFX.sys 49580 bytes executable
Varredura completada com sucesso
Ficheiros ocultos: 2
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Arquivos de programas\Orbitdownloader\orbitnet.exe
.
**************************************************************************
.
Tempo para concluso: 2008-06-06 1:38:46 - machine was rebooted [Ana Helena]
ComboFix-quarantined-files.txt 2008-06-06 04:38:35
Pre-Run: 34,920,718,336 bytes disponveis
Post-Run: 34,910,044,160 bytes disponveis
178 --- E O F --- 2008-05-20 05:56:23