rendered paste bodyComboFix 08-10-19.04 - Marco 2008-10-21 1:21:14.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.710 [GMT -3:00]
Executando de: C:\Documents and Settings\Marco\Desktop\ComboFix.exe
Comandos utilizados :: C:\Documents and Settings\Marco\Desktop\CFScript.txt
* Criado um novo ponto de restauro
FILE ::
C:\.security
C:\WINDOWS\.security
C:\WINDOWS\[u]0[/u]01.scr
C:\WINDOWS\gscr.dll
C:\WINDOWS\system32\cbXqQKed.dll
C:\WINDOWS\system32\cbXrSKAQ.dll
C:\WINDOWS\system32\drivers\pcantispy.sys
C:\WINDOWS\system32\gfwdezwz.exe
C:\WINDOWS\system32\iifEvwvs.dll
C:\WINDOWS\system32\mfojijqt.exe
C:\WINDOWS\system32\qfuhejyd.exe
C:\WINDOWS\system32\sfcbshsn.exe
C:\WINDOWS\system32\xxywWQjG.dll
C:\Documents and Settings\Marco\Menu Iniciar\Programas\Inicializar\ :#:
.
((((((((((((((((((((((((((((((((((((( Outras Excluses )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\.security
C:\Documents and Settings\All Users\Dados de aplicativos\ebubevsp
C:\Documents and Settings\All Users\Dados de aplicativos\ebubevsp\ifizwfgb.exe
C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy
C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy\config.xml
C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy\logs\1224530722.log
C:\Documents and Settings\Marco\Dados de aplicativos\PC-Antispy\Sites.bl
C:\WINDOWS\.security
C:\WINDOWS\[u]0[/u]01.scr
C:\WINDOWS\gscr.dll
C:\WINDOWS\system32\gfwdezwz.exe
C:\WINDOWS\system32\mfojijqt.exe
C:\WINDOWS\system32\qfuhejyd.exe
C:\WINDOWS\system32\sfcbshsn.exe
C:\WINDOWS\privacy_danger . . . . falha na excluso
.
((((((((((((((((((((((((((((((((((((((( Drivers/Servios )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_PCANTISPY
(((((((((((((((( Arquivos/Ficheiros criados de 2008-09-21 to 2008-10-21 ))))))))))))))))))))))))))))
.
2008-12-12 11:25 . 2008-12-12 11:25 554 --a------ C:\WINDOWS\eReg.dat
2008-12-12 11:19 . 2008-12-12 11:22 <DIR> d-------- C:\Arquivos de programas\EA GAMES
2008-12-12 11:18 . 2008-12-12 11:18 <DIR> d-------- C:\Arquivos de programas\DAEMON Tools Lite
2008-12-12 11:16 . 2008-12-12 11:16 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-12-12 11:15 . 2008-12-12 11:15 <DIR> d-------- C:\Documents and Settings\Marco\Dados de aplicativos\DAEMON Tools
2008-12-12 11:06 . 2008-10-10 22:24 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\NFS Underground
2008-12-12 11:05 . 2008-12-12 11:05 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\DirectX
2008-10-20 20:50 . 2008-10-20 20:50 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-10-20 20:41 . 2008-10-20 20:42 <DIR> d-------- C:\Documents and Settings\Administrador
2008-10-20 16:13 . 2008-10-20 16:13 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Yahoo! Companion
2008-10-20 13:52 . 2008-10-20 13:52 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-10-20 13:52 . 2008-10-20 13:52 <DIR> d-------- C:\Arquivos de programas\microsoft frontpage
2008-10-20 13:24 . 2008-10-20 13:24 <DIR> d-------- C:\Arquivos de programas\Yahoo!
2008-10-20 13:23 . 2008-10-20 13:24 <DIR> d-------- C:\Arquivos de programas\CCleaner
2008-10-20 00:35 . 2008-10-20 22:20 <DIR> d--h----- C:\$AVG8.VAULT$
2008-10-20 00:30 . 2008-10-20 08:40 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-10-20 00:30 . 2008-10-20 00:30 <DIR> d-------- C:\Arquivos de programas\AVG
2008-10-20 00:30 . 2008-10-20 00:30 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-10-20 00:30 . 2008-10-20 00:30 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-10-20 00:30 . 2008-10-20 00:30 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-10-19 23:55 . 2008-10-20 01:39 <DIR> d-a------ C:\Documents and Settings\All Users\Dados de aplicativos\TEMP
2008-10-19 23:55 . 2008-10-19 23:55 <DIR> d-------- C:\Arquivos de programas\NitroPC
2008-10-19 23:24 . 2008-10-19 23:24 <DIR> d-------- C:\Arquivos de programas\Panda Security
2008-10-18 23:17 . 2008-10-20 00:30 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avg8
2008-10-18 12:59 . 2008-10-18 12:59 <DIR> d-------- C:\WINDOWS\privacy_danger
2008-10-17 14:24 . 2008-10-17 14:24 <DIR> d-------- C:\Arquivos de programas\VSO
2008-10-17 14:24 . 2004-05-04 11:53 1,645,320 --a------ C:\WINDOWS\gdiplus.dll
2008-10-17 14:24 . 2006-05-20 16:16 1,184,984 --a------ C:\WINDOWS\system32\wvc1dmod.dll
2008-10-17 14:24 . 2006-05-11 19:21 626,688 --a------ C:\WINDOWS\system32\vp7vfw.dll
2008-10-17 14:24 . 2006-09-29 12:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2008-10-17 14:24 . 2006-09-29 12:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2008-10-17 14:24 . 2006-09-29 12:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2008-10-17 14:24 . 2007-03-18 20:37 65,602 --a------ C:\WINDOWS\system32\cook3260.dll
2008-10-17 14:24 . 2008-10-17 14:24 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-10-17 08:47 . 2004-08-04 00:45 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-10-17 08:47 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-10-17 08:47 . 2001-09-05 23:50 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-10-16 18:56 . 2008-10-16 18:56 <DIR> d-------- C:\Program Files
2008-10-16 18:56 . 2008-10-16 18:56 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\xing shared
2008-10-15 12:25 . 2008-09-15 12:40 1,846,144 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 12:24 . 2008-08-14 10:45 2,184,576 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 12:24 . 2008-08-14 10:45 2,140,160 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 12:24 . 2008-08-14 10:45 2,061,952 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 12:24 . 2008-08-14 10:45 2,019,840 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 12:22 . 2008-08-28 07:04 333,056 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-14 10:39 . 2008-10-14 10:39 <DIR> dr-h----- C:\MSOCache
2008-10-14 09:18 . 2008-10-16 03:48 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-10-14 09:17 . 2008-10-14 10:45 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft Help
2008-10-12 23:23 . 2008-10-12 23:23 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\Adobe
2008-10-09 16:35 . 2008-10-09 16:35 <DIR> d-------- C:\World of Warcraft
2008-10-09 11:58 . 2008-10-20 03:28 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-10-09 11:57 . 2008-10-18 06:57 <DIR> d-------- C:\Arquivos de programas\TVSuper3
2008-10-09 11:57 . 2002-12-20 12:02 1,077,336 --a------ C:\WINDOWS\system32\Mscomctl.ocx
2008-10-09 11:57 . 2000-12-06 00:00 209,608 --a------ C:\WINDOWS\system32\Tabctl32.ocx
2008-10-09 11:57 . 2000-05-22 00:00 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-10-09 11:55 . 2008-10-09 11:55 <DIR> d-------- C:\Documents and Settings\Marco\Dados de aplicativos\ppStream
2008-10-09 11:55 . 2008-10-09 11:56 <DIR> d-------- C:\Arquivos de programas\SuperTV
2008-10-09 11:55 . 2008-10-09 11:56 129 --a------ C:\WINDOWS\psnetwork.ini
2008-10-09 11:55 . 2008-10-09 11:56 95 --a------ C:\Iotmrd.sys
2008-10-09 11:47 . 2008-10-09 11:47 <DIR> d-------- C:\Arquivos de programas\GameVicio
2008-10-09 11:46 . 2008-10-09 11:46 295 --a------ C:\WINDOWS\game.ini
2008-10-09 11:41 . 2008-10-09 11:41 <DIR> d-------- C:\Arquivos de programas\Activision
2008-10-08 22:26 . 2008-10-08 22:26 268 --ah----- C:\sqmdata00.sqm
2008-10-08 22:26 . 2008-10-08 22:26 244 --ah----- C:\sqmnoopt00.sqm
2008-10-08 19:00 . 2008-10-08 19:00 <DIR> d-------- C:\WINDOWS\Cache
2008-10-08 18:40 . 2008-10-10 16:34 <DIR> d-------- C:\UT2004
2008-10-08 18:09 . 2008-10-08 18:09 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-10-08 15:22 . 2008-04-11 15:51 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-10-08 15:22 . 2008-05-01 11:32 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
.
((((((((((((((((((((((((((((((((((((( Relatrio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-12 14:19 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield
2008-10-16 21:56 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Real
2008-10-10 19:31 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-10-09 14:38 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information
2008-10-09 01:01 --------- d-----w C:\Arquivos de programas\MSN Messenger
2008-10-08 21:54 --------- d-----w C:\Arquivos de programas\Discador Digerati
2008-10-08 21:10 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-09-15 15:40 1,846,144 ----a-w C:\WINDOWS\system32\win32k.sys
2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-20 05:37 661,504 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 13:45 2,184,576 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:45 2,061,952 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legtimas por defeito no so mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"DAEMON Tools Lite"="C:\Arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\ARQUIV~1\AVG\AVG8\avgtray.exe" [2008-10-20 1234712]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^.security]
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\.security
backup=C:\WINDOWS\pss\.securityCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^MyVitalAgent.lnk]
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\MyVitalAgent.lnk
backup=C:\WINDOWS\pss\MyVitalAgent.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Marco^Menu Iniciar^Programas^Inicializar^.security]
path=C:\Documents and Settings\Marco\Menu Iniciar\Programas\Inicializar\.security
backup=C:\WINDOWS\pss\.securityStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
-ra------ 2001-07-09 07:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NitroPC]
--a------ 2008-04-08 21:40 3434000 C:\Arquivos de programas\NitroPC\NitroPC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-10-16 18:56 185872 C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Arquivos de programas\\EA GAMES\\Battlefield Vietnam\\bfvietnam.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=
"C:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-10-20 97928]
R2 0VsNdis08;VitalAgent Network Driver 8.1;C:\Arquivos de programas\INS\VitalAgent\Program\VsNdis08.sys [2001-02-07 31671]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-10-20 76040]
S3 0VsComm12;VitalAgent Serial Port Driver 12.4;C:\Arquivos de programas\INS\VitalAgent\Program\VsComm12.sys [2001-02-07 15443]
.
- - - - ORFOS REMOVIDOS - - - -
MSConfigStartUp-ShApiInfo - C:\WINDOWS\system32\gfwdezwz.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 01:25:18
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
------------------------ Outros Processos em Execuo ------------------------
.
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\ARQUIV~1\AVG\AVG8\avgscanx.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
C:\Arquivos de programas\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Tempo para concluso: 2008-10-21 1:30:35 - Mquina reiniciou
ComboFix-quarantined-files.txt 2008-10-21 04:30:20
ComboFix2.txt 2008-10-20 21:03:45
Pr-execuo: 17 pasta(s) 42.988.847.104 bytes disponveis
Ps execuo: 17 pasta(s) 42,981,453,824 bytes disponveis
205 --- E O F --- 2008-10-16 06:02:25