Liliiane

Aguardando resposta!

ComboFix 10-01-03.03 - Lili 03/01/2010 22:48:49.3.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.478.309 [GMT -2:00] Executando de: c:\documents and settings\Lili\Desktop\ComboFix.exe Comandos utilizados :: c:\documents and settings\Lili\Desktop\CFScript.txt AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98} FILE :: "h:\stqqj.pif" . (((((((((((((((( Arquivos/Ficheiros criados de 2009-12-04 to 2010-01-04 )))))))))))))))))))))))))))) . 2010-01-03 23:10 . 2008-02-28 13:50 -------- d-----w- c:\documents and settings\Lili\FixPolicies 2010-01-03 20:27 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll 2010-01-03 20:27 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll 2010-01-03 20:27 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll 2010-01-03 20:21 . 2010-01-03 22:26 -------- d-----w- C:\$AVG8.VAULT$ 2010-01-03 20:12 . 2010-01-03 20:12 -------- d-----w- c:\arquivos de programas\AVG 2010-01-03 20:12 . 2010-01-03 23:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8 2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Malwarebytes 2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes 2010-01-03 15:40 . 2010-01-03 15:40 -------- d-----w- c:\arquivos de programas\Alwil Software 2010-01-02 17:45 . 2010-01-02 18:21 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP 2010-01-02 17:44 . 2010-01-02 18:33 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools 2010-01-02 03:35 . 2010-01-04 00:17 -------- d-----w- C:\downloads 2010-01-02 03:35 . 2010-01-02 03:35 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\GrabPro 2010-01-02 03:35 . 2010-01-04 00:41 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Orbit 2010-01-02 03:35 . 2010-01-03 23:07 -------- d-----w- c:\arquivos de programas\Orbitdownloader 2010-01-01 20:55 . 2004-08-04 02:45 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll 2010-01-01 20:01 . 2004-08-04 01:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-03 20:48 . 2010-01-01 20:04 -------- d-----w- c:\arquivos de programas\Mobile PhoneTools 2010-01-02 02:09 . 2010-01-01 19:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Analog Devices 2010-01-01 20:55 . 2010-01-01 20:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information 2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield 2010-01-01 20:08 . 2010-01-01 20:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software 2010-01-01 19:59 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat 2010-01-01 19:59 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat 2010-01-01 19:55 . 2010-01-01 19:55 -------- d-----w- c:\arquivos de programas\microsoft frontpage 2010-01-01 19:53 . 2010-01-01 19:53 -------- d-----w- c:\arquivos de programas\Serviços on-line 2010-01-01 19:52 . 2010-01-01 19:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços 2010-01-01 19:51 . 2010-01-01 19:51 21844 ----a-w- c:\windows\system32\emptyregdb.dat . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2010-01-03 1388544] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\ Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-1-2 1716224] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Arquivos de programas\\Mobile PhoneTools\\mphonetools.exe"= "c:\\Arquivos de programas\\Analog Devices\\SoundMAX\\SMax4PNP.exe"= "c:\\Documents and Settings\\Lili\\Desktop\\OrbitDownloaderSetup.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"= R3 D301bus;GW01 USB WMC Bus Driver (WDM);c:\windows\system32\drivers\D301bus.sys [1/1/2010 18:04 83328] R3 D301mdfl;GW01 USB WMC Modem Filter;c:\windows\system32\drivers\D301mdfl.sys [1/1/2010 18:04 14976] R3 D301mdm;GW01 USB WMC Modem Driver;c:\windows\system32\drivers\D301mdm.sys [1/1/2010 18:04 109824] R3 d301nd5;GW01 USB WMC Ethernet GW (NDIS);c:\windows\system32\drivers\d301nd5.sys [1/1/2010 18:04 24832] R3 d301unic;GW01 USB WMC Ethernet GW (WDM);c:\windows\system32\drivers\d301unic.sys [1/1/2010 18:04 105728] S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?] . . ------- Scan Suplementar ------- . uStart Page = hxxp://search.orbitdownloader.com IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-03 22:50 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . Tempo para conclusão: 2010-01-03 22:51:34 ComboFix-quarantined-files.txt 2010-01-04 00:51 ComboFix2.txt 2010-01-04 00:26 ComboFix3.txt 2010-01-03 23:48 Pré-execução: 7 pasta(s) 49.501.208.576 bytes disponíveis Pós execução: 8 pasta(s) 49.476.837.376 bytes disponíveis - - End Of File - - 0F2BF56A9C680B6B3847A796E03E77AF

omboFix 10-01-03.03 - Lili 03/01/2010 22:23:19.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.478.304 [GMT -2:00] Executando de: c:\documents and settings\Lili\Desktop\ComboFix.exe AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98} . (((((((((((((((( Arquivos/Ficheiros criados de 2009-12-04 to 2010-01-04 )))))))))))))))))))))))))))) . 2010-01-03 23:10 . 2008-02-28 13:50 -------- d-----w- c:\documents and settings\Lili\FixPolicies 2010-01-03 20:27 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll 2010-01-03 20:27 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll 2010-01-03 20:27 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll 2010-01-03 20:21 . 2010-01-03 22:26 -------- d-----w- C:\$AVG8.VAULT$ 2010-01-03 20:12 . 2010-01-03 20:12 -------- d-----w- c:\arquivos de programas\AVG 2010-01-03 20:12 . 2010-01-03 23:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8 2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Malwarebytes 2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes 2010-01-03 15:40 . 2010-01-03 15:40 -------- d-----w- c:\arquivos de programas\Alwil Software 2010-01-02 17:45 . 2010-01-02 18:21 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP 2010-01-02 17:44 . 2010-01-02 18:33 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools 2010-01-02 03:35 . 2010-01-04 00:17 -------- d-----w- C:\downloads 2010-01-02 03:35 . 2010-01-02 03:35 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\GrabPro 2010-01-02 03:35 . 2010-01-04 00:22 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Orbit 2010-01-02 03:35 . 2010-01-03 23:07 -------- d-----w- c:\arquivos de programas\Orbitdownloader 2010-01-01 20:55 . 2004-08-04 02:45 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll 2010-01-01 20:01 . 2004-08-04 01:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-03 20:48 . 2010-01-01 20:04 -------- d-----w- c:\arquivos de programas\Mobile PhoneTools 2010-01-02 02:09 . 2010-01-01 19:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Analog Devices 2010-01-01 20:55 . 2010-01-01 20:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information 2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield 2010-01-01 20:08 . 2010-01-01 20:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software 2010-01-01 19:59 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat 2010-01-01 19:59 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat 2010-01-01 19:55 . 2010-01-01 19:55 -------- d-----w- c:\arquivos de programas\microsoft frontpage 2010-01-01 19:53 . 2010-01-01 19:53 -------- d-----w- c:\arquivos de programas\Serviços on-line 2010-01-01 19:52 . 2010-01-01 19:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços 2010-01-01 19:51 . 2010-01-01 19:51 21844 ----a-w- c:\windows\system32\emptyregdb.dat . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2010-01-03 1388544] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\ Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-1-2 1716224] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "h:\\stqgj.pif"= "c:\\Arquivos de programas\\Mobile PhoneTools\\mphonetools.exe"= "c:\\Arquivos de programas\\Analog Devices\\SoundMAX\\SMax4PNP.exe"= "c:\\Documents and Settings\\Lili\\Desktop\\OrbitDownloaderSetup.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"= R3 D301bus;GW01 USB WMC Bus Driver (WDM);c:\windows\system32\drivers\D301bus.sys [1/1/2010 18:04 83328] R3 D301mdfl;GW01 USB WMC Modem Filter;c:\windows\system32\drivers\D301mdfl.sys [1/1/2010 18:04 14976] R3 D301mdm;GW01 USB WMC Modem Driver;c:\windows\system32\drivers\D301mdm.sys [1/1/2010 18:04 109824] R3 d301nd5;GW01 USB WMC Ethernet GW (NDIS);c:\windows\system32\drivers\d301nd5.sys [1/1/2010 18:04 24832] R3 d301unic;GW01 USB WMC Ethernet GW (WDM);c:\windows\system32\drivers\d301unic.sys [1/1/2010 18:04 105728] S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?] . . ------- Scan Suplementar ------- . uStart Page = hxxp://search.orbitdownloader.com IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-03 22:25 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . Tempo para conclusão: 2010-01-03 22:26:06 ComboFix-quarantined-files.txt 2010-01-04 00:26 ComboFix2.txt 2010-01-03 23:48 Pré-execução: 6 pasta(s) 49.482.530.816 bytes disponíveis Pós execução: 8 pasta(s) 49.502.564.352 bytes disponíveis - - End Of File - - A7302E38BCB6DAF1447C44A2C89663B5

já está iniciando no modo seguro, e o gerenciador de tarefas também já está pegando! ComboFix 10-01-03.03 - Lili 03/01/2010 21:44:00.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.478.263 [GMT -2:00] Executando de: c:\documents and settings\Lili\Desktop\ComboFix.exe AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98} . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Serviços ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_DAC970NT -------\Service_dac970nt (((((((((((((((( Arquivos/Ficheiros criados de 2009-12-03 to 2010-01-03 )))))))))))))))))))))))))))) . 2010-01-03 23:10 . 2008-02-28 13:50 -------- d-----w- c:\documents and settings\Lili\FixPolicies 2010-01-03 20:27 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll 2010-01-03 20:27 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll 2010-01-03 20:27 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll 2010-01-03 20:21 . 2010-01-03 22:26 -------- d-----w- C:\$AVG8.VAULT$ 2010-01-03 20:12 . 2010-01-03 20:12 -------- d-----w- c:\arquivos de programas\AVG 2010-01-03 20:12 . 2010-01-03 23:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8 2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Malwarebytes 2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes 2010-01-03 15:40 . 2010-01-03 15:40 -------- d-----w- c:\arquivos de programas\Alwil Software 2010-01-02 17:45 . 2010-01-02 18:21 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP 2010-01-02 17:44 . 2010-01-02 18:33 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools 2010-01-02 03:35 . 2010-01-03 23:08 -------- d-----w- C:\downloads 2010-01-02 03:35 . 2010-01-02 03:35 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\GrabPro 2010-01-02 03:35 . 2010-01-03 23:47 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Orbit 2010-01-02 03:35 . 2010-01-03 23:07 -------- d-----w- c:\arquivos de programas\Orbitdownloader 2010-01-01 20:55 . 2004-08-04 02:45 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll 2010-01-01 20:10 . 2010-01-01 20:10 -------- d-s---w- c:\documents and settings\Lili\UserData 2010-01-01 20:01 . 2004-08-04 01:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-03 20:48 . 2010-01-01 20:04 -------- d-----w- c:\arquivos de programas\Mobile PhoneTools 2010-01-02 02:09 . 2010-01-01 19:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Analog Devices 2010-01-01 20:55 . 2010-01-01 20:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information 2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield 2010-01-01 20:08 . 2010-01-01 20:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software 2010-01-01 19:59 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat 2010-01-01 19:59 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat 2010-01-01 19:55 . 2010-01-01 19:55 -------- d-----w- c:\arquivos de programas\microsoft frontpage 2010-01-01 19:53 . 2010-01-01 19:53 -------- d-----w- c:\arquivos de programas\Serviços on-line 2010-01-01 19:52 . 2010-01-01 19:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços 2010-01-01 19:51 . 2010-01-01 19:51 21844 ----a-w- c:\windows\system32\emptyregdb.dat . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2010-01-03 1388544] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\ Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-1-2 1716224] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "h:\\stqgj.pif"= "c:\\Arquivos de programas\\Mobile PhoneTools\\mphonetools.exe"= "c:\\Arquivos de programas\\Analog Devices\\SoundMAX\\SMax4PNP.exe"= "c:\\Documents and Settings\\Lili\\Desktop\\OrbitDownloaderSetup.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"= "c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"= R3 D301bus;GW01 USB WMC Bus Driver (WDM);c:\windows\system32\drivers\D301bus.sys [1/1/2010 18:04 83328] R3 D301mdfl;GW01 USB WMC Modem Filter;c:\windows\system32\drivers\D301mdfl.sys [1/1/2010 18:04 14976] R3 D301mdm;GW01 USB WMC Modem Driver;c:\windows\system32\drivers\D301mdm.sys [1/1/2010 18:04 109824] R3 d301nd5;GW01 USB WMC Ethernet GW (NDIS);c:\windows\system32\drivers\d301nd5.sys [1/1/2010 18:04 24832] R3 d301unic;GW01 USB WMC Ethernet GW (WDM);c:\windows\system32\drivers\d301unic.sys [1/1/2010 18:04 105728] S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?] . . ------- Scan Suplementar ------- . uStart Page = hxxp://search.orbitdownloader.com IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202 TCP: {44A729FA-5EB3-4AEC-8ECF-E586FFD7551D} = 200.169.116.22 200.169.117.252 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-03 21:47 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializáveis ocultas ... Procurando ficheiros/arquivos ocultos ... Varredura completada com sucesso arquivos/ficheiros ocultos: 0 ************************************************************************** . ------------------------ Outros Processos em Execução ------------------------ . c:\arquivos de programas\Orbitdownloader\orbitnet.exe . ************************************************************************** . Tempo para conclusão: 2010-01-03 21:48:14 - Máquina reiniciou ComboFix-quarantined-files.txt 2010-01-03 23:48 Pré-execução: 5 pasta(s) 49.067.220.992 bytes disponíveis Pós execução: 7 pasta(s) 49.544.605.696 bytes disponíveis WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 7A530F86F7EDD74DD2EF56EFD09A97B5 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:51:24, on 3/1/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\wuauclt.exe C:\Arquivos de programas\Orbitdownloader\orbitdm.exe C:\Arquivos de programas\Orbitdownloader\orbitnet.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Downloads\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing) O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O17 - HKLM\System\CCS\Services\Tcpip\..\{44A729FA-5EB3-4AEC-8ECF-E586FFD7551D}: NameServer = 200.169.116.22 200.169.117.252 -- End of file - 2810 bytes

A uns dias, eu conectei meu mp4 em um outro computador pra revelar fotos, quando eu o conectei de volta no meu computador localizou um vírus chamado "Win32:Confi [Wrm]". Eu baixei vários programas pra remover, sem contar que tive que formatar, então agora está aparecendo outros virus : "Win32/tanatos.M" e "Win32/Heur". eu estou usando no momento o "avg anti-malware" e também baixei o "avast" (que também serve contra worms, malwares, spywares , etc... ). só que nenhum deles consegue retirar o vírus! Sem contar que ele não abre o gerenciador de tarefas, o meu dispositivo de som não funciona, o computador não inicia no modo de segurança! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:32:59, on 3/1/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe C:\ARQUIV~1\AVG\AVG8\avgfws8.exe C:\ARQUIV~1\AVG\AVG8\avgemc.exe C:\ARQUIV~1\AVG\AVG8\avgam.exe C:\ARQUIV~1\AVG\AVG8\avgrsx.exe C:\ARQUIV~1\AVG\AVG8\avgnsx.exe C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe C:\ARQUIV~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\dumprep.exe C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\Arquivos de programas\Orbitdownloader\orbitnet.exe C:\Arquivos de programas\Mobile PhoneTools\mPhonetools.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\Arquivos de programas\AVG\AVG8\aAvgApi.exe C:\Arquivos de programas\AVG\AVG8\avgupd.exe C:\WINDOWS\system32\notepad.exe C:\Arquivos de programas\AVG\AVG8\avgui.exe C:\Arquivos de programas\Orbitdownloader\orbitdm.exe C:\Downloads\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARQUIV~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARQUIV~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing) O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O17 - HKLM\System\CCS\Services\Tcpip\..\{44A729FA-5EB3-4AEC-8ECF-E586FFD7551D}: NameServer = 200.169.116.22 200.169.117.252 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgfws8.exe -- End of file - 4667 bytes