Liliiane
-
Total de itens
0 -
Registro em
-
Última visita
Posts postados por Liliiane
-
-
-
ComboFix 10-01-03.03 - Lili 03/01/2010 22:48:49.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.478.309 [GMT -2:00]
Executando de: c:\documents and settings\Lili\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Lili\Desktop\CFScript.txt
AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}
FILE ::
"h:\stqqj.pif"
.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-04 to 2010-01-04 ))))))))))))))))))))))))))))
.
2010-01-03 23:10 . 2008-02-28 13:50 -------- d-----w- c:\documents and settings\Lili\FixPolicies
2010-01-03 20:27 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2010-01-03 20:27 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-01-03 20:27 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2010-01-03 20:21 . 2010-01-03 22:26 -------- d-----w- C:\$AVG8.VAULT$
2010-01-03 20:12 . 2010-01-03 20:12 -------- d-----w- c:\arquivos de programas\AVG
2010-01-03 20:12 . 2010-01-03 23:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8
2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Malwarebytes
2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-01-03 15:40 . 2010-01-03 15:40 -------- d-----w- c:\arquivos de programas\Alwil Software
2010-01-02 17:45 . 2010-01-02 18:21 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP
2010-01-02 17:44 . 2010-01-02 18:33 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools
2010-01-02 03:35 . 2010-01-04 00:17 -------- d-----w- C:\downloads
2010-01-02 03:35 . 2010-01-02 03:35 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\GrabPro
2010-01-02 03:35 . 2010-01-04 00:41 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Orbit
2010-01-02 03:35 . 2010-01-03 23:07 -------- d-----w- c:\arquivos de programas\Orbitdownloader
2010-01-01 20:55 . 2004-08-04 02:45 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
2010-01-01 20:01 . 2004-08-04 01:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 20:48 . 2010-01-01 20:04 -------- d-----w- c:\arquivos de programas\Mobile PhoneTools
2010-01-02 02:09 . 2010-01-01 19:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Analog Devices
2010-01-01 20:55 . 2010-01-01 20:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information
2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield
2010-01-01 20:08 . 2010-01-01 20:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software
2010-01-01 19:59 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat
2010-01-01 19:59 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat
2010-01-01 19:55 . 2010-01-01 19:55 -------- d-----w- c:\arquivos de programas\microsoft frontpage
2010-01-01 19:53 . 2010-01-01 19:53 -------- d-----w- c:\arquivos de programas\Serviços on-line
2010-01-01 19:52 . 2010-01-01 19:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços
2010-01-01 19:51 . 2010-01-01 19:51 21844 ----a-w- c:\windows\system32\emptyregdb.dat
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2010-01-03 1388544]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-1-2 1716224]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Arquivos de programas\\Mobile PhoneTools\\mphonetools.exe"=
"c:\\Arquivos de programas\\Analog Devices\\SoundMAX\\SMax4PNP.exe"=
"c:\\Documents and Settings\\Lili\\Desktop\\OrbitDownloaderSetup.exe"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=
R3 D301bus;GW01 USB WMC Bus Driver (WDM);c:\windows\system32\drivers\D301bus.sys [1/1/2010 18:04 83328]
R3 D301mdfl;GW01 USB WMC Modem Filter;c:\windows\system32\drivers\D301mdfl.sys [1/1/2010 18:04 14976]
R3 D301mdm;GW01 USB WMC Modem Driver;c:\windows\system32\drivers\D301mdm.sys [1/1/2010 18:04 109824]
R3 d301nd5;GW01 USB WMC Ethernet GW (NDIS);c:\windows\system32\drivers\d301nd5.sys [1/1/2010 18:04 24832]
R3 d301unic;GW01 USB WMC Ethernet GW (WDM);c:\windows\system32\drivers\d301unic.sys [1/1/2010 18:04 105728]
S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://search.orbitdownloader.com
IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 22:50
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
Tempo para conclusão: 2010-01-03 22:51:34
ComboFix-quarantined-files.txt 2010-01-04 00:51
ComboFix2.txt 2010-01-04 00:26
ComboFix3.txt 2010-01-03 23:48
Pré-execução: 7 pasta(s) 49.501.208.576 bytes disponíveis
Pós execução: 8 pasta(s) 49.476.837.376 bytes disponíveis
- - End Of File - - 0F2BF56A9C680B6B3847A796E03E77AF
-
omboFix 10-01-03.03 - Lili 03/01/2010 22:23:19.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.478.304 [GMT -2:00]
Executando de: c:\documents and settings\Lili\Desktop\ComboFix.exe
AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}
.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-04 to 2010-01-04 ))))))))))))))))))))))))))))
.
2010-01-03 23:10 . 2008-02-28 13:50 -------- d-----w- c:\documents and settings\Lili\FixPolicies
2010-01-03 20:27 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2010-01-03 20:27 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-01-03 20:27 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2010-01-03 20:21 . 2010-01-03 22:26 -------- d-----w- C:\$AVG8.VAULT$
2010-01-03 20:12 . 2010-01-03 20:12 -------- d-----w- c:\arquivos de programas\AVG
2010-01-03 20:12 . 2010-01-03 23:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8
2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Malwarebytes
2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-01-03 15:40 . 2010-01-03 15:40 -------- d-----w- c:\arquivos de programas\Alwil Software
2010-01-02 17:45 . 2010-01-02 18:21 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP
2010-01-02 17:44 . 2010-01-02 18:33 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools
2010-01-02 03:35 . 2010-01-04 00:17 -------- d-----w- C:\downloads
2010-01-02 03:35 . 2010-01-02 03:35 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\GrabPro
2010-01-02 03:35 . 2010-01-04 00:22 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Orbit
2010-01-02 03:35 . 2010-01-03 23:07 -------- d-----w- c:\arquivos de programas\Orbitdownloader
2010-01-01 20:55 . 2004-08-04 02:45 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
2010-01-01 20:01 . 2004-08-04 01:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 20:48 . 2010-01-01 20:04 -------- d-----w- c:\arquivos de programas\Mobile PhoneTools
2010-01-02 02:09 . 2010-01-01 19:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Analog Devices
2010-01-01 20:55 . 2010-01-01 20:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information
2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield
2010-01-01 20:08 . 2010-01-01 20:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software
2010-01-01 19:59 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat
2010-01-01 19:59 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat
2010-01-01 19:55 . 2010-01-01 19:55 -------- d-----w- c:\arquivos de programas\microsoft frontpage
2010-01-01 19:53 . 2010-01-01 19:53 -------- d-----w- c:\arquivos de programas\Serviços on-line
2010-01-01 19:52 . 2010-01-01 19:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços
2010-01-01 19:51 . 2010-01-01 19:51 21844 ----a-w- c:\windows\system32\emptyregdb.dat
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2010-01-03 1388544]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-1-2 1716224]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\stqgj.pif"=
"c:\\Arquivos de programas\\Mobile PhoneTools\\mphonetools.exe"=
"c:\\Arquivos de programas\\Analog Devices\\SoundMAX\\SMax4PNP.exe"=
"c:\\Documents and Settings\\Lili\\Desktop\\OrbitDownloaderSetup.exe"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=
R3 D301bus;GW01 USB WMC Bus Driver (WDM);c:\windows\system32\drivers\D301bus.sys [1/1/2010 18:04 83328]
R3 D301mdfl;GW01 USB WMC Modem Filter;c:\windows\system32\drivers\D301mdfl.sys [1/1/2010 18:04 14976]
R3 D301mdm;GW01 USB WMC Modem Driver;c:\windows\system32\drivers\D301mdm.sys [1/1/2010 18:04 109824]
R3 d301nd5;GW01 USB WMC Ethernet GW (NDIS);c:\windows\system32\drivers\d301nd5.sys [1/1/2010 18:04 24832]
R3 d301unic;GW01 USB WMC Ethernet GW (WDM);c:\windows\system32\drivers\d301unic.sys [1/1/2010 18:04 105728]
S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://search.orbitdownloader.com
IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 22:25
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
Tempo para conclusão: 2010-01-03 22:26:06
ComboFix-quarantined-files.txt 2010-01-04 00:26
ComboFix2.txt 2010-01-03 23:48
Pré-execução: 6 pasta(s) 49.482.530.816 bytes disponíveis
Pós execução: 8 pasta(s) 49.502.564.352 bytes disponíveis
- - End Of File - - A7302E38BCB6DAF1447C44A2C89663B5
-
já está iniciando no modo seguro, e o gerenciador de tarefas também já está pegando!
ComboFix 10-01-03.03 - Lili 03/01/2010 21:44:00.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.478.263 [GMT -2:00]
Executando de: c:\documents and settings\Lili\Desktop\ComboFix.exe
AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_DAC970NT
-------\Service_dac970nt
(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-03 to 2010-01-03 ))))))))))))))))))))))))))))
.
2010-01-03 23:10 . 2008-02-28 13:50 -------- d-----w- c:\documents and settings\Lili\FixPolicies
2010-01-03 20:27 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2010-01-03 20:27 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-01-03 20:27 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2010-01-03 20:21 . 2010-01-03 22:26 -------- d-----w- C:\$AVG8.VAULT$
2010-01-03 20:12 . 2010-01-03 20:12 -------- d-----w- c:\arquivos de programas\AVG
2010-01-03 20:12 . 2010-01-03 23:15 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\avg8
2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Malwarebytes
2010-01-03 16:20 . 2010-01-03 16:20 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-01-03 15:40 . 2010-01-03 15:40 -------- d-----w- c:\arquivos de programas\Alwil Software
2010-01-02 17:45 . 2010-01-02 18:21 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP
2010-01-02 17:44 . 2010-01-02 18:33 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\PC Tools
2010-01-02 03:35 . 2010-01-03 23:08 -------- d-----w- C:\downloads
2010-01-02 03:35 . 2010-01-02 03:35 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\GrabPro
2010-01-02 03:35 . 2010-01-03 23:47 -------- d-----w- c:\documents and settings\Lili\Dados de aplicativos\Orbit
2010-01-02 03:35 . 2010-01-03 23:07 -------- d-----w- c:\arquivos de programas\Orbitdownloader
2010-01-01 20:55 . 2004-08-04 02:45 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
2010-01-01 20:10 . 2010-01-01 20:10 -------- d-s---w- c:\documents and settings\Lili\UserData
2010-01-01 20:01 . 2004-08-04 01:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 20:48 . 2010-01-01 20:04 -------- d-----w- c:\arquivos de programas\Mobile PhoneTools
2010-01-02 02:09 . 2010-01-01 19:53 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Analog Devices
2010-01-01 20:55 . 2010-01-01 20:04 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information
2010-01-01 20:55 . 2010-01-01 20:55 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield
2010-01-01 20:08 . 2010-01-01 20:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software
2010-01-01 19:59 . 2001-10-28 15:07 48628 ----a-w- c:\windows\system32\perfc016.dat
2010-01-01 19:59 . 2001-10-28 15:07 344380 ----a-w- c:\windows\system32\perfh016.dat
2010-01-01 19:55 . 2010-01-01 19:55 -------- d-----w- c:\arquivos de programas\microsoft frontpage
2010-01-01 19:53 . 2010-01-01 19:53 -------- d-----w- c:\arquivos de programas\Serviços on-line
2010-01-01 19:52 . 2010-01-01 19:52 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Serviços
2010-01-01 19:51 . 2010-01-01 19:51 21844 ----a-w- c:\windows\system32\emptyregdb.dat
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SoundMAXPnP"="c:\arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe" [2010-01-03 1388544]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Orbit.lnk - c:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-1-2 1716224]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\stqgj.pif"=
"c:\\Arquivos de programas\\Mobile PhoneTools\\mphonetools.exe"=
"c:\\Arquivos de programas\\Analog Devices\\SoundMAX\\SMax4PNP.exe"=
"c:\\Documents and Settings\\Lili\\Desktop\\OrbitDownloaderSetup.exe"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=
"c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=
R3 D301bus;GW01 USB WMC Bus Driver (WDM);c:\windows\system32\drivers\D301bus.sys [1/1/2010 18:04 83328]
R3 D301mdfl;GW01 USB WMC Modem Filter;c:\windows\system32\drivers\D301mdfl.sys [1/1/2010 18:04 14976]
R3 D301mdm;GW01 USB WMC Modem Driver;c:\windows\system32\drivers\D301mdm.sys [1/1/2010 18:04 109824]
R3 d301nd5;GW01 USB WMC Ethernet GW (NDIS);c:\windows\system32\drivers\d301nd5.sys [1/1/2010 18:04 24832]
R3 d301unic;GW01 USB WMC Ethernet GW (WDM);c:\windows\system32\drivers\d301unic.sys [1/1/2010 18:04 105728]
S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://search.orbitdownloader.com
IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202
TCP: {44A729FA-5EB3-4AEC-8ECF-E586FFD7551D} = 200.169.116.22 200.169.117.252
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 21:47
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
------------------------ Outros Processos em Execução ------------------------
.
c:\arquivos de programas\Orbitdownloader\orbitnet.exe
.
**************************************************************************
.
Tempo para conclusão: 2010-01-03 21:48:14 - Máquina reiniciou
ComboFix-quarantined-files.txt 2010-01-03 23:48
Pré-execução: 5 pasta(s) 49.067.220.992 bytes disponíveis
Pós execução: 7 pasta(s) 49.544.605.696 bytes disponíveis
WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 7A530F86F7EDD74DD2EF56EFD09A97B5
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:51:24, on 3/1/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Arquivos de programas\Orbitdownloader\orbitdm.exe
C:\Arquivos de programas\Orbitdownloader\orbitnet.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Downloads\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{44A729FA-5EB3-4AEC-8ECF-E586FFD7551D}: NameServer = 200.169.116.22 200.169.117.252
--
End of file - 2810 bytes
-
A uns dias, eu conectei meu mp4 em um outro computador pra revelar fotos, quando eu o conectei de volta no meu computador localizou um vírus chamado "Win32:Confi [Wrm]".
Eu baixei vários programas pra remover, sem contar que tive que formatar, então agora está aparecendo outros virus : "Win32/tanatos.M" e "Win32/Heur".
eu estou usando no momento o "avg anti-malware" e também baixei o "avast" (que também serve contra worms, malwares, spywares , etc... ).
só que nenhum deles consegue retirar o vírus!
Sem contar que ele não abre o gerenciador de tarefas, o meu dispositivo de som não funciona, o computador não inicia no modo de segurança!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:32:59, on 3/1/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
C:\ARQUIV~1\AVG\AVG8\avgfws8.exe
C:\ARQUIV~1\AVG\AVG8\avgemc.exe
C:\ARQUIV~1\AVG\AVG8\avgam.exe
C:\ARQUIV~1\AVG\AVG8\avgrsx.exe
C:\ARQUIV~1\AVG\AVG8\avgnsx.exe
C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe
C:\ARQUIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\dumprep.exe
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Arquivos de programas\Orbitdownloader\orbitnet.exe
C:\Arquivos de programas\Mobile PhoneTools\mPhonetools.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\AVG\AVG8\aAvgApi.exe
C:\Arquivos de programas\AVG\AVG8\avgupd.exe
C:\WINDOWS\system32\notepad.exe
C:\Arquivos de programas\AVG\AVG8\avgui.exe
C:\Arquivos de programas\Orbitdownloader\orbitdm.exe
C:\Downloads\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARQUIV~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARQUIV~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [soundMAX] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{44A729FA-5EB3-4AEC-8ECF-E586FFD7551D}: NameServer = 200.169.116.22 200.169.117.252
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgfws8.exe
--
End of file - 4667 bytes
[Resolvido]Vírus Win32.Heur & Tanatos.M
em Casos Resolvidos
Postado
Aguardando resposta!