claytinho1001

CONTINUA COM O VIRUS SEGUE O LOG DO COMBOFIX ComboFix 10-01-19.04 - Inova 20/01/2010 7:57.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.55.1046.18.1015.268 [GMT -2:00] Executando de: c:\users\Inova\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . D:\anoataly.exe D:\cs6phv6d.exe D:\e9naq.exe D:\h0.exe D:\wisf1.exe E:\anoataly.exe E:\cs6phv6d.exe E:\e9naq.exe E:\h0.exe E:\wisf1.exe . (((((((((((((((( Arquivos/Ficheiros criados de 2009-12-20 to 2010-01-20 )))))))))))))))))))))))))))) . 2010-01-19 16:17 . 2010-01-19 16:17 -------- d-----w- c:\users\Inova\AppData\Roaming\Lingoes 2010-01-19 16:17 . 2010-01-19 16:17 -------- d-----w- c:\users\Inova\AppData\Local\Lingoes 2010-01-19 16:16 . 2010-01-19 16:16 -------- d-----w- c:\programdata\Lingoes 2010-01-19 15:57 . 2010-01-19 15:57 -------- d-----w- c:\programdata\NCH Software 2010-01-18 18:13 . 2010-01-18 18:13 -------- d-----w- c:\users\Inova\AppData\Roaming\AdobeUM 2010-01-18 18:12 . 2010-01-18 18:13 -------- d-----w- c:\users\Inova\AppData\Local\Adobe 2010-01-18 18:12 . 2010-01-18 18:12 -------- d-----w- c:\program files\Common Files\Adobe 2010-01-16 11:56 . 2010-01-16 11:57 -------- d-----w- C:\Storage Card 2010-01-16 10:37 . 2010-01-16 10:37 -------- d-----w- c:\users\Inova\AppData\Local\Ahead 2010-01-15 19:41 . 2010-01-20 10:02 -------- d-----w- c:\users\Inova\AppData\Roaming\skypePM 2010-01-15 19:41 . 2008-12-11 18:02 417792 ----a-w- c:\windows\system32\GDS32.DLL 2010-01-15 19:41 . 2010-01-15 19:41 -------- d-----w- c:\program files\Firebird 2010-01-15 19:39 . 2008-12-11 18:02 417792 ----a-w- c:\windows\system32\fbclient.dll 2010-01-15 19:39 . 2007-09-27 00:21 401920 ----a-w- c:\windows\system32\DesinstalaFinanceiro.exe 2010-01-15 19:39 . 2004-02-27 14:02 124416 ----a-w- c:\windows\system32\DBExpint.dll 2010-01-15 19:39 . 2002-08-09 14:00 296448 ----a-w- c:\windows\system32\Midas.dll 2010-01-15 19:39 . 2002-08-09 11:00 22528 ----a-w- c:\windows\system32\Borlndmm.dll 2010-01-15 19:39 . 2010-01-15 19:39 -------- d-----w- C:\Info Livre 2010-01-15 19:39 . 2010-01-20 10:02 -------- d-----w- c:\users\Inova\AppData\Roaming\Skype 2010-01-15 19:33 . 2010-01-15 19:33 -------- d-----w- c:\program files\Common Files\Skype 2010-01-15 19:33 . 2010-01-15 19:35 -------- d-----r- c:\program files\Skype 2010-01-15 19:32 . 2010-01-15 19:33 -------- d-----w- c:\programdata\Skype 2010-01-15 18:58 . 2010-01-15 19:14 -------- d-----w- c:\users\Inova\AppData\Local\Microsoft Games 2010-01-15 18:19 . 2010-01-15 18:19 -------- d-----w- c:\users\Inova\AppData\Roaming\Nero 2010-01-15 17:35 . 2010-01-15 16:43 -------- d-----w- c:\windows\Panther 2010-01-15 17:35 . 2010-01-15 17:35 -------- d-----w- C:\Boot 2010-01-15 17:26 . 2010-01-15 17:27 -------- d-----w- c:\program files\Common Files\Nero 2010-01-15 17:26 . 2010-01-15 17:26 -------- d-----w- c:\programdata\Nero 2010-01-15 17:26 . 2010-01-15 17:26 -------- d-----w- c:\program files\Nero 2010-01-15 17:17 . 2010-01-20 09:39 -------- d-----w- c:\users\Inova\Tracing 2010-01-15 17:14 . 2010-01-15 17:14 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-15 17:13 . 2010-01-15 17:13 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2010-01-15 17:13 . 2010-01-15 17:13 -------- d-----w- c:\program files\Microsoft Sync Framework 2010-01-15 17:12 . 2006-11-29 15:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2010-01-15 17:12 . 2010-01-15 17:12 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2010-01-15 17:11 . 2010-01-15 17:13 -------- d-----w- c:\program files\Microsoft 2010-01-15 17:10 . 2010-01-15 17:10 -------- d-----w- c:\program files\Windows Live SkyDrive 2010-01-15 17:10 . 2010-01-15 17:13 -------- d-----w- c:\program files\Windows Live 2010-01-15 17:08 . 2010-01-15 17:08 -------- d-----w- c:\program files\Common Files\Windows Live 2010-01-15 17:08 . 2010-01-15 17:08 -------- d-----w- c:\program files\CCleaner 2010-01-15 17:04 . 2010-01-19 17:14 109216 ----a-w- c:\users\Inova\AppData\Local\GDIPFONTCACHEV1.DAT 2010-01-15 17:03 . 2009-11-02 22:42 195456 ------w- c:\windows\system32\MpSigStub.exe 2010-01-15 17:03 . 2010-01-15 17:03 -------- d-----w- c:\programdata\DVD Shrink 2010-01-15 17:03 . 2010-01-15 17:03 -------- d-----w- c:\program files\DVD Shrink 2010-01-15 17:02 . 2010-01-15 17:02 -------- d-----w- c:\users\Inova\AppData\Local\Mozilla 2010-01-15 16:57 . 2006-10-26 21:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2010-01-15 16:57 . 2006-10-26 21:56 32592 ----a-w- c:\windows\system32\msonpmon.dll 2010-01-15 16:56 . 2010-01-15 16:56 -------- d-----w- c:\program files\Microsoft Works 2010-01-15 16:55 . 2010-01-15 16:55 -------- d-----w- c:\windows\PCHEALTH 2010-01-15 16:55 . 2010-01-15 16:55 -------- d-----w- c:\program files\Microsoft.NET 2010-01-15 16:54 . 2010-01-15 16:54 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2010-01-15 16:53 . 2010-01-15 16:53 -------- d-----w- c:\users\Inova\AppData\Local\Microsoft Help 2010-01-15 16:53 . 2010-01-15 16:57 -------- d-----w- c:\programdata\Microsoft Help 2010-01-15 16:52 . 2010-01-15 16:52 -------- d-----r- C:\MSOCache 2010-01-15 16:51 . 2010-01-15 16:51 -------- d-----w- c:\windows\system32\Macromed 2010-01-15 16:51 . 2009-10-11 06:17 411368 ----a-w- c:\windows\system32\deploytk.dll 2010-01-15 16:51 . 2010-01-15 17:49 -------- d-----w- c:\program files\Java 2010-01-15 16:51 . 2010-01-18 18:12 -------- d-sh--w- c:\windows\Installer 2010-01-15 16:46 . 2010-01-20 09:43 -------- d-----w- c:\windows\system32\wbem\Performance 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-----w- C:\Recovery 2010-01-15 16:38 . 2010-01-15 16:38 -------- d-----w- c:\programdata\Hewlett-Packard 2010-01-15 16:38 . 2009-07-14 01:15 280064 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-20 09:43 . 2009-07-14 08:31 654272 ----a-w- c:\windows\system32\prfh0416.dat 2010-01-20 09:43 . 2009-07-14 08:31 124724 ----a-w- c:\windows\system32\prfc0416.dat 2010-01-15 19:41 . 2010-01-15 19:41 56 ---há-w- c:\programdata\ezsidmv.dat 2010-01-15 16:56 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild 2010-01-15 16:50 . 2010-01-15 16:50 -------- d-----w- c:\program files\Marcos Velasco Security 2010-01-15 16:50 . 2010-01-15 16:50 -------- d-----w- c:\program files\K-Lite Codec Pack 2010-01-15 16:44 . 2010-01-15 16:44 0 ---há-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Modelos 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Menu Iniciar 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Favoritos 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Documentos 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\programdata\Dados de aplicativos 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\program files\Common Files\Sistema 2010-01-15 16:43 . 2010-01-15 16:43 -------- d-sh--we c:\program files\Arquivos Comuns 2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias e legítimas por defeito não são mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-10 2221352] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv R3 RTL8167;Realtek 8167 NT Driver;c:\windows\System32\drivers\Rt86win7.sys [10/06/2009 19:18 139776] S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s [?] S3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s [?] . . ------- Scan Suplementar ------- . uStart Page = hxxp://www.lagoacred.com.br/ IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {C2E3B710-325F-4E5E-9002-D11F6421FCAD} = 200.165.132.151,200.165.132.148 FF - ProfilePath - c:\users\Inova\AppData\Roaming\Mozilla\Firefox\Profiles\6dugicfq.default\ FF - prefs.js: browser.startup.homepage - www.google.com.br FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); . . --------------------- CHAVES DO REGISTRO BLOQUEADAS --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Tempo para conclusão: 2010-01-20 08:03:42 ComboFix-quarantined-files.txt 2010-01-20 10:03 Pré-execução: 13.013.704.704 bytes disponíveis Pós execução: 12.954.947.584 bytes disponíveis - - End Of File - - 75E9EDD9ED946AB0B70AE846C423E986

SEGUE O LOG DO PC Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:19:53, on 20/01/2010 Platform: Unknown Windows (WinNT 6.01.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16385) Boot mode: Normal Running processes: C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Windows Live\Mail\wlmail.exe C:\Windows\system32\NOTEPAD.EXE C:\Program Files\AVG\AVG9\avgscanx.exe C:\Windows\system32\conhost.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\AVG\AVG9\avgui.exe C:\Info Livre\FinanceiroIB\GerenciadorFIL.exe C:\Windows\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Inova\Desktop\REMOVER\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lagoacred.com.br/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock...ash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C2E3B710-325F-4E5E-9002-D11F6421FCAD}: NameServer = 200.165.132.151,200.165.132.148 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_0\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_0\bin\fbserver.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe -- End of file - 5549 bytes