Pc lento após instalar net!

bodonchild · Junho 12, 2010

O pc perde rendimento, demora p/ abrir páginas e downloads.

O avira não atualiza..e as vzs a memória cai drasticamente..Eis o log:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 19:14:20, on 11/6/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avfwsvc.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\NOTEPAD.EXE

C:\Arquivos de programas\Avira\AntiVir Desktop\avmailc.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\AVWEBGRD.EXE

C:\Arquivos de programas\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\update.exe

C:\Documents and Settings\Convidado\Meus documentos\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.live.com/sphome.aspx

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: NitroPDFBHO Class - {CF070CB8-F02F-4af4-A7B7-8D45CAD4BB54} - C:\Arquivos de programas\Nitro PDF\PDF Download\NitroPDF.dll

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Save Page As PDF ... - file://C:\Arquivos de programas\Nitro PDF\PDF Download\nitroweb.htm

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\Arquivos de programas\Nitro PDF\PDF Download\NitroPDF.dll

O9 - Extra 'Tools' menuitem: PDF Download - Options - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\Arquivos de programas\Nitro PDF\PDF Download\NitroPDF.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe (file missing)

O9 - Extra button: PDF Download - {F1C0FD6C-A6A0-49a7-A932-71A56461867F} - C:\Arquivos de programas\Nitro PDF\PDF Download\NitroPDF.dll (HKCU)

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{8AD1177A-26EC-45AA-A0C5-1772FE68E6CC}: NameServer = 172.19.51.1

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira FireWall (AntiVirFirewallService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avfwsvc.exe

O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avmailc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\AVWEBGRD.EXE

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Arquivos de programas\TuneUp Utilities 2010\TuneUpDefragService.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Arquivos de programas\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--

End of file - 6670 bytes

RenatoMejias · Junho 19, 2010

1. Faça o download do DDS e salve no desktop.

Links Alternativos

Link2

Temporariamente desative seus programas de proteção.
Duplo clique em dds.scr.
Irá surgir uma tela preta com algumas informações. Não clique em nada, apenas aguarde!
Quando terminar, duas janelas abrirão: DDS.txt e Attach.txt.
Salve os resultados e cole-os no seu tópico.

bodonchild · Junho 22, 2010

Desculpe a demora..E desde já obrigado pela ajuda!!

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 7/9/2007 20:11:15

System Uptime: 22/6/2010 19:57:37 (4 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-7211

Processor: Intel® Celeron® CPU 2.66GHz | Socket 775 | 2660/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 25,898 GiB free.

D: is CDROM ()

E: is CDROM (UDF)

F: is CDROM (CDFS)

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: USB Device

Device ID: USB\VID_0D8C&PID_5200\5&1EEE9724&0&6

Manufacturer:

Name: USB Device

PNP Device ID: USB\VID_0D8C&PID_5200\5&1EEE9724&0&6

Service:

==== System Restore Points ===================

RP7: 19/6/2010 10:28:40 - Ponto de verificação do sistema

RP8: 19/6/2010 10:28:40 - teste 1

RP9: 19/6/2010 10:28:40 - Installed Windows XP WIC.

RP10: 19/6/2010 10:28:40 - DirectX instalado

RP11: 19/6/2010 10:28:39 - Removido Assistente de Conexão do Windows Live

RP12: 19/6/2010 10:28:39 - Removido Ferramenta de Carregamento do Windows Live

RP13: 19/6/2010 10:28:39 - Removed Microsoft SQL Server 2005 Compact Edition [ENU]

RP14: 19/6/2010 10:28:39 - Removido Windows Live Sync

RP15: 19/6/2010 10:28:39 - Removed Microsoft Sync Framework Runtime Native v1.0 (x86)

RP16: 19/6/2010 10:28:39 - Removed Microsoft Sync Framework Services Native v1.0 (x86)

RP17: 19/6/2010 10:28:38 - Operação de restauração

RP18: 19/6/2010 10:28:38 - Installed Windows Installer Clean Up

RP19: 18/6/2010 19:47:46 - Removed PDF Download for Internet Explorer

RP20: 19/6/2010 15:07:35 - OK

RP21: 20/6/2010 16:22:42 - Ponto de verificação do sistema

RP22: 22/6/2010 12:15:05 - Ponto de verificação do sistema

==== Installed Programs ======================

Acoustica Beatcraft

Acoustica Effects Pack

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 6.0.1 - Português

Agares RackA3 v1.0

Apple Application Support

Apple Software Update

Arquivo do WinRAR

ASIO4ALL

Assistente de Conexão do Windows Live

Atualização de Segurança para Windows Internet Explorer 8 (KB971961)

Atualização de Segurança para Windows Internet Explorer 8 (KB981332)

Atualização de Segurança para Windows Internet Explorer 8 (KB982381)

Atualização para Windows Internet Explorer 8 (KB976662)

Atualização para Windows Internet Explorer 8 (KB982632)

Avira Premium Security Suite

Blue Cat's Chorus - VST

Blue Cat's Chorus VST 3.5

Blue Cat's Flanger VST 2.5

Blue Cat's Freeware Pack VST 1.1

Blue Cat's FreqAnalyst VST 1.4

Blue Cat's Gain Suite VST 2.3

Blue Cat's Phaser - DX

Blue Cat's Phaser VST 2.5

Blue Cat's Stereo Chorus VST 3.5

Blue Cat's Stereo Flanger - DX

Blue Cat's Stereo Flanger VST 2.5

Blue Cat's Triple EQ VST 3.4

BlueCat's Digital Peak Meter - VST

Cakewalk VST Adapter 4

CCleaner

DAEMON Tools

Defraggler

Digital Camera Driver

Drumaxx

DVD Photo Slideshow Professional 8.00

DVDFab Platinum 3.0.8.0 Ghosthunter release

Ferramenta de Carregamento do Windows Live

FL Studio 9

GetRight

Google Chrome

Google Earth

Google SketchUp 7

Google Toolbar for Internet Explorer

Google Update Helper

Guitar Pro 5.2

Guitar Tracks Pro 3

Hardcore

IL Download Manager

Inkscape 0.47

K-Lite Mega Codec Pack 4.9.0

Malwarebytes' Anti-Malware

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Office Professional Edição 2003

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Motorola SM56 Speakerphone Modem

Mozilla Firefox (3.6.4)

MSVCRT

Need for Speed™ Most Wanted

Nero 7 Ultra Edition

Nero Suite

nullDC 1.0.0 Public Beta 1 Setup

OGA Notifier 2.0.0048.0

Platform

PoiZone

Polipo 1.0.4.1

PowerDVD

PSP PianoVerb 1.0

PSP VintageMeter 1.0

Realtek AC'97 Audio

Safari

Sawer

Segoe UI

Sonic Foundry Sound Forge 6.0

Speccy

Studio Devil British Valve Custom v1.1

The Simpsons Movie - Sleeping Homer Screen Saver

Tor 0.2.1.26

Toxic Biohazard

TuneUp Utilities

TuneUp Utilities Language Pack (pt-BR)

Tweak UI

UltraISO Premium V9.35

VIA Platform Device Manager

VIA/S3G Display Driver 6.14.10.0297

Vidalia 0.2.9

Wave Arts Tube Saturator

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows Installer 3.1 (KB893803)

Windows Installer Clean Up

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Messenger

Windows Media Format Runtime

==== End Of File ===========================

DDS (Ver_10-03-17.01) - NTFSx86

Run by Administrador at 22:58:30,93 on ter 22/06/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.447.150 [GMT -3:00]

AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {11638345-E4FC-4BEE-BB73-EC754659C5F6}

FW: Avira FireWall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avfwsvc.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avmailc.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\AVWEBGRD.EXE

svchost.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\Administrador\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com.br/

uSearch Page = hxxp://search.live.com

uSearch Bar = hxxp://search.live.com/sphome.aspx

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://search.live.com/sphome.aspx

mCustomizeSearch = hxxp://search.live.com/sphome.aspx

BHO: IE to GetRight Helper: {31ff080d-12a3-439a-a2ef-4ba95a3148e8} - c:\arquivos de programas\getright\xx2gr.dll

BHO: Auxiliar de Conexão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\arquivos de programas\arquivos comuns\microsoft shared\windows live\WindowsLiveLogin.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [avgnt] "c:\arquivos de programas\avira\antivir desktop\avgnt.exe" /min

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

uPolicies-explorer: MaxRecentDocs = 10 (0xa)

uPolicies-explorer: NoRecentDocsNetHood = 1 (0x1)

IE: Download with GetRight - c:\arquivos de programas\getright\GRdownload.htm

IE: Open with GetRight Browser - c:\arquivos de programas\getright\GRbrowse.htm

LSP: c:\arquivos de programas\avira\antivir desktop\avsda.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

TCP: {8AD1177A-26EC-45AA-A0C5-1772FE68E6CC} = 172.19.51.1

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\dadosd~1\mozilla\firefox\profiles\i51zogxw.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br

FF - prefs.js: network.proxy.type - 0

FF - component: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\i51zogxw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

FF - plugin: c:\arquivos de programas\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\arquivos de programas\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\arquivos de programas\k-lite codec pack\real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\k-lite codec pack\real\browser\plugins\nprpjplug.dll

FF - plugin: c:\documents and settings\administrador\configuraã§ãµes locais\dados de aplicativos\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\documents and settings\administrador\dados de aplicativos\mozilla\firefox\profiles\i51zogxw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

---- FIREFOX POLICIES ----

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-já", "mozff");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2007-9-7 155136]

R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2007-9-7 5248]

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-9-7 11264]

R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [2010-6-10 102856]

R1 avgio;avgio;c:\arquivos de programas\avira\antivir desktop\avgio.sys [2009-12-11 11608]

R2 AntiVirFirewallService;Avira FireWall;c:\arquivos de programas\avira\antivir desktop\avfwsvc.exe [2010-6-10 536232]

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\arquivos de programas\avira\antivir desktop\avmailc.exe [2010-6-10 337064]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\avira\antivir desktop\sched.exe [2009-12-11 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\arquivos de programas\avira\antivir desktop\avguard.exe [2009-12-11 267432]

R2 AntiVirWebService;Avira AntiVir WebGuard;c:\arquivos de programas\avira\antivir desktop\avwebgrd.exe [2010-6-10 405672]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-11 60936]

R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [2010-6-10 79432]

S2 rjhnrsqbm;Support Server;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\arquivos de programas\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2010-2-25 10064]

S3 uti3nzc5;AVZ Kernel Driver;c:\windows\system32\drivers\uti3nzc5.sys [2009-12-11 7168]

S4 gupdate;Google Update Service (gupdate);"c:\arquivos de programas\google\update\googleupdate.exe" /svc --> c:\arquivos de programas\google\update\GoogleUpdate.exe [?]

S4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\arquivos de programas\tuneup utilities 2010\TuneUpUtilitiesService32.exe [2010-5-7 1051976]

=============== Created Last 30 ================

2010-06-21 18:38:49 0 d-----w- C:\Downloads

2010-06-21 18:11:28 0 d-----w- c:\arquivos de programas\GetRight

2010-06-21 17:52:39 0 d-----w- c:\docume~1\admini~1\dadosd~1\Tor

2010-06-21 17:52:37 0 d-----w- c:\arquivos de programas\Vidalia Bundle

2010-06-19 19:11:33 0 d-----w- c:\arquivos de programas\Acoustica Shared Effects

2010-06-19 19:11:05 0 d-----w- c:\arquivos de programas\Acoustica Beatcraft

2010-06-19 18:31:20 0 d-----w- c:\arquivos de programas\ASIO4ALL v2

2010-06-19 18:29:24 1554944 ----a-w- c:\windows\system32\vorbis.acm

2010-06-19 18:28:42 0 d-----w- c:\arquivos de programas\Outsim

2010-06-19 18:25:04 0 d-----w- c:\arquivos de programas\Image-Line

2010-06-19 17:04:36 0 d-----w- c:\docume~1\alluse~1\dadosd~1\Socusoft

2010-06-19 17:03:06 24064 ----a-w- c:\windows\system32\msxml3a.dll

2010-06-19 17:01:41 0 d-----w- c:\arquivos de programas\Socusoft

2010-06-19 17:01:41 0 d-----w- c:\arquivos de programas\DVD Photo Slideshow Professional

2010-06-18 23:43:38 0 d-----w- c:\arquivos de programas\Windows Live SkyDrive

2010-06-18 23:14:56 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys

2010-06-18 22:25:10 0 d-----w- c:\arquivos de programas\Windows Installer Clean Up

2010-06-18 20:15:43 0 d-----w- c:\windows\system32\wbem\Repository

2010-06-18 17:35:08 0 d-----w- c:\docume~1\admini~1\dadosd~1\GetRight

2010-06-17 20:01:58 0 d-----w- c:\docume~1\admini~1\dadosd~1\QuickScan

2010-06-17 14:57:56 48620 ---há-w- c:\windows\system32\mlfcache.dat

2010-06-17 14:49:17 0 d-----w- c:\arquivos de programas\arquivos comuns\Apple

2010-06-16 20:03:21 0 d--h--w- c:\windows\msdownld.tmp

2010-06-16 19:18:36 0 d-----w- c:\docume~1\admini~1\dadosd~1\Uniblue

2010-06-16 16:11:03 266360 ----a-w- c:\windows\system32\TweakUI.exe

2010-06-16 13:42:11 0 d-----w- c:\windows\system32\CatRoot_bak

2010-06-13 18:05:29 0 d-----w- c:\windows\ServicePackFiles

2010-06-12 02:01:18 160217 ----a-w- c:\windows\system32\PowerToysLicense.rtf

2010-06-11 16:52:29 0 d-sh--w- c:\documents and settings\administrador\IECompatCache

2010-06-11 16:50:30 0 d-sh--w- c:\documents and settings\administrador\PrivacIE

2010-06-11 16:47:29 0 d-sh--w- c:\documents and settings\administrador\IETldCache

2010-06-11 16:44:12 0 d-----w- c:\windows\ie8updates

2010-06-11 16:42:08 0 dc-h--w- c:\windows\ie8

2010-06-11 16:38:00 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2010-06-11 16:38:00 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-06-11 16:37:57 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2010-06-11 16:37:57 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2010-06-11 16:37:57 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2010-06-11 16:37:56 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

2010-06-11 16:37:54 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll

2010-06-11 16:23:02 41984 -c----w- c:\windows\system32\dllcache\iecompat.dll

2010-06-10 23:48:18 30536 ----a-w- c:\windows\system32\TURegOpt.exe

2010-06-10 23:48:17 30024 ----a-w- c:\windows\system32\uxtuneup.dll

2010-06-10 23:47:36 0 d-----w- c:\arquivos de programas\TuneUp Utilities 2010

2010-06-10 23:47:19 0 d-----w- c:\docume~1\alluse~1\dadosd~1\TuneUp Software

2010-06-10 21:08:00 2062592 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-06-10 21:07:55 2020864 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-06-10 21:07:50 2185600 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-06-10 21:07:40 2141184 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-06-10 16:56:55 0 d-----w- c:\docume~1\admini~1\dadosd~1\Avira

2010-06-10 16:52:45 79432 ----a-w- c:\windows\system32\drivers\avfwim.sys

2010-06-10 16:52:45 102856 ----a-w- c:\windows\system32\drivers\avfwot.sys

2010-06-08 16:01:55 454016 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2010-06-08 15:52:53 272384 -c----w- c:\windows\system32\dllcache\bthport.sys

2010-06-08 15:52:53 272384 ------w- c:\windows\system32\drivers\bthport.sys

2010-06-08 14:16:30 0 d-----w- c:\docume~1\admini~1\dadosd~1\TuneUp Software

2010-06-08 14:15:48 0 d-sh--w- c:\docume~1\alluse~1\dadosd~1\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

2010-06-08 14:14:05 0 d-----w- c:\arquivos de programas\Speccy

2010-06-08 13:40:38 0 d-----w- c:\arquivos de programas\Defraggler

2010-06-08 13:37:13 0 d-----w- c:\arquivos de programas\CCleaner

2010-06-08 03:17:44 215920 ----a-w- c:\windows\system32\muweb.dll

2010-06-08 03:17:44 17264 ----a-w- c:\windows\system32\mucltui.dll.mui

2010-06-08 03:17:43 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-06-08 00:22:57 13369344 ----a-w- c:\documents and settings\administrador\NTUSER.DAT_tureg_old

2010-06-07 23:44:18 0 d-----w- c:\documents and settings\administrador\Tracing

2010-06-07 23:41:18 0 d-----w- c:\arquivos de programas\Microsoft

2010-06-07 22:38:52 0 d-----w- c:\arquivos de programas\arquivos comuns\Windows Live

2010-06-07 20:59:17 0 d-----w- c:\windows\system32\PreInstall

2010-06-07 17:16:48 0 d-----w- c:\windows\system32\SoftwareDistribution

2010-06-05 19:17:06 4926 ----a-w- c:\documents and settings\administrador\.recently-used.xbel

2010-06-04 19:45:24 249936 ----a-w- c:\windows\system32\prgiso.dll

==================== Find3M ====================

2010-06-20 15:19:20 44672 ----a-w- c:\windows\system32\drivers\UAGP35.SYS

2010-06-18 19:20:11 68306 ----a-w- c:\windows\system32\perfc016.dat

2010-06-18 19:20:11 428330 ----a-w- c:\windows\system32\perfh016.dat

2010-06-08 13:01:35 49586 ----a-w- c:\windows\system32\prfc0416.dat

2010-06-08 13:01:35 347294 ----a-w- c:\windows\system32\prfh0416.dat

2010-05-06 10:34:18 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 08:26:15 1851008 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 18:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 18:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-20 05:47:37 285696 ----a-w- c:\windows\system32\atmfd.dll

2010-04-17 01:12:18 48464 ----a-w- c:\windows\system32\sirenacm.dll

============= FINISH: 23:00:18,15 ===============

Editado Junho 23, 2010 por bodonchild

RenatoMejias · Junho 25, 2010

Leia as instruções contidas neste link:

##### "Como usar o ComboFix" #####

Nas instruções contidas no link acima, poderá verificar quais os fóruns onde os Analistas estão devidamente habilitados a utilizar corretamente a ferramenta:"Fóruns para receber ajuda com logs do ComboFix"

Faça o download do ComboFix de um dos links oficiais listados abaixo e salve no seu desktop:
- Link
- Link alternativo
Temporariamente e durante a execução destas instruções, é muito importante que mantenha desabilitados os seus programas de proteção (Antivirus, Antispyware e Firewall). Reative as proteções após a execução do(s) procedimento(s) abaixo mencionado(s).
Duplo clique no icone que está no desktop.
Leia e aceite as condições, digitando 1 e enter.
Computadores com Windows XP deverão instalar o Console de Recuperação:
- Se o seu computador tem instaldo o Windows XP e ainda não tem instalado o Console de Recuperação, por favor certifique-se que está conectado à Internet, e clique em "Sim".
- Clique em "OK" ao EULA.
- Quando o Console de Recuperação estiver já instalado, clique em "SIM" para continuar.
O ComboFix será executado, por favor seja paciente e aguarde.
Atenção: Não utilize o mouse nem o teclado enquanto a ferramenta estiver sendo executada, isso pode fazer com que o computador pare.
Poderá surgir o aviso que é necessário reiniciar o computador.
NÃO REINICIE!!! O ComboFix reiniciará o computador automaticamente.
Quando a ferramenta terminar de rodar, gerará um log (o arquivo C:\ComboFix.txt). Copie e cole o conteúdo desse arquivo na sua proxima resposta.

NÃO utilize a ferramenta por conta própria. É uma ferramenta poderosa criada pra lidar com infecções sofisticadas e caso não a utilize corretamente poderá danificar o seu computador.
Existem vários malwares que impedem a execução correta da ferramenta e com isso danificar gravemente o computador. Analistas habilitados a utilizar o ComboFix conhecem esses casos e sabem lidar com estas situações.
Muitos dos Analistas não respondem a topicos em que vejam que o ComboFix foi utilizado sem supervisão.
Existem varias ferramentas anti-malware generalistas em que os autores ao elaborarem a programação das mesmas, estão pensando nos usuários finais e para serem usadas sem supervisão. O Combofix não é uma ferramenta desse tipo, e assim sendo e até por respeito ao autor da ferramenta, não utilize sem supervisão.

bodonchild · Junho 25, 2010

Bem, estamos no caminho certo...havia um rootkit...

ComboFix 10-06-24.03 - Administrador 25/06/2010 13:19:47.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.447.197 [GMT -3:00]

Executando de: c:\documents and settings\Administrador\Desktop\ComboFix.exe

AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Avira FireWall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}

FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

* AV residente está ativo

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrador\Dados de aplicativos\.#

c:\documents and settings\Administrador\Dados de aplicativos\.#\MBX@150@935368.###

c:\documents and settings\Administrador\Dados de aplicativos\.#\MBX@150@935A58.###

c:\documents and settings\Administrador\Dados de aplicativos\.#\MBX@51C@9352F0.###

c:\documents and settings\Administrador\Dados de aplicativos\.#\MBX@51C@9359E0.###

c:\documents and settings\Administrador\Dados de aplicativos\.#\MBX@6E8@935368.###

c:\documents and settings\Administrador\Dados de aplicativos\.#\MBX@6E8@935A58.###

c:\documents and settings\mario\jpeg.dll

c:\documents and settings\mario\libtiff.dll

c:\documents and settings\mario\MARIO.exe

c:\documents and settings\mario\ogg.dll

c:\documents and settings\mario\smpeg.dll

c:\documents and settings\mario\vorbis.dll

c:\documents and settings\mario\vorbisfile.dll

c:\windows\system32\msvcsv60.dll

A cópia de c:\windows\system32\drivers\uagp35.sys foi encontrada e desinfectada

Cópia restaurada de - Kitty had a snack :p

.

(((((((((((((((( Arquivos/Ficheiros criados de 2010-05-25 to 2010-06-25 ))))))))))))))))))))))))))))

.

2010-06-24 02:50 . 2010-06-24 02:50 -------- d-----w- c:\documents and settings\Convidado\Dados de aplicativos\ESET

2010-06-24 00:46 . 2010-06-24 00:49 -------- d-----w- c:\arquivos de programas\UTorrents (Minha Pasta)

2010-06-24 00:40 . 2010-06-25 16:02 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\uTorrent

2010-06-24 00:19 . 2010-06-24 00:19 184320 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\wlan4.dll

2010-06-24 00:19 . 2010-06-24 00:19 59904 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\ups.dll

2010-06-24 00:19 . 2010-06-24 00:19 10752 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\system.dll

2010-06-24 00:19 . 2010-06-24 00:19 65536 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\sync.dll

2010-06-24 00:14 . 2010-06-24 00:19 75264 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\stp.dll

2010-06-24 00:14 . 2010-06-24 00:14 90624 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\secure.dll

2010-06-24 00:14 . 2010-06-24 00:14 116736 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\roting4.dll

2010-06-24 00:13 . 2010-06-24 00:14 59392 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\radlan.dll

2010-06-24 00:13 . 2010-06-24 00:13 109056 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\ppp.dll

2010-06-24 00:13 . 2010-06-24 00:13 70656 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\pim.dll

2010-06-24 00:13 . 2010-06-24 00:13 57856 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\ntp.dll

2010-06-24 00:13 . 2010-06-24 00:13 71168 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\mpls.dll

2010-06-24 00:11 . 2010-06-24 00:13 58368 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\lcd.dll

2010-06-24 00:09 . 2010-06-24 00:11 57344 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\isdn.dll

2010-06-24 00:09 . 2010-06-24 00:09 76288 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\ipv6.dll

2010-06-24 00:09 . 2010-06-24 00:09 79872 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\hotspot.dll

2010-06-24 00:09 . 2010-06-24 00:09 69632 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\dhcp.dll

2010-06-24 00:09 . 2010-06-24 00:09 58880 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\arlan.dll

2010-06-24 00:09 . 2010-06-24 00:09 69632 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\advtool.dll

2010-06-24 00:07 . 2010-06-24 00:09 1514496 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.3-4232445254\roteros.dll

2010-06-23 18:34 . 2010-06-23 18:34 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Megaupload

2010-06-23 18:33 . 2010-06-23 18:33 -------- d-----w- c:\arquivos de programas\Megaupload

2010-06-23 13:40 . 2010-06-23 13:40 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\ESET

2010-06-23 13:38 . 2010-06-23 13:38 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\ESET

2010-06-23 13:38 . 2010-06-23 13:38 -------- d-----w- c:\arquivos de programas\ESET

2010-06-23 03:08 . 2010-06-23 03:08 184320 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\wlan4.dll

2010-06-23 03:08 . 2010-06-23 03:08 59904 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\ups.dll

2010-06-23 03:08 . 2010-06-23 03:08 10752 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\system.dll

2010-06-23 03:08 . 2010-06-23 03:08 65536 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\sync.dll

2010-06-23 03:08 . 2010-06-23 03:08 90624 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\secure.dll

2010-06-23 03:08 . 2010-06-23 03:08 116736 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\roting4.dll

2010-06-23 03:08 . 2010-06-23 03:08 59392 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\radlan.dll

2010-06-23 03:07 . 2010-06-23 03:08 110080 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\ppp.dll

2010-06-23 03:07 . 2010-06-23 03:07 70656 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\pim.dll

2010-06-23 03:07 . 2010-06-23 03:07 57856 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\ntp.dll

2010-06-23 03:07 . 2010-06-23 03:07 71168 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\mpls.dll

2010-06-23 03:07 . 2010-06-23 03:07 58368 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\lcd.dll

2010-06-23 03:07 . 2010-06-23 03:07 57344 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\isdn.dll

2010-06-23 03:07 . 2010-06-23 03:07 76288 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\ipv6.dll

2010-06-23 03:07 . 2010-06-23 03:07 79872 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\hotspot.dll

2010-06-23 03:07 . 2010-06-23 03:07 70144 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\dhcp.dll

2010-06-23 03:07 . 2010-06-23 03:07 58880 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\arlan.dll

2010-06-23 03:07 . 2010-06-23 03:07 69632 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\advtool.dll

2010-06-23 03:07 . 2010-06-23 03:07 1531904 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik\Winbox\4.6-2146247327\roteros.dll

2010-06-23 03:06 . 2010-06-23 03:06 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Mikrotik

2010-06-21 18:38 . 2010-06-24 20:10 -------- d-----w- C:\Downloads

2010-06-21 18:11 . 2010-06-21 19:20 -------- d-----w- c:\arquivos de programas\GetRight

2010-06-21 17:52 . 2010-06-23 20:45 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Tor

2010-06-21 17:52 . 2010-06-23 20:45 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Vidalia

2010-06-21 17:52 . 2010-06-21 17:52 -------- d-----w- c:\arquivos de programas\Vidalia Bundle

2010-06-20 02:35 . 2010-06-21 23:49 -------- d---a-w- c:\documents and settings\All Users\Dados de aplicativos\TEMP

2010-06-19 19:11 . 2010-06-19 19:11 -------- d-----w- c:\arquivos de programas\Acoustica Shared Effects

2010-06-19 19:11 . 2010-06-19 19:11 -------- d-----w- c:\arquivos de programas\Acoustica Beatcraft

2010-06-19 18:31 . 2010-06-19 18:31 -------- d-----w- c:\arquivos de programas\ASIO4ALL v2

2010-06-19 18:28 . 2010-06-19 18:28 -------- d-----w- c:\arquivos de programas\Outsim

2010-06-19 18:25 . 2010-06-19 19:10 -------- d-----w- c:\arquivos de programas\Image-Line

2010-06-19 17:04 . 2010-06-19 17:04 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Socusoft

2010-06-19 17:03 . 2010-06-03 12:00 24064 ----a-w- c:\windows\system32\msxml3a.dll

2010-06-19 17:01 . 2010-06-19 17:03 -------- d-----w- c:\arquivos de programas\DVD Photo Slideshow Professional

2010-06-19 17:01 . 2010-06-19 17:01 -------- d-----w- c:\arquivos de programas\Socusoft

2010-06-18 23:43 . 2010-06-18 23:43 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive

2010-06-18 23:43 . 2010-06-18 23:43 -------- d-----w- c:\arquivos de programas\Windows Live

2010-06-18 23:14 . 2009-11-20 19:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys

2010-06-18 22:25 . 2010-06-18 22:25 3584 ----a-r- c:\documents and settings\Administrador\Dados de aplicativos\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2010-06-18 22:25 . 2010-06-18 22:25 -------- d-----w- c:\arquivos de programas\Windows Installer Clean Up

2010-06-18 20:15 . 2010-06-18 20:15 -------- d-----w- c:\windows\system32\wbem\Repository

2010-06-18 17:35 . 2010-06-24 20:10 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\GetRight

2010-06-18 16:15 . 2010-06-18 16:15 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Java

2010-06-17 20:01 . 2010-06-22 16:46 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\QuickScan

2010-06-17 20:01 . 2010-05-31 19:34 702120 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\i51zogxw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

2010-06-17 20:01 . 2010-05-31 19:34 868456 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\i51zogxw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

2010-06-17 16:14 . 2010-06-17 16:14 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\DivX

2010-06-17 14:57 . 2010-06-18 00:19 48620 ---há-w- c:\windows\system32\mlfcache.dat

2010-06-17 14:50 . 2010-06-17 14:50 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Apple Computer

2010-06-17 14:50 . 2010-06-17 14:50 -------- d-----w- c:\arquivos de programas\Safari

2010-06-17 14:50 . 2010-06-17 14:50 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Apple Computer

2010-06-17 14:49 . 2010-06-17 14:49 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Apple

2010-06-17 14:48 . 2010-06-17 14:48 -------- d-----w- c:\arquivos de programas\Apple Software Update

2010-06-17 14:48 . 2010-06-17 14:48 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Apple

2010-06-17 13:46 . 2010-06-17 13:46 0 ----a-w- c:\windows\nsreg.dat

2010-06-16 20:03 . 2010-06-16 20:10 -------- d--h--w- c:\windows\msdownld.tmp

2010-06-16 19:18 . 2010-06-16 19:18 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Uniblue

2010-06-16 16:11 . 2003-06-25 19:05 266360 ----a-w- c:\windows\system32\TweakUI.exe

2010-06-16 13:42 . 2010-06-16 14:39 -------- d-----w- c:\windows\system32\CatRoot_bak

2010-06-13 18:05 . 2010-06-13 18:05 -------- d-----w- c:\windows\ServicePackFiles

2010-06-13 17:35 . 2010-06-13 17:35 -------- d-----w- c:\documents and settings\LocalService\Dados de aplicativos\McAfee

2010-06-11 18:49 . 2010-06-11 18:49 -------- d-sh--w- c:\documents and settings\Convidado\IECompatCache

2010-06-11 18:48 . 2010-06-11 18:48 -------- d-sh--w- c:\documents and settings\Convidado\PrivacIE

2010-06-11 18:10 . 2010-06-11 18:10 -------- d-sh--w- c:\documents and settings\Convidado\IETldCache

2010-06-11 16:52 . 2010-06-11 16:52 -------- d-sh--w- c:\documents and settings\Administrador\IECompatCache

2010-06-11 16:50 . 2010-06-11 16:50 -------- d-sh--w- c:\documents and settings\Administrador\PrivacIE

2010-06-11 16:47 . 2010-06-11 16:47 -------- d-sh--w- c:\documents and settings\Administrador\IETldCache

2010-06-11 16:44 . 2010-06-13 18:25 -------- d-----w- c:\windows\ie8updates

2010-06-11 16:42 . 2010-06-11 16:43 -------- dc-h--w- c:\windows\ie8

2010-06-11 16:38 . 2010-05-06 10:34 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2010-06-11 16:38 . 2010-05-06 10:34 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-06-11 16:37 . 2010-05-06 10:34 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2010-06-11 16:37 . 2010-05-06 10:34 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2010-06-11 16:37 . 2010-05-06 10:34 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2010-06-11 16:37 . 2010-05-06 10:34 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

2010-06-11 16:37 . 2010-05-06 10:34 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll

2010-06-11 16:23 . 2010-04-16 11:43 41984 -c----w- c:\windows\system32\dllcache\iecompat.dll

2010-06-11 01:59 . 2010-06-11 01:59 -------- d-sh--w- c:\documents and settings\Convidado\UserData

2010-06-11 01:56 . 2010-06-24 02:51 -------- d-----w- c:\documents and settings\Convidado\Tracing

2010-06-11 00:25 . 2010-06-11 00:25 -------- d-----w- c:\documents and settings\Convidado\Dados de aplicativos\TuneUp Software

2010-06-10 23:48 . 2010-05-07 20:50 30536 ----a-w- c:\windows\system32\TURegOpt.exe

2010-06-10 23:48 . 2010-05-07 20:45 30024 ----a-w- c:\windows\system32\uxtuneup.dll

2010-06-10 23:47 . 2010-06-10 23:48 -------- d-----w- c:\arquivos de programas\TuneUp Utilities 2010

2010-06-10 23:47 . 2010-06-10 23:47 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\TuneUp Software

2010-06-10 21:08 . 2010-02-16 19:33 2062592 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-06-10 21:07 . 2010-02-16 19:32 2020864 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-06-10 21:07 . 2010-02-16 19:33 2185600 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-06-10 21:07 . 2010-02-16 19:33 2141184 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-06-10 15:05 . 2010-06-10 15:24 -------- d-----w- c:\arquivos de programas\Google

2010-06-08 16:01 . 2010-02-24 12:31 454016 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2010-06-08 15:52 . 2008-06-14 17:59 272384 -c----w- c:\windows\system32\dllcache\bthport.sys

2010-06-08 15:52 . 2008-06-14 17:59 272384 ------w- c:\windows\system32\drivers\bthport.sys

2010-06-08 14:16 . 2010-06-08 14:16 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\TuneUp Software

2010-06-08 14:15 . 2010-06-08 14:15 -------- d-sh--w- c:\documents and settings\All Users\Dados de aplicativos\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

2010-06-08 14:14 . 2010-06-08 14:14 -------- d-----w- c:\arquivos de programas\Speccy

2010-06-08 13:40 . 2010-06-08 13:40 -------- d-----w- c:\arquivos de programas\Defraggler

2010-06-08 13:37 . 2010-06-08 13:37 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Yahoo!

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-06-25 15:17 . 2007-09-07 19:17 44672 ----a-w- c:\windows\system32\drivers\uagp35.sys

2010-06-23 18:33 . 2007-09-07 23:19 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2010-06-22 22:18 . 2008-01-26 14:21 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Media Player Classic

2010-06-22 00:22 . 2007-09-08 00:00 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\Vso

2010-06-19 20:39 . 2009-11-05 14:42 16 ----a-w- c:\windows\msocreg32.dat

2010-06-18 19:20 . 2001-10-28 17:07 68306 ----a-w- c:\windows\system32\perfc016.dat

2010-06-18 19:20 . 2001-10-28 17:07 428330 ----a-w- c:\windows\system32\perfh016.dat

2010-06-17 13:44 . 2009-12-30 14:16 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\MSScanAppDataDir

2010-06-10 16:53 . 2009-12-11 22:07 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Avira

2010-06-08 13:01 . 2010-01-28 14:37 49586 ----a-w- c:\windows\system32\prfc0416.dat

2010-06-08 13:01 . 2010-01-28 14:37 347294 ----a-w- c:\windows\system32\prfh0416.dat

2010-06-07 16:13 . 2010-02-05 14:15 -------- d-----w- c:\arquivos de programas\Malwarebytes' Anti-Malware

2010-05-30 17:18 . 2009-05-25 17:11 -------- d-----w- c:\arquivos de programas\Sweet Home 3D 1.8

2010-05-12 23:40 . 2008-05-07 17:34 -------- d-----w- c:\arquivos de programas\EMULADORES

2010-05-06 10:34 . 2004-08-04 03:45 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 08:26 . 2004-08-04 03:38 1851008 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 18:39 . 2010-02-05 14:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 18:39 . 2010-02-05 14:15 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-20 05:47 . 2004-08-04 03:44 285696 ----a-w- c:\windows\system32\atmfd.dll

2010-04-17 01:12 . 2010-04-17 01:12 48464 ----a-w- c:\windows\system32\sirenacm.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"egui"="c:\arquivos de programas\ESET\ESET Smart Security\egui.exe" [2010-03-24 2145000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MaxRecentDocs"= 10 (0xa)

"NoRecentDocsNetHood"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^Administrador^Menu Iniciar^Programas^Inicializar^desktop.ini]

path=c:\documents and settings\Administrador\Menu Iniciar\Programas\Inicializar\desktop.ini

backup=c:\windows\pss\desktop.iniStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^desktop.ini]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\desktop.ini

backup=c:\windows\pss\desktop.iniCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2007-01-15 19:14 147456 ----a-r- c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]

2004-08-22 20:05 81920 ----a-r- c:\arquivos de programas\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]

2004-08-04 03:45 159744 ----a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2006-01-12 18:40 155648 ----a-r- c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2003-12-08 20:35 32768 ----a-r- c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]

2004-12-28 22:01 544768 ----a-w- c:\windows\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

2006-08-02 21:12 577536 ------w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]

2006-04-11 08:06 176128 ----a-w- c:\windows\system32\VTTrayp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"TuneUp.Defrag"=3 (0x3)

"NBService"=3 (0x3)

"WZCSVC"=2 (0x2)

"UxTuneUp"=2 (0x2)

"TapiSrv"=3 (0x3)

"RDSessMgr"=3 (0x3)

"RasMan"=3 (0x3)

"RasAuto"=3 (0x3)

"mnmsrvc"=3 (0x3)

"ImapiService"=3 (0x3)

"getPlusHelper"=3 (0x3)

"XoftSpyService"=3 (0x3)

"TuneUp.UtilitiesSvc"=2 (0x2)

"ose"=3 (0x3)

"MDM"=2 (0x2)

"gusvc"=3 (0x3)

"gupdate"=2 (0x2)

"rjhnrsqbm"=2 (0x2)

"FastUserSwitchingCompatibility"=3 (0x3)

"helpsvc"=2 (0x2)

"wscsvc"=2 (0x2)

"SharedAccess"=2 (0x2)

"SCardSvr"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Google Update"="c:\documents and settings\Administrador\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"VTTimer"=VTTimer.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Arquivos de programas\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=

"c:\\Arquivos de programas\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\UTorrents (Minha Pasta)\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1277:TCP"= 1277:TCP:*:Disabled:qxfyulz

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [7/9/2007 20:59 155136]

R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [7/9/2007 20:59 5248]

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [24/3/2010 20:31 114984]

R2 ekrn;ESET Service;c:\arquivos de programas\ESET\ESET Smart Security\ekrn.exe [24/3/2010 20:31 810120]

S2 rjhnrsqbm;Support Server;c:\windows\system32\svchost.exe -k netsvcs [4/8/2004 00:45 14336]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\arquivos de programas\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [25/2/2010 11:18 10064]

S3 uti3nzc5;AVZ Kernel Driver;c:\windows\system32\drivers\uti3nzc5.sys [11/12/2009 17:31 7168]

S4 gupdate;Google Update Service (gupdate);"c:\arquivos de programas\Google\Update\GoogleUpdate.exe" /svc --> c:\arquivos de programas\Google\Update\GoogleUpdate.exe [?]

S4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\arquivos de programas\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [7/5/2010 17:48 1051976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Download Link Using Mega Manager... - c:\arquivos de programas\Megaupload\Mega Manager\mm_file.htm

IE: Download with GetRight - c:\arquivos de programas\GetRight\GRdownload.htm

IE: Open with GetRight Browser - c:\arquivos de programas\GetRight\GRbrowse.htm

TCP: {8AD1177A-26EC-45AA-A0C5-1772FE68E6CC} = 172.19.51.1

FF - ProfilePath - c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\i51zogxw.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.br

FF - prefs.js: network.proxy.type - 0

FF - component: c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\i51zogxw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

FF - plugin: c:\arquivos de programas\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\arquivos de programas\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\i51zogxw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

---- FIREFOX POLICIES ----

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORFÃOS REMOVIDOS - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

MSConfigStartUp-swg - c:\arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-06-25 13:27

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x83E11BA8]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf752cfc3

\Driver\ACPI -> ACPI.sys @ 0xf7459cb8

\Driver\atapi -> 0x83e11ba8

IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a18f6

ParseProcedure -> ntoskrnl.exe @ 0x8056f26d

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a18f6

ParseProcedure -> ntoskrnl.exe @ 0x8056f26d

NDIS: VIA Rhine II Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf72e0ba0

PacketIndicateHandler -> NDIS.sys @ 0xf72edb21

SendHandler -> NDIS.sys @ 0xf72cb87b

Warning: possible MBR rootkit infection !

user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\rjhnrsqbm]

"ServiceDll"="c:\windows\system32\hincakl.dll"

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_USERS\S-1-5-21-796845957-115176313-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,49,4c,65,43,56,d8,40,4f,96,08,c2,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,49,4c,65,43,56,d8,40,4f,96,08,c2,\

"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,49,4c,65,43,56,d8,40,4f,96,08,c2,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|þ»Òw*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

Tempo para conclusão: 2010-06-25 13:30:45

ComboFix-quarantined-files.txt 2010-06-25 16:30

Pré-execução: 11 pasta(s) 27.611.176.960 bytes disponíveis

Pós execução: 12 pasta(s) 27.570.814.976 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=6 Default=6 Failed=2 LastKnownGood=7 Sets=1,2,3,4,5,6,7

- - End Of File - - C90B77C83EF9758E1D6B1286E5BEF873

Editado Junho 25, 2010 por bodonchild

bodonchild · Junho 25, 2010

Mais um detalhe...Logo após o procedimento com o ComboFix, fiz um scan automático com o ESET Smart Security, (pois desinstalei o Avira porque não estava atualizando) e havia alguns trojans..Dois deles estavam na pasta que o ComboFix criou..Os outros já estavam na quarentena...

Locais dos vírus:

C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\Av-test.txt - Eicar test file

C:\QooBox\32788R22FWJFW\uagp35.sys - Win32/Olmarik.ZC trojan

C:\Arquivos de programas\EMULADORES\P64\Project64 1.7.0.55E\NRage-Language-1034.dll - Win32/Agent trojan

C:\WINDOWS\system32\drivers\uagp35.sys - Win32/Olmarik.ZC trojan

C:\WINDOWS\system32\drivers\uagp35.sys.tmp - Win32/Olmarik.ZC trojan

E estes, (todos uma variante do Win32/TrojanClicker.Delf.NKC trojan):

C:\WINDOWS\system32\emxqkjn.dll

C:\WINDOWS\system32\ywdlyom.dll

C:\WINDOWS\system32\ttgtdsw.dll

C:\WINDOWS\system32\ceidajv.dll

C:\WINDOWS\system32\nlxylqz.dll

C:\WINDOWS\system32\wedqqhz.dll

C:\WINDOWS\system32\vdutiby.dll

C:\WINDOWS\system32\henaxzk.dll

C:\WINDOWS\system32\vzckwya.dll

C:\WINDOWS\system32\tunmasw.dll

Só que assim que eles eram postos na quarentena,

acho que eles voltavam,porque ocorria um erro no log do antivirus em:

C:\WINDOWS\Temp\xnpg.tmp\svchost.exe.

Espero q isso possa ajudar em algo..

RenatoMejias · Junho 29, 2010

Faça uma nova execução do ComboFix e poste seu logs para análise.

bodonchild · Junho 29, 2010

Havia uma nova versão do ComboFix, e eu atualizei.Novamente o "ComboFix detectou a presença de rootkit e precisou reiniciar o pc".Após o teste, logo que ativei o antivirus, a proteção automatica detectou o "eicar test file" (Av-test.txt), mas este não é um virus é apenas um "teste" para ver se o antivirus reage, certo?Bem, aí esta o log:

ComboFix 10-06-28.01 - Administrador 29/06/2010 11:17:42.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.447.189 [GMT -3:00]

Executando de: c:\documents and settings\Administrador\Desktop\ComboFix.exe

AV: ESET Smart Security 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Avira FireWall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}

FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

* AV residente está ativo

.

(((((((((((((((( Arquivos/Ficheiros criados de 2010-05-28 to 2010-06-29 ))))))))))))))))))))))))))))

.

2010-06-28 17:28 . 2010-06-28 17:30 96 ----a-w- c:\documents and settings\Administrador\Dados de aplicativos\TurboDemo\WRTDX8672.DLL

2010-06-28 17:28 . 2010-06-28 17:30 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\TurboDemo

2010-06-28 00:51 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2010-06-28 00:51 . 2010-02-17 17:07 2194176 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-06-28 00:51 . 2009-03-06 14:20 286208 -c----w- c:\windows\system32\dllcache\pdh.dll

2010-06-28 00:51 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe

2010-06-28 00:51 . 2009-02-09 10:53 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2010-06-28 00:51 . 2009-02-09 10:53 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2010-06-28 00:51 . 2009-02-09 10:53 683520 -c----w- c:\windows\system32\dllcache\advapi32.dll

2010-06-28 00:51 . 2009-02-09 10:53 730624 -c----w- c:\windows\system32\dllcache\ntdll.dll

2010-06-28 00:51 . 2009-02-09 10:53 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2010-06-28 00:51 . 2010-02-16 19:07 2150400 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-06-28 00:51 . 2010-02-16 19:07 2028544 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-06-28 00:06 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys

2010-06-27 23:43 . 2008-06-14 17:34 272384 -c----w- c:\windows\system32\dllcache\bthport.sys

2010-06-27 23:42 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys

2010-06-27 23:39 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2010-06-27 23:36 . 2008-05-09 10:55 180224 -c----w- c:\windows\system32\dllcache\scrobj.dll

2010-06-27 23:36 . 2008-05-09 10:55 90112 -c----w- c:\windows\system32\dllcache\wshext.dll

2010-06-27 23:36 . 2008-05-09 10:55 172032 -c----w- c:\windows\system32\dllcache\scrrun.dll

2010-06-27 23:36 . 2008-05-09 08:45 135168 -c----w- c:\windows\system32\dllcache\cscript.exe

2010-06-27 23:36 . 2008-05-08 11:24 155648 -c----w- c:\windows\system32\dllcache\wscript.exe

2010-06-27 23:36 . 2009-10-15 16:32 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll

2010-06-27 23:36 . 2009-10-15 16:32 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll

2010-06-27 20:21 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2010-06-27 20:11 . 2008-10-15 16:36 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll

2010-06-27 19:49 . 2010-06-27 19:49 -------- d-----w- c:\windows\system32\bits

2010-06-27 19:45 . 2008-04-13 22:20 294912 -c----w- c:\windows\system32\dllcache\dlimport.exe

2010-06-24 02:50 . 2010-06-24 02:50 -------- d-----w- c:\documents and settings\Convidado\Dados de aplicativos\ESET

2010-06-24 00:46 . 2010-06-24 00:49 -------- d-----w- c:\arquivos de programas\UTorrents (Minha Pasta)

2010-06-24 00:40 . 2010-06-28 19:35 -------- d-----w- c:\documents and settings\Administrador\Dados de aplicativos\uTorrent