core.cache.dsk

Question

esse arquivo esta corrompido, fica abrindo pop-up de alguns sites aqui de alguns minutos em minutos ja tentei de tudo e nada dessa ***** sair, segue a baixo o log. valeu!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:14, on 28/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20696)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HiJackThis\HijackThis.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B07047BA-CA74-4407-8F48-D4C56117DE47}: NameServer = 200.165.132.154 200.165.132.148
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 5571 bytes

Answer

Log limpo.

Esse rootkit a&iacute; &eacute; chato pra ****** de remover...

Mas eu acho que instalando o Kaspersky (mesmo que trial) ele remover&aacute; para voc&ecirc;...

De qualquer forma, achei um tutorial bacana (em ingl&ecirc;s). Qual duvida, s&oacute; deixar a&iacute;...

1) Boot into Safe Mode:
http://www.pchell.com/support/safemode.s...
2) Click on Start, Search, and choose All Files and Folders
3) In the all or part of file name box, type the following

core.sys

4) In the Look In box, choose local hard drives and click Search
5) When core.sys is found in the c:\windows\system32\drivers directory, right-click on it and choose Delete
6) Repeat steps 2-5 for the file core.cache.dsk
7) Close the Search box
8) Click on Start, Run and type REGEDIT and press Enter
9) Click on the Plus sign (+) next to HKEY_LOCAL_MACHINE
10) Click the plus next to SYSTEM
11) Click the plus next to CurrentControlSet
12) Click the plus next to Services
13) Find the folder called CORE and right-click on it and choose Delete

*** WARNING *** If the folder CORE does not exist, dont do anything

14) Close the Registry Editor by clicking on the X in the right-hand corner of the window

15) Reboot your computer in Normal mode
16) Once the computer is rebooted, open your web browser and go to Kaspersky Online Scanner by clicking on the link below.

http://www.kaspersky.com/virusscanner

17) Scan your computer and delete any other files flagged as problems.

Your computer should now be free of these vicious popups.

You should also use SUPERantispyware free it works the best
Fonte: http://au.answers.yahoo.com/answers2/frontend.php/question?qid=20080109140651AAi9JNP

Outro tuto parecido, mas com fotos:

Remove Powered by Zedo & URL.cpvfeed.com Popups

Posted by Ajit Gaddam
     November 4, 2007
     
                                    Spyware is computer software that is installed on your computer without your consent and intercepts or takes partial control over your interaction with your computer. Spyware such as Zedo &ldquo;powered by Zedo&rdquo; and URL.cpvfeed.com redirects your browser or opens popups displaying advertising. Zedo and URL.cpvfeed.com spyware also installs the core.sys rootkit resulting in slow internet speeds, different home pages and also loss of internet. In this article on Spyware and Adware removal, I will show you how to remove the Zedo(powered by Zedo) and URL.cpvfeed.com popups and also remove the core.sys rootkit.
 How to Remove &ldquo;Powered by Zedo&rdquo; and URL.cpvfeed.com spyware

Step 1: Download PC Tools Spyware Doctor.
 We will be using this free Anti Spyware tool provided by Google. Google is giving out this amazing Spyware product for free as part of its Google Pack. While the Google Pack has other good software, you can download just the PC Tools Spyware Doctor. Click here to    Get essential software with Google Pack. including the AntiSpyware software we need to remove the Zero and URL.cpvfeed spyware software.
 Step 2: Disable System restore on your computer.
 On the Desktop, right click My Computer. Click Properties. Click the System Restore Tab.  Check Turn off System Restore. Click Apply and OK. When prompted to restart your computer, Restart and Boot into Safe mode.
 https://www.hardware.com.br/static/c/m/3fffd34afc971e101976dd222171011b
 Step 3: Boot into Safe Mode instead of booting normally into Windows.
 Step 4: Search for core.sys.
 Click on Start and then Search and type core.sys. If the search results return any core.sys results, delete them. Again, in Search, type core.cache.dsk. If you find core.cache.dsk instances, remove them too.
 Step 5: Clean the Registry.
 Press  + R which will open the run command. Now type in regedit.  Under HKEY_LOCAL_MACHINE,  click the plus sign(+) . Here you will see CurrentControlSet and in some cases, CurrentControlSet1 and also CurrentControlSet2.
 Under each one of the CurrentControlSets, click the plus sign(+) next to Service. Scroll down and there will be a folder called CORE. Right click on the folder and Delete it. Do the same for any remaining CurrentControlSets.
 https://www.hardware.com.br/static/c/m/429922299704b8275987c6f52ea23298
 Step 6: Run Spyware Scan to remove the Zero and URL.cpvfeed.com popups
  First reboot your computer and log into Windows in the Normal mode. Now, open your PC Tools Spyware Doctor. If you did not download the free AntiSpyware software provided by Google, click here to    Get essential software with Google Pack.
 Under the PC Tools Spyware Doctor, run a complete system scan for spyware and adware removal. You have successfully removed Zero and URL.cpvfeed.com popups and core.sys rootkit.
 
https://www.hardware.com.br/static/c/m/7328e95cf76598f0aea7343ed1eebc12
Fonte: http://www.root777.com/spyware/remove-powered-by-zedo-urlcpvfeedcom-popups/

Answer

HaoYunng

S&oacute; duas perguntinhas...esse Windows &eacute; novo?

Voc&ecirc; comprou o PC com ele instalado?

Answer

nao comprei o pc com ele instalado nao, e &eacute; novo sim pq?

Answer

&Eacute; porque h&aacute; um crack nele.

Veja se a dica do apterix resolve. Se n&atilde;o, s&oacute; com Combofix.

Answer

como assim ?

Answer

http://www.bleepingcomputer.com/startups/antiwpa.dll-21379.html

O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll

Answer

tentei tudo que podia , dos 2 passos mais nenhum deu certo, ainda baixei o superantispyware o arquivo sempre volta

Answer

*Baixe o programa do link e salve-o no Desktop 
    http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
    *Anote ou imprima todo o procedimento
    *Desative temporariamente seu antiv&iacute;rus, anti-spyware e firewall
    *Feche o Internet Explorer e o Windows Explorer
    *Duplo-clique no arquivo combofix.exe e tecle 1 > ENTER. Pode demorar...
    *[COLOR=Red]Enquanto estiver em execu&ccedil;&atilde;o, n&atilde;o clique na janela do ComboFix, nem o feche clicando no X, n&atilde;o mova o mouse e n&atilde;o use o teclado, sen&atilde;o ir&aacute; parar e seu desktop ficar&aacute; em branco!![/COLOR]
    *O ComboFix poder&aacute; reiniciar o PC automaticamente
    *Para parar ou sair do ComboFix, tecle N > ENTER
    *Cole o resultado criado em C:\ComboFix.txt junto com novo log do hijack

Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:32:47, on 30/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20696)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\HiJackThis\HijackThis.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B07047BA-CA74-4407-8F48-D4C56117DE47}: NameServer = 200.165.132.154 200.165.132.148
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel&reg; Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 5736 bytes






ComboFix 08-01-30.1 - Anubis 2008-01-29 21:26:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.715 [GMT -2:00]
Running from: C:\Documents and Settings\Anubis.THOR-0CDDA29C69\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-30 )))))))))))))))))))))))))))))))
.

2008-01-29 20:42 . 2008-01-29 20:42 104,130 --a------ C:\untitled222.JPG
2008-01-29 20:20 . 2008-01-29 20:20  d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-01-29 20:19 . 2008-01-29 20:52  d-------- C:\Program Files\SUPERAntiSpyware
2008-01-29 20:19 . 2008-01-29 20:19  d-------- C:\Documents and Settings\Anubis.THOR-0CDDA29C69\Application Data\SUPERAntiSpyware.com
2008-01-29 20:17 . 2008-01-29 20:17 100 --a------ C:\WINDOWS\system32\ikhcore.cfg
2008-01-29 19:43 . 2008-01-29 20:50 167,545 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-29 19:11 . 2008-01-29 19:41  d-------- C:\Program Files\Spyware Doctor
2008-01-29 19:11 . 2008-01-29 19:11  d-------- C:\Documents and Settings\Anubis.THOR-0CDDA29C69\Application Data\PC Tools
2008-01-29 19:11 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-29 19:11 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-29 19:11 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-29 19:11 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-01-29 18:43 . 2008-01-29 18:43  d--h----- C:\WINDOWS\PIF
2008-01-29 15:51 . 2008-01-29 15:51 91,492 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-01-29 15:51 . 2008-01-29 15:51 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-01-29 15:50 . 2008-01-29 15:50  d-------- C:\Program Files\Kaspersky Lab
2008-01-29 15:50 . 2008-01-30 21:28 1,673,760 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-29 15:50 . 2008-01-30 21:28 14,852 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-29 15:50 . 2008-01-30 21:30 9,760 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-29 15:50 . 2008-01-30 21:28 1,940 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-29 15:43 . 2008-01-29 15:43  d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2008-01-29 11:57 . 2008-01-29 11:57  d-------- C:\WINDOWS\system32\%BlstFolder%
2008-01-29 11:32 . 2008-01-29 20:18  d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-01-28 22:46 . 2008-01-29 03:33 704 --a------ C:\WINDOWS\system32	mp.reg
2008-01-28 22:45 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-28 22:45 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-28 22:45 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-28 22:45 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-28 22:45 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-28 22:45 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-28 22:22 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-28 22:21 . 2008-01-28 22:22  d-------- C:\Program Files\Java
2008-01-28 21:30 . 2007-07-01 01:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-28 21:30 . 2007-07-01 01:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-28 21:30 . 2007-10-10 21:47 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-28 21:30 . 2007-10-10 21:47 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-28 21:30 . 2007-10-10 21:47 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-28 21:30 . 2007-10-10 21:47 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-28 21:30 . 2007-10-10 21:47 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-28 21:30 . 2007-10-10 06:16 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-28 21:29 . 2007-10-10 21:47 6,067,200 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-28 20:41 . 2008-01-28 20:41  d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-28 20:41 . 2008-01-30 21:30  d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-01-28 20:37 . 2008-01-28 20:37  d-------- C:\Program Files\Panda Antivirus 2008
2008-01-28 19:03 . 2008-01-28 19:03  d-------- C:\WINDOWS\ERUNT
2008-01-28 18:55 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-28 18:54 . 2008-01-28 21:32  d--h----- C:\WINDOWS\$hf_mig$
2008-01-28 18:47 . 2008-01-28 18:49 15,452,536 --a------ C:\Program Files\IE7-WindowsXP-x86-enu.exe
2008-01-28 18:45 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-28 18:44 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\vyhtuobrxcev.sys
2008-01-28 18:38 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\uofhhpfmyxui.sys
2008-01-28 18:17 . 2008-01-28 20:33  d-------- C:\WINDOWS\system32\ActiveScan
2008-01-28 18:17 . 2008-01-28 20:05 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-28 18:17 . 2008-01-28 20:05 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-28 18:17 . 2008-01-28 20:05 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-28 16:54 . 2008-01-28 17:41  d-------- C:\WINDOWS\BDOSCAN8
2008-01-28 13:52 . 2008-01-28 13:52  d-------- C:\Program Files\IObit
2008-01-27 22:58 . 2008-01-27 23:02  d-------- C:\Program Files\SpywareBlaster
2008-01-27 22:58 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-01-27 22:53 . 2008-01-27 22:53  d-------- C:\Documents and Settings\Anubis.THOR-0CDDA29C69\Application Data\Grisoft
2008-01-27 22:52 . 2008-01-27 22:52  d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-01-27 22:52 . 2007-05-30 10:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-27 22:27 . 2005-01-14 01:41 11,254 --a------ C:\WINDOWS\system32\locate.com
2008-01-27 22:06 . 2008-01-27 22:06 24,295 --a------ C:\attachment.htm
2008-01-27 21:26 . 2008-01-27 21:26  d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg7
2008-01-27 17:03 . 2008-01-27 17:03  d-------- C:\Documents and Settings\Administrator.THOR-0CDDA29C69\Application Data\TuneUp Software
2008-01-27 16:03 . 2008-01-27 17:19  d-------- C:\Program Files\Common Files\Symantec Shared
2008-01-27 16:03 . 2008-01-27 17:18  d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-01-27 13:58 . 2008-01-27 14:19  d-------- C:\Program Files\Sword of The New World
2008-01-27 13:40 . 2008-01-27 13:40 752,640 --a------ C:\shmok.pps
2008-01-27 13:38 . 2008-01-27 13:38 505,344 --a------ C:\ESTOSIESUNTATOO_1_.pps
2008-01-26 21:36 . 2008-01-26 21:36 399,360 --a------ C:\OQUEMAISFALTAINVENTAR.pps
2008-01-25 17:14 . 2008-01-25 17:14 143,472 --a------ C:\untitled.JPG
2008-01-25 13:26 . 2008-01-25 13:26  d-------- C:\Documents and Settings\Anubis.THOR-0CDDA29C69\Application Data\ImgBurn
2008-01-25 13:24 . 2008-01-25 13:25  d-------- C:\Program Files\ImgBurn
2008-01-25 13:15 . 2004-08-04 00:56 116,224 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-01-25 13:15 . 2001-08-17 22:37 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2008-01-25 13:15 . 2001-08-17 22:36 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2008-01-25 13:15 . 2001-08-17 22:36 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2008-01-25 13:15 . 2001-08-17 22:37 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2008-01-25 13:13 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-01-25 13:12 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys
2008-01-25 13:11 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache2mdkxga.sys
2008-01-25 13:10 . 2005-03-25 22:42 363,520 --a--c--- C:\WINDOWS\system32\dllcache\psisdecd.dll
2008-01-25 13:07 . 2001-08-17 14:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys
2008-01-25 13:06 . 2007-07-19 11:40 2,062,336 --a--c--- C:\WINDOWS\system32\dllcache
tkrnlpa.exe
2008-01-25 13:05 . 2001-08-17 13:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-01-25 13:04 . 2004-08-04 00:56 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll
2008-01-25 13:03 . 2001-08-17 14:56 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-01-25 13:02 . 2001-08-17 12:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-01-25 13:01 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-01-25 13:00 . 2004-08-04 00:56 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2008-01-25 12:59 . 2001-08-17 13:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-01-25 12:58 . 2007-07-19 14:01 2,185,472 --a--c--- C:\WINDOWS\system32\dllcache
toskrnl.exe
2008-01-25 12:58 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-01-25 00:24 . 2008-01-28 01:05 293 --a------ C:\WINDOWS\wininit.ini
2008-01-24 23:15 . 2005-09-19 09:38 65,536 --a------ C:\WINDOWS\system32azer.cpl
2008-01-24 18:39 . 2008-01-24 18:46 5,052,430 --a------ C:\XnView-win.exe
2008-01-22 13:46 . 2002-08-23 14:31 49,152 --------- C:\WINDOWS\system32\enclss32.dll
2008-01-22 13:27 . 2004-04-10 23:24 29,074 --a------ C:\WINDOWS\system32\drivers\glauiad.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 03:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 04:15 360,704 ----a-w C:\WINDOWS\system32\drivers	cpip.sys
2008-01-16 16:51 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-01-16 05:21 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-14 17:51 --------- d-----w C:\Program Files\Intel
2008-01-14 17:42 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-14 17:39 --------- d--h--w C:\Program Files\Uninstall Information
2008-01-03 17:50 991,744 ----a-w C:\WINDOWS\system32\drmv2clt.dll
2008-01-03 17:50 99,840 ----a-w C:\WINDOWS\system32\wmpshell.dll
2008-01-03 17:50 95,344 ----a-w C:\WINDOWS\system32\wudfcoinstaller.dll
2008-01-03 17:50 937,984 ----a-w C:\WINDOWS\system32\wmnetmgr.dll
2008-01-03 17:50 82,944 ----a-w C:\WINDOWS\system32\drivers\wudfrd.sys
2008-01-03 17:50 8,231,936 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-01-03 17:50 77,568 ----a-w C:\WINDOWS\system32\drivers\wudfpf.sys
2008-01-03 17:50 757,248 ----a-w C:\WINDOWS\system32\wmadmod.dll
2008-01-03 17:50 7,168 ----a-w C:\WINDOWS\system32\asferror.dll
2008-01-03 17:50 603,648 ----a-w C:\WINDOWS\system32\wmspdmod.dll
2008-01-03 17:50 55,808 ----a-w C:\WINDOWS\system32\wudfsvc.dll
2008-01-03 17:50 542,720 ----a-w C:\WINDOWS\system32\blackbox.dll
2008-01-03 17:50 414,720 ----a-w C:\WINDOWS\system32\msscp.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\wmvdmod.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\wmsdmod.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\mpg4dmod.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\mp4sdmod.dll
2008-01-03 17:50 4,096 ----a-w C:\WINDOWS\system32\mp43dmod.dll
2008-01-03 17:50 38,528 ----a-w C:\WINDOWS\system32\drivers\wpdusb.sys
2008-01-03 17:50 38,400 ----a-w C:\WINDOWS\system32\wpdshextres.dll
2008-01-03 17:50 37,376 ----a-w C:\WINDOWS\system32\wmdmps.dll
2008-01-03 17:50 356,352 ----a-w C:\WINDOWS\system32\WPDSp.dll
2008-01-03 17:50 33,792 ----a-w C:\WINDOWS\system32\wmdmlog.dll
2008-01-03 17:50 321,536 ----a-w C:\WINDOWS\system32\mswmdm.dll
2008-01-03 17:50 316,416 ----a-w C:\WINDOWS\system32\wudfx.dll
2008-01-03 17:50 314,880 ----a-w C:\WINDOWS\system32\wmpdxm.dll
2008-01-03 17:50 27,136 ----a-w C:\WINDOWS\system32\mspmsnsv.dll
2008-01-03 17:50 242,688 ----a-w C:\WINDOWS\system32\wmpasf.dll
2008-01-03 17:50 229,376 ----a-w C:\WINDOWS\system32\cewmdm.dll
2008-01-03 17:50 227,328 ----a-w C:\WINDOWS\system32\wmerror.dll
2008-01-03 17:50 222,208 ----a-w C:\WINDOWS\system32\wmasf.dll
2008-01-03 17:50 211,456 ----a-w C:\WINDOWS\system32\qasf.dll
2008-01-03 17:50 2,603,008 ----a-w C:\WINDOWS\system32\wpdshext.dll
2008-01-03 17:50 179,712 ----a-w C:\WINDOWS\system32\msnetobj.dll
2008-01-03 17:50 175,616 ----a-w C:\WINDOWS\system32\mspmsp.dll
2008-01-03 17:50 17,408 ----a-w C:\WINDOWS\system32\wpdshextautoplay.exe
2008-01-03 17:50 165,376 ----a-w C:\WINDOWS\system32\wudfplatform.dll
2008-01-03 17:50 157,184 ----a-w C:\WINDOWS\system32\wmidx.dll
2008-01-03 17:50 146,432 ----a-w C:\WINDOWS\system32\wudfhost.exe
2008-01-03 17:50 133,632 ----a-w C:\WINDOWS\system32\wpdshserviceobj.dll
2008-01-03 17:50 11,264 ----a-w C:\WINDOWS\system32\laprxy.dll
2008-01-03 17:50 100,864 ----a-w C:\WINDOWS\system32\logagent.exe
2008-01-03 17:50 1,329,152 ----a-w C:\WINDOWS\system32\wmspdmoe.dll
2008-01-03 17:50 1,117,696 ----a-w C:\WINDOWS\system32\wmadmoe.dll
2008-01-03 17:49 8,704 ----a-w C:\WINDOWS\system32\wdfmgr.exe
2008-01-03 17:49 8,704 ----a-w C:\WINDOWS\system32\uWDF.exe
2008-01-03 17:49 767,488 ----a-w C:\WINDOWS\system32\wmvsencd.dll
2008-01-03 17:49 656,896 ----a-w C:\WINDOWS\system32\wmvxencd.dll
2008-01-03 17:49 63,488 ----a-w C:\WINDOWS\system32\wpdmtpus.dll
2008-01-03 17:49 629,760 ----a-w C:\WINDOWS\system32\wpd_ci.dll
2008-01-03 17:49 613,376 ----a-w C:\WINDOWS\system32\wmpmde.dll
2008-01-03 17:49 534,528 ----a-w C:\WINDOWS\system32\wmdrmsdk.dll
2008-01-03 17:49 429,056 ----a-w C:\WINDOWS\system32\wmdrmdev.dll
2008-01-03 17:49 4,096 ----a-w C:\WINDOWS\system32\wmvadve.dll
2008-01-03 17:49 4,096 ----a-w C:\WINDOWS\system32\wmvadvd.dll
2008-01-03 17:49 4,096 ----a-w C:\WINDOWS\system32\wdfapi.dll
2008-01-03 17:49 35,840 ----a-w C:\WINDOWS\system32\wpdconns.dll
2008-01-03 17:49 348,672 ----a-w C:\WINDOWS\system32\wmdrmnet.dll
2008-01-03 17:49 317,440 ----a-w C:\WINDOWS\system32\mp4sdecd.dll
2008-01-03 17:49 312,128 ----a-w C:\WINDOWS\system32\msdelta.dll
2008-01-03 17:49 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
2008-01-03 17:49 284,160 ----a-w C:\WINDOWS\system32\portabledeviceapi.dll
2008-01-03 17:49 276,992 ----a-w C:\WINDOWS\system32\audiodev.dll
2008-01-03 17:49 259,072 ----a-w C:\WINDOWS\system32\mpg4decd.dll
2008-01-03 17:49 259,072 ----a-w C:\WINDOWS\system32\mp43decd.dll
2008-01-03 17:49 249,856 ----a-w C:\WINDOWS\system32\drmupgds.exe
2008-01-03 17:49 212,992 ----a-w C:\WINDOWS\system32\mfplat.dll
2008-01-03 17:49 204,288 ----a-w C:\WINDOWS\system32\wmpsrcwp.dll
2008-01-03 17:49 199,168 ----a-w C:\WINDOWS\system32\portabledevicewmdrm.dll
2008-01-03 17:49 166,912 ----a-w C:\WINDOWS\system32\portabledevicetypes.dll
2008-01-03 17:49 154,624 ----a-w C:\WINDOWS\system32\wpdmtp.dll
2008-01-03 17:49 132,096 ----a-w C:\WINDOWS\system32\portabledevicewiacompat.dll
2008-01-03 17:49 130,048 ----a-w C:\WINDOWS\system32\wmpps.dll
2008-01-03 17:49 101,888 ----a-w C:\WINDOWS\system32\portabledeviceclassextension.dll
2008-01-03 17:49 1,574,912 ----a-w C:\WINDOWS\system32\wmvencod.dll
2008-01-03 17:49 1,543,680 ----a-w C:\WINDOWS\system32\wmvdecod.dll
2008-01-03 17:49 1,382,912 ----a-w C:\WINDOWS\system32\wmvsdecd.dll
2008-01-03 17:35 86,073 ----a-w C:\WINDOWS\system32\usrfaxa.dll
2008-01-03 17:35 80,128 ----a-w C:\WINDOWS\system32\drivers\parport.sys
2008-01-03 17:35 8,192 ----a-w C:\WINDOWS\system32	sbyuv.dll
2008-01-03 17:35 8,192 ----a-w C:\WINDOWS\system32\streamci.dll
2008-01-03 17:35 77,891 ----a-w C:\WINDOWS\system32\usrmlnka.exe
2008-01-03 17:35 77,890 ----a-w C:\WINDOWS\system32\usrdpa.dll
2008-01-03 17:35 77,883 ----a-w C:\WINDOWS\system32\usrrtosa.dll
2008-01-03 17:35 72,192 ----a-w C:\WINDOWS\system32\sprio800.dll
2008-01-03 17:35 70,656 ----a-w C:\WINDOWS\system32\sprio600.dll
2008-01-03 17:35 69,700 ----a-w C:\WINDOWS\system32\usrshuta.exe
2008-01-03 17:35 69,699 ----a-w C:\WINDOWS\system32\usrcoina.dll
2008-01-03 17:35 69,632 ----a-w C:\WINDOWS\system32\spnike.dll
2008-01-03 17:35 63,744 ----a-w C:\WINDOWS\system32\drivers\mf.sys
2008-01-03 17:35 61,824 ----a-w C:\WINDOWS\system32\drivers
ic1394.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 10:00 15360]
SUPERAntiSpyware=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2007-06-21 14:06 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NvCplDaemon=C:\WINDOWS\system32\NvCpl.dll [2007-12-04 19:11 8523776]
SunJavaUpdateSched=C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe [2007-12-14 03:42 144784]
AVP=C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe [2007-12-18 00:43 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE=C:\WINDOWS\system32\CTFMON.EXE [2004-08-04 10:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
NoResolveSearch= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Antiwpa]
antiwpa.dll 2006-07-22 20:49 5376 C:\WINDOWS\system32\antiwpa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-09-23 10:10 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 2007-12-18 00:43 227856 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
--a------ 2007-12-10 14:53 1103752 C:\Program Files\Spyware Doctor\pctsTray.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversionun-]
AlcoholAutomount=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe /automount
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-]
!AVG Anti-Spyware=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\_avgas.exe /minimized
Advanced WindowsCare V2 Pro=C:\Program Files\IObit\Advanced WindowsCare V2 Pro\Awc.exe /startup
PRONoMgr.exe=C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
SunJavaUpdateSched=C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
nwiz=nwiz.exe /install
razer=C:\Program Files\Razer_Pro_Solutionsazerhid.exe
SoundMan=SOUNDMAN.EXE

R1 nwlnkfwdd;nwlnkfwdd;C:\WINDOWS\system32\drivers
wlnkfwdd.sys [2008-01-17 16:26]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 10:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
R3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2005-04-24 22:43]
S3 glauiad;D-Link DSL-502G Router;C:\WINDOWS\system32\DRIVERS\glauiad.sys [2004-04-10 23:24]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers
pf.sys [2005-08-02 19:10]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-17 03:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
2008-01-29 18:30:03 C:\WINDOWS\Tasks\Advanced WindowsCare V2 Pro.job
- C:\Program Files\IObit\Advanced WindowsCare V2 Pro\AutoCare.exe
2008-01-28 22:00:12 C:\WINDOWS\Tasks\AwcProUpdate.job
- C:\Program Files\IObit\Advanced WindowsCare V2 Pro\AutoUpdate.ex
- C:\Program Files\IObit\Advanced WindowsCare V2 Pro\.Anubis
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-30 21:30:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Stardock\Object Desktop\WindowBlinds	ray.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
.
**************************************************************************
.
Completion time: 2008-01-30 21:32:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-30 23:32:20

Answer

Por favor...

*V&aacute; em Iniciar > Painel de Controle > Apar&ecirc;ncia e Personaliza&ccedil;&atilde;o > Op&ccedil;&otilde;es de Pasta > Exibir > Configura&ccedil;&otilde;es avan&ccedil;adas > Mostrar pastas e arquivos ocultos > OK

Envie o arquivo para an&aacute;lise em http://www.virustotal.com
C:\WINDOWS\system32\drivers
wlnkfwdd.sys

Ap&oacute;s isto daremos continuidade ao procedimento.

Answer

era esse o arquivo mesmo, ja fiz o procedimento gra&ccedil;as a um expert ne um outro forum, parece que meu problema foi solucionado FINALMENTE, mais muito obrigado pela ajuda de vcs ^^

Ferramentas

Mover Tópico