Wings
Cyber Highlander
Registrado
20.3K Mensagens
1.2K Curtidas
Desative seu antivírus
Clique com o botão direito do mouse no ícone do Avira ao lado do relógio
Clique na opção "Antivir Guard enable".
*Baixe o RSIT e salve-o no desktop
*Execute o RSIT e clique [Continue]
*Cole o relatório C:\rsit\log.txt
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
Logfile of random's system information tool 1.08 (written by random/random)
Run by PaPaInOeL- at 2010-10-21 13:39:19
Microsoft Windows XP Professional Service Pack 3
System drive C: has 52 GB (93%) free of 56 GB
Total RAM: 1471 MB (74% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:39:33, on 21/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\PaPaInOeL-\Desktop\RSIT.exe
C:\Arquivos de programas\trend micro\PaPaInOeL-.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C6DF834-2B4A-411B-B944-52CD8D9F9315}: NameServer = 201.10.128.3 201.10.1.2
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
--
End of file - 3175 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll [2010-10-21 501120]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"=C:\WINDOWS\system32\VTTimer.exe [2005-03-08 135168]
"VTTrayp"=C:\WINDOWS\system32\VTtrayp.exe [2005-11-01 241664]
"SunJavaUpdateSched"=C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe [2010-10-21 140672]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\programas\wirar37br\wrar371br.exe"="D:\programas\wirar37br\wrar371br.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\WINDOWS\system32\VModes.exe"="C:\WINDOWS\system32\VModes.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\VTTimer.exe"="C:\WINDOWS\system32\VTTimer.exe:*:Enabled:ipsec"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
======List of files/folders created in the last 1 months======
2010-10-21 13:39:19 ----D---- C:\rsit
2010-10-21 13:39:19 ----D---- C:\Arquivos de programas\trend micro
2010-10-21 13:39:05 ----A---- C:\WINDOWS\system32\javaws.exe
2010-10-21 13:39:05 ----A---- C:\WINDOWS\system32\javaw.exe
2010-10-21 13:39:05 ----A---- C:\WINDOWS\system32\java.exe
2010-10-21 13:38:27 ----D---- C:\Arquivos de programas\Java
2010-10-21 13:38:23 ----D---- C:\Arquivos de programas\Arquivos comuns\Java
2010-10-21 13:38:10 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Sun
2010-10-21 13:37:17 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\teamspeak2
2010-10-21 13:37:09 ----D---- C:\Arquivos de programas\Teamspeak2_RC2
2010-10-21 13:28:49 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-10-21 13:27:38 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Mozilla
2010-10-21 13:27:33 ----D---- C:\Arquivos de programas\Mozilla Firefox
2010-10-21 13:26:05 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2010-10-21 13:26:05 ----A---- C:\WINDOWS\system32\pndx5032.dll
2010-10-21 13:26:05 ----A---- C:\WINDOWS\system32\pndx5016.dll
2010-10-21 13:26:04 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Real
2010-10-21 13:26:04 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Real
2010-10-21 13:26:04 ----D---- C:\Arquivos de programas\Real Alternative
2010-10-21 13:26:04 ----A---- C:\WINDOWS\system32\msvcr71.dll
2010-10-21 13:26:04 ----A---- C:\WINDOWS\system32\msvcp71.dll
2010-10-21 13:22:58 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-10-21 13:22:58 ----D---- C:\WINDOWS\LastGood
2010-10-21 13:22:52 ----D---- C:\WINDOWS\vnDrvBas
2010-10-21 13:22:52 ----A---- C:\WINDOWS\system32\vuins32.dll
2010-10-21 13:22:52 ----A---- C:\WINDOWS\system32\drivers\fetnd5bv.sys
2010-10-21 13:22:52 ----A---- C:\WINDOWS\system32\difxapi.dll
2010-10-21 13:21:01 ----A---- C:\WINDOWS\RtlRack.ini
2010-10-21 13:19:35 ----D---- C:\Arquivos de programas\S3
2010-10-21 13:18:06 ----D---- C:\Arquivos de programas\WinRAR
2010-10-21 13:16:21 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Identities
2010-10-21 13:16:19 ----HD---- C:\Arquivos de programas\Uninstall Information
2010-10-21 13:16:12 ----SD---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Microsoft
2010-10-21 13:16:12 ----ASH---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\desktop.ini
2010-10-21 13:14:57 ----D---- C:\WINDOWS\SoftwareDistribution
2010-10-21 13:14:56 ----D---- C:\WINDOWS\Prefetch
2010-10-21 13:14:55 ----SD---- C:\WINDOWS\system32\Microsoft
2010-10-21 13:14:55 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-10-21 13:05:02 ----D---- C:\WINDOWS\system32\xircom
2010-10-21 13:05:02 ----D---- C:\Arquivos de programas\xerox
2010-10-21 13:05:02 ----D---- C:\Arquivos de programas\microsoft frontpage
2010-10-21 13:04:40 ----RASH---- C:\MSDOS.SYS
2010-10-21 13:04:40 ----RASH---- C:\IO.SYS
2010-10-21 13:04:40 ----A---- C:\WINDOWS\control.ini
2010-10-21 13:04:40 ----A---- C:\CONFIG.SYS
2010-10-21 13:04:40 ----A---- C:\AUTOEXEC.BAT
2010-10-21 13:04:23 ----A---- C:\WINDOWS\OEWABLog.txt
2010-10-21 13:04:19 ----A---- C:\WINDOWS\system32\mapi32.dll
2010-10-21 13:03:20 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-10-21 13:03:20 ----RD---- C:\WINDOWS\Offline Web Pages
2010-10-21 13:03:20 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2010-10-21 13:03:12 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2010-10-21 13:03:07 ----HD---- C:\Arquivos de programas\WindowsUpdate
2010-10-21 13:03:03 ----D---- C:\Arquivos de programas\Serviços on-line
2010-10-21 13:02:45 ----D---- C:\WINDOWS\system32\DirectX
2010-10-21 13:02:39 ----A---- C:\WINDOWS\system32\atrace.dll
2010-10-21 13:02:37 ----A---- C:\WINDOWS\system32\desktop.ini
2010-10-21 13:02:36 ----A---- C:\WINDOWS\desktop.ini
2010-10-21 13:02:29 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2010-10-21 13:02:28 ----D---- C:\Arquivos de programas\Arquivos comuns\Serviços
2010-10-21 13:02:28 ----A---- C:\WINDOWS\system32\acctres.dll
2010-10-21 13:02:25 ----SD---- C:\WINDOWS\Tasks
2010-10-21 13:02:25 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2010-10-21 13:02:24 ----D---- C:\Arquivos de programas\Arquivos comuns\MSSoap
2010-10-21 13:02:20 ----D---- C:\WINDOWS\srchasst
2010-10-21 13:02:19 ----D---- C:\WINDOWS\system32\Macromed
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuweb.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wups.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wucltui.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauserv.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuaueng.dll.wusetup.425750.bak
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuaueng.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuaucpl.cpl.wusetup.425640.bak
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauclt.exe.wusetup.425593.bak
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauclt.exe
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\wuapi.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\qmgr.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2010-10-21 13:02:10 ----D---- C:\Arquivos de programas\Movie Maker
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\safrslv.dll
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\safrdm.dll
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\racpldlg.dll
2010-10-21 13:01:47 ----D---- C:\WINDOWS\system32\Restore
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\srsvc.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\srrstr.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\srclient.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\fltMc.exe
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\fltlib.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\mnmdd.dll
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\ils.dll
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\drivers\sr.sys
2010-10-21 13:01:45 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2010-10-21 13:01:45 ----A---- C:\WINDOWS\system32\msconf.dll
2010-10-21 13:01:45 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2010-10-21 13:01:42 ----D---- C:\Arquivos de programas\NetMeeting
2010-10-21 13:01:42 ----A---- C:\WINDOWS\system32\msoert2.dll
2010-10-21 13:01:42 ----A---- C:\WINDOWS\system32\msoeacct.dll
2010-10-21 13:01:41 ----A---- C:\WINDOWS\system32\inetres.dll
2010-10-21 13:01:41 ----A---- C:\WINDOWS\system32\inetcomm.dll
2010-10-21 13:01:39 ----D---- C:\Arquivos de programas\Outlook Express
2010-10-21 13:01:39 ----A---- C:\WINDOWS\system32\schedsvc.dll
2010-10-21 13:01:39 ----A---- C:\WINDOWS\system32\mstinit.exe
2010-10-21 13:01:39 ----A---- C:\WINDOWS\system32\mstask.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\isign32.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\inetcfg.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\icwphbk.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\icwdial.dll
2010-10-21 13:01:32 ----D---- C:\Arquivos de programas\Arquivos comuns\System
2010-10-21 13:01:30 ----D---- C:\Arquivos de programas\Internet Explorer
2010-10-21 13:00:45 ----D---- C:\Arquivos de programas\ComPlus Applications
2010-10-21 13:00:43 ----A---- C:\WINDOWS\vbaddin.ini
2010-10-21 13:00:43 ----A---- C:\WINDOWS\vb.ini
2010-10-21 13:00:38 ----D---- C:\WINDOWS\Registration
2010-10-21 13:00:30 ----D---- C:\Arquivos de programas\Windows Media Player
2010-10-21 13:00:23 ----D---- C:\Arquivos de programas\Messenger
2010-10-21 13:00:19 ----D---- C:\Arquivos de programas\MSN Gaming Zone
2010-10-21 13:00:19 ----A---- C:\WINDOWS\system32\write.exe
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\sndvol32.exe
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\hticons.dll
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\avwav.dll
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\avtapi.dll
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\avmeter.dll
2010-10-21 13:00:08 ----A---- C:\WINDOWS\system32\winchat.exe
2010-10-21 13:00:01 ----A---- C:\WINDOWS\system32\getuname.dll
2010-10-21 13:00:01 ----A---- C:\WINDOWS\system32\charmap.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\winmine.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\sol.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\mshearts.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\calc.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tslabels.ini
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tskill.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tscon.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\shadow.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\rwinsta.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\reset.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\freecell.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\regini.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\qwinsta.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\qappsrv.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\msg.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\logoff.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\cdmodem.dll
2010-10-21 12:59:51 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\sndrec32.exe
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\mplay32.exe
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\hypertrm.dll
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\accwiz.exe
2010-10-21 12:59:49 ----D---- C:\Arquivos de programas\Windows NT
2010-10-21 12:59:49 ----A---- C:\WINDOWS\system32\mspaint.exe
2010-10-21 12:59:49 ----A---- C:\WINDOWS\system32\clipbrd.exe
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\spider.exe
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\tsgqec.dll
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\aaclient.dll
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\remotepg.dll
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\mstscax.dll
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\mstsc.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\termsrv.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\sessmgr.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdshost.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdpclip.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdchost.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\qprocess.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\icaapi.dll
2010-10-21 12:59:44 ----D---- C:\WINDOWS\system32\MsDtc
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\mtxoci.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\msdtctm.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2010-10-21 12:59:43 ----A---- C:\WINDOWS\system32\xolehlp.dll
2010-10-21 12:59:43 ----A---- C:\WINDOWS\system32\msdtclog.dll
2010-10-21 12:59:43 ----A---- C:\WINDOWS\system32\msdtc.exe
2010-10-21 12:59:42 ----D---- C:\WINDOWS\system32\Com
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\mtxex.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\mtxdm.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\comrepl.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\comaddin.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\colbact.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\stclient.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\clbcatex.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\catsrvut.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\catsrvps.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\catsrv.dll
2010-10-21 12:59:39 ----A---- C:\WINDOWS\system32\comuid.dll
2010-10-21 12:59:39 ----A---- C:\WINDOWS\system32\comsvcs.dll
2010-10-21 12:59:38 ----A---- C:\WINDOWS\system32\comsnap.dll
2010-10-21 12:59:38 ----A---- C:\WINDOWS\system32\clbcatq.dll
2010-10-21 12:59:31 ----A---- C:\WINDOWS\system32\servdeps.dll
2010-10-21 12:59:30 ----A---- C:\WINDOWS\system32\mmfutil.dll
2010-10-21 12:59:30 ----A---- C:\WINDOWS\system32\licwmi.dll
2010-10-21 12:59:30 ----A---- C:\WINDOWS\system32\cmprops.dll
2010-10-21 12:59:27 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys
2010-10-21 12:59:26 ----A---- C:\WINDOWS\system32\drivers\termdd.sys
2010-10-21 10:58:27 ----A---- C:\WINDOWS\system32\h323log.txt
2010-10-21 10:53:38 ----A---- C:\WINDOWS\system32\drivers\audstub.sys
2010-10-21 10:52:50 ----A---- C:\WINDOWS\system32\drivers\redbook.sys
2010-10-21 10:52:09 ----A---- C:\WINDOWS\system32\drivers\fetnd5.sys
2010-10-21 10:52:05 ----A---- C:\WINDOWS\system32\usbui.dll
2010-10-21 10:51:51 ----A---- C:\WINDOWS\system32\drivers\UAGP35.SYS
2010-10-21 10:50:39 ----SHD---- C:\WINDOWS\Installer
2010-10-21 10:50:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-21 10:50:38 ----D---- C:\Arquivos de programas\Arquivos comuns\ODBC
2010-10-21 10:50:38 ----A---- C:\WINDOWS\ODBCINST.INI
2010-10-21 10:50:34 ----RD---- C:\Arquivos de programas
2010-10-21 10:50:34 ----D---- C:\Arquivos de programas\Arquivos comuns\SpeechEngines
2010-10-21 10:50:34 ----D---- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared
2010-10-21 10:50:34 ----D---- C:\Arquivos de programas\Arquivos comuns
2010-10-21 10:50:30 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2010-10-21 10:50:30 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2010-10-21 10:50:30 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdur.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdru.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2010-10-21 10:50:26 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2010-10-21 10:50:26 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdest.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdro.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\spxcoins.dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\irclass.dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\dgsetup.dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2010-10-21 10:50:17 ----A---- C:\WINDOWS\TASKMAN.EXE
2010-10-21 10:50:16 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2010-10-21 10:50:16 ----A---- C:\WINDOWS\system32\drivers\irenum.sys
2010-10-21 10:50:16 ----A---- C:\WINDOWS\system32\batt.dll
2010-10-21 10:50:16 ----A---- C:\WINDOWS\NOTEPAD.EXE
2010-10-21 10:50:14 ----A---- C:\WINDOWS\system32\storprop.dll
2010-10-21 10:50:06 ----ASH---- C:\Documents and Settings\All Users\Dados de aplicativos\desktop.ini
2010-10-21 10:50:01 ----RA---- C:\WINDOWS\SET8.tmp
2010-10-21 10:49:58 ----RA---- C:\WINDOWS\SET4.tmp
2010-10-21 10:49:57 ----RA---- C:\WINDOWS\SET3.tmp
2010-10-21 10:49:51 ----D---- C:\WINDOWS\system32\CatRoot2
2010-10-21 10:49:51 ----D---- C:\WINDOWS\system32\CatRoot
2010-10-21 10:49:46 ----SD---- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft
2010-10-21 10:49:25 ----A---- C:\WINDOWS\setuplog.txt
2010-10-21 10:49:22 ----SHD---- C:\System Volume Information
2010-10-21 10:49:22 ----D---- C:\Documents and Settings
2010-10-21 10:48:34 ----SH---- C:\boot.ini
2010-10-21 10:40:34 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-10-21 10:40:34 ----RSD---- C:\WINDOWS\Fonts
2010-10-21 10:40:34 ----RD---- C:\WINDOWS\Web
2010-10-21 10:40:34 ----HD---- C:\WINDOWS\inf
2010-10-21 10:40:34 ----D---- C:\WINDOWS\WinSxS
2010-10-21 10:40:34 ----D---- C:\WINDOWS\twain_32
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Temp
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\wins
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\wbem
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\usmt
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\spool
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\ShellExt
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\Setup
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\ras
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\pt-BR
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\oobe
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\npp
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\mui
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\inetsrv
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\IME
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\icsxml
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\ias
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\export
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\drivers\etc
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\drivers\disdn
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\drivers
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\dhcp
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\config
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\3com_dmi
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\3076
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\2052
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1054
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1046
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1042
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1041
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1037
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1033
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1031
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1028
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1025
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system
2010-10-21 10:40:34 ----D---- C:\WINDOWS\security
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Resources
2010-10-21 10:40:34 ----D---- C:\WINDOWS\repair
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Provisioning
2010-10-21 10:40:34 ----D---- C:\WINDOWS\PeerNet
2010-10-21 10:40:34 ----D---- C:\WINDOWS\pchealth
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Network Diagnostic
2010-10-21 10:40:34 ----D---- C:\WINDOWS\mui
2010-10-21 10:40:34 ----D---- C:\WINDOWS\msapps
2010-10-21 10:40:34 ----D---- C:\WINDOWS\msagent
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Media
2010-10-21 10:40:34 ----D---- C:\WINDOWS\L2Schemas
2010-10-21 10:40:34 ----D---- C:\WINDOWS\java
2010-10-21 10:40:34 ----D---- C:\WINDOWS\ime
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Help
2010-10-21 10:40:34 ----D---- C:\WINDOWS\ehome
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Driver Cache
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Debug
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Cursors
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Connection Wizard
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Config
2010-10-21 10:40:34 ----D---- C:\WINDOWS\AppPatch
2010-10-21 10:40:34 ----D---- C:\WINDOWS\addins
2010-10-21 10:40:34 ----D---- C:\WINDOWS
2010-10-21 10:40:34 ----ASH---- C:\pagefile.sys
======List of files/folders modified in the last 1 months======
2010-10-21 13:17:32 ----A---- C:\WINDOWS\system.ini
2010-10-21 13:04:40 ----A---- C:\WINDOWS\win.ini
2010-10-21 13:04:05 ----ASH---- C:\WINDOWS\fonts\desktop.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 uagp35;Filtro Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-13 44672]
R1 intelppm;Driver de Processador Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R3 dac970nt;dac970nt; \??\C:\WINDOWS\system32\drivers\fqjkkn.sys []
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-04-17 42496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 viagfx;viagfx; C:\WINDOWS\system32\DRIVERS\vtmini.sys [2005-12-27 247040]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
All services whitelisted
-----------------EOF-----------------
Ahh , obs: vi que no relatorio só aparece disco C:
meu pc tem disco D: tbm, onde tem muito arquivo..
nao sei se isso ajuda em algo
Wings
Cyber Highlander
Registrado
20.3K Mensagens
1.2K Curtidas
Há uma contaminação pelo Sality.
A remoção pode não ser possível e a formatação poderá ser necessária. Tentaremos a remoção...
1.
*Delete o RSIT e a pasta C:\rsit
2.
*Baixe o RegUnlocker e salve-o no desktop
*Execute o programa e na aba [A - Restricciones], selecione:
1 - Elimina las restricciones del Sistema
2 - Eliminar restricciones del Explorador
*Clique [Aplicar]
3.
*Baixe o SalityKiller e salve-o no desktop
*Extraia para C:\
*Desative a Restauração do Sistema
*Clique com o botão direito do mouse em Meu Computador e selecione Propriedades
*Clique em Restauração do Sistema
*Selecione a opção:
[X] Desativar Restauração do Sistema
*Clique [Aplicar] > [Sim] > [OK]
*Este programa será executado em 2 janelas distintas ao mesmo tempo!!
*A primeira janela:
*Clique [Iniciar] > [Executar] > copie e cole: C:\salitykiller.exe -m
*Clique [OK]
*Mantenha a janela rodando. Não feche-a!! Se desejar, minimize-a.
*A segunda janela:
*Clique [Iniciar] > [Executar] > copie e cole: C:\salitykiller.exe -y -x -j -l sality.txt -v
*Clique [OK]
*Ao término, a janela 2 será fechada automaticamente. Feche, então, a janela 1.
*Cole o resumo localizado no final do arquivo C:\sality.txt, conforme mostrado abaixo:
23:57:51:0 Infected files: 8
23:57:51:0 Infected processes: 0
23:57:51:0 Infected threads: 2
23:57:51:0 Cured files: 8
23:57:51:0 Executed registry scripts: 1
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
então..
ja formatei ele a esperamça de corrigir
porem só piorou a situação
não sei se viu a obs no final do ultimo post..
tenho disco D:
onde salvo os arquivos antes de formatar
Obrigado, segue o log
14:25:00:204 3904 Infected files: 341
14:25:00:267 3904 Infected processes: 0
14:25:00:267 3904 Infected threads: 0
14:25:00:267 3904 Cured files: 341
14:25:00:267 3904 Will be cured on reboot: 0
14:25:00:329 3904 Executed registry scripts: 1
Wings
Cyber Highlander
Registrado
20.3K Mensagens
1.2K Curtidas
Pode ser que na partição D:\ haja arquivos contaminados....
Bom, continuaremos.
1.
*Delete o arquivo C:\sality.txt
2.
*Baixe novamente o RSIT e siga as orientações conforme descrevi antes. Cole o relatório dele.
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
Segue o relatório
Logfile of random's system information tool 1.08 (written by random/random)
Run by PaPaInOeL- at 2010-10-21 14:39:14
Microsoft Windows XP Professional Service Pack 3
System drive C: has 52 GB (92%) free of 56 GB
Total RAM: 1471 MB (65% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:39:26, on 21/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
D:\programas\Level Up! Games\Perfect World\element\elementclient.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\PaPaInOeL-\Desktop\RSIT.exe
C:\Arquivos de programas\trend micro\PaPaInOeL-.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{E05D21BB-F7B1-463B-9A41-8C723ED77F76}: NameServer = 201.10.120.2 201.10.128.2
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
--
End of file - 3327 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll [2010-10-21 501120]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"=C:\WINDOWS\system32\VTTimer.exe [2010-10-21 53248]
"VTTrayp"=C:\WINDOWS\system32\VTtrayp.exe [2010-10-21 163840]
"SunJavaUpdateSched"=C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe [2010-10-21 140672]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-06-20 577536]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\programas\wirar37br\wrar371br.exe"="D:\programas\wirar37br\wrar371br.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\WINDOWS\system32\VModes.exe"="C:\WINDOWS\system32\VModes.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\VTTimer.exe"="C:\WINDOWS\system32\VTTimer.exe:*:Enabled:ipsec"
"C:\DOCUME~1\PAPAIN~1\CONFIG~1\Temp\dojuyc.exe"="C:\DOCUME~1\PAPAIN~1\CONFIG~1\Temp\dojuyc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\PAPAIN~1\CONFIG~1\Temp\etkbu.exe"="C:\DOCUME~1\PAPAIN~1\CONFIG~1\Temp\etkbu.exe:*:Enabled:ipsec"
"D:\programas\Level Up! Games\Perfect World\element\reportbugs\pwprotector.exe"="D:\programas\Level Up! Games\Perfect World\element\reportbugs\pwprotector.exe:*:Enabled:ipsec"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
======List of files/folders created in the last 1 months======
2010-10-21 14:39:14 ----D---- C:\rsit
2010-10-21 14:36:59 ----A---- C:\WINDOWS\system32\wmpns.dll
2010-10-21 14:35:07 ----A---- C:\WINDOWS\system32\ChCfg.exe
2010-10-21 14:35:03 ----A---- C:\WINDOWS\system32\drivers\splitter.sys
2010-10-21 14:35:01 ----A---- C:\WINDOWS\system32\drivers\wdmaud.sys
2010-10-21 14:34:59 ----A---- C:\WINDOWS\system32\drivers\DMusic.sys
2010-10-21 14:34:57 ----A---- C:\WINDOWS\system32\drivers\swmidi.sys
2010-10-21 14:34:55 ----A---- C:\WINDOWS\system32\drivers\aec.sys
2010-10-21 14:34:54 ----A---- C:\WINDOWS\system32\drivers\kmixer.sys
2010-10-21 14:34:53 ----A---- C:\WINDOWS\system32\drivers\drmkaud.sys
2010-10-21 14:34:51 ----A---- C:\WINDOWS\system32\drivers\sysaudio.sys
2010-10-21 14:34:49 ----A---- C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010-10-21 14:34:48 ----A---- C:\WINDOWS\system32\drivers\MSPQM.sys
2010-10-21 14:34:45 ----A---- C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010-10-21 14:34:39 ----A---- C:\WINDOWS\system32\ksuser.dll
2010-10-21 14:34:39 ----A---- C:\WINDOWS\system32\drivers\portcls.sys
2010-10-21 14:34:39 ----A---- C:\WINDOWS\system32\drivers\drmk.sys
2010-10-21 14:34:36 ----D---- C:\Arquivos de programas\Realtek Sound Manager
2010-10-21 14:34:36 ----D---- C:\Arquivos de programas\AvRack
2010-10-21 14:34:36 ----A---- C:\WINDOWS\avrack.ini
2010-10-21 14:34:29 ----D---- C:\Arquivos de programas\Realtek AC97
2010-10-21 14:34:29 ----A---- C:\WINDOWS\system32\RTLCPL.exe
2010-10-21 14:34:28 ----HD---- C:\Arquivos de programas\InstallShield Installation Information
2010-10-21 14:34:28 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2010-10-21 14:34:28 ----A---- C:\WINDOWS\system32\drivers\alcxwdm.sys
2010-10-21 14:34:28 ----A---- C:\WINDOWS\soundman.exe
2010-10-21 14:34:28 ----A---- C:\WINDOWS\alcupd.exe
2010-10-21 14:34:28 ----A---- C:\WINDOWS\Alcrmv.exe
2010-10-21 14:34:21 ----D---- C:\Arquivos de programas\Arquivos comuns\InstallShield
2010-10-21 14:06:10 ----A---- C:\SalityKiller.exe
2010-10-21 14:06:10 ----A---- C:\eula.txt
2010-10-21 14:05:57 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\WinRAR
2010-10-21 14:05:37 ----D---- C:\RegUnlocker Backups
2010-10-21 14:05:13 ----SHD---- C:\RECYCLER
2010-10-21 13:43:58 ----SHDC---- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller
2010-10-21 13:43:51 ----D---- C:\Arquivos de programas\Windows Live
2010-10-21 13:43:44 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller
2010-10-21 13:39:19 ----D---- C:\Arquivos de programas\trend micro
2010-10-21 13:39:05 ----A---- C:\WINDOWS\system32\javaws.exe
2010-10-21 13:39:05 ----A---- C:\WINDOWS\system32\javaw.exe
2010-10-21 13:39:05 ----A---- C:\WINDOWS\system32\java.exe
2010-10-21 13:38:27 ----D---- C:\Arquivos de programas\Java
2010-10-21 13:38:23 ----D---- C:\Arquivos de programas\Arquivos comuns\Java
2010-10-21 13:38:10 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Sun
2010-10-21 13:37:17 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\teamspeak2
2010-10-21 13:37:09 ----D---- C:\Arquivos de programas\Teamspeak2_RC2
2010-10-21 13:28:49 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-10-21 13:27:38 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Mozilla
2010-10-21 13:27:33 ----D---- C:\Arquivos de programas\Mozilla Firefox
2010-10-21 13:26:05 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2010-10-21 13:26:05 ----A---- C:\WINDOWS\system32\pndx5032.dll
2010-10-21 13:26:05 ----A---- C:\WINDOWS\system32\pndx5016.dll
2010-10-21 13:26:04 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Real
2010-10-21 13:26:04 ----D---- C:\Documents and Settings\All Users\Dados de aplicativos\Real
2010-10-21 13:26:04 ----D---- C:\Arquivos de programas\Real Alternative
2010-10-21 13:26:04 ----A---- C:\WINDOWS\system32\msvcr71.dll
2010-10-21 13:26:04 ----A---- C:\WINDOWS\system32\msvcp71.dll
2010-10-21 13:22:58 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-10-21 13:22:52 ----D---- C:\WINDOWS\vnDrvBas
2010-10-21 13:22:52 ----A---- C:\WINDOWS\system32\vuins32.dll
2010-10-21 13:22:52 ----A---- C:\WINDOWS\system32\drivers\fetnd5bv.sys
2010-10-21 13:22:52 ----A---- C:\WINDOWS\system32\difxapi.dll
2010-10-21 13:21:01 ----A---- C:\WINDOWS\RtlRack.ini
2010-10-21 13:19:35 ----D---- C:\Arquivos de programas\S3
2010-10-21 13:18:06 ----D---- C:\Arquivos de programas\WinRAR
2010-10-21 13:16:21 ----D---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Identities
2010-10-21 13:16:19 ----HD---- C:\Arquivos de programas\Uninstall Information
2010-10-21 13:16:12 ----SD---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\Microsoft
2010-10-21 13:16:12 ----ASH---- C:\Documents and Settings\PaPaInOeL-\Dados de aplicativos\desktop.ini
2010-10-21 13:14:57 ----D---- C:\WINDOWS\SoftwareDistribution
2010-10-21 13:14:56 ----D---- C:\WINDOWS\Prefetch
2010-10-21 13:14:55 ----SD---- C:\WINDOWS\system32\Microsoft
2010-10-21 13:14:55 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-10-21 13:05:02 ----D---- C:\WINDOWS\system32\xircom
2010-10-21 13:05:02 ----D---- C:\Arquivos de programas\xerox
2010-10-21 13:05:02 ----D---- C:\Arquivos de programas\microsoft frontpage
2010-10-21 13:04:40 ----RASH---- C:\MSDOS.SYS
2010-10-21 13:04:40 ----RASH---- C:\IO.SYS
2010-10-21 13:04:40 ----A---- C:\WINDOWS\control.ini
2010-10-21 13:04:40 ----A---- C:\CONFIG.SYS
2010-10-21 13:04:40 ----A---- C:\AUTOEXEC.BAT
2010-10-21 13:04:23 ----A---- C:\WINDOWS\OEWABLog.txt
2010-10-21 13:04:19 ----A---- C:\WINDOWS\system32\mapi32.dll
2010-10-21 13:03:20 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-10-21 13:03:20 ----RD---- C:\WINDOWS\Offline Web Pages
2010-10-21 13:03:20 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2010-10-21 13:03:12 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2010-10-21 13:03:07 ----HD---- C:\Arquivos de programas\WindowsUpdate
2010-10-21 13:03:03 ----D---- C:\Arquivos de programas\Serviços on-line
2010-10-21 13:02:45 ----D---- C:\WINDOWS\system32\DirectX
2010-10-21 13:02:39 ----A---- C:\WINDOWS\system32\atrace.dll
2010-10-21 13:02:37 ----A---- C:\WINDOWS\system32\desktop.ini
2010-10-21 13:02:36 ----A---- C:\WINDOWS\desktop.ini
2010-10-21 13:02:29 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2010-10-21 13:02:28 ----D---- C:\Arquivos de programas\Arquivos comuns\Serviços
2010-10-21 13:02:28 ----A---- C:\WINDOWS\system32\acctres.dll
2010-10-21 13:02:25 ----SD---- C:\WINDOWS\Tasks
2010-10-21 13:02:25 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2010-10-21 13:02:24 ----D---- C:\Arquivos de programas\Arquivos comuns\MSSoap
2010-10-21 13:02:20 ----D---- C:\WINDOWS\srchasst
2010-10-21 13:02:19 ----D---- C:\WINDOWS\system32\Macromed
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuweb.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wups.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wucltui.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauserv.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuaueng.dll
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2010-10-21 13:02:15 ----A---- C:\WINDOWS\system32\wuauclt.exe
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\wuapi.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\qmgr.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2010-10-21 13:02:14 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2010-10-21 13:02:10 ----D---- C:\Arquivos de programas\Movie Maker
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\safrslv.dll
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\safrdm.dll
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2010-10-21 13:01:51 ----A---- C:\WINDOWS\system32\racpldlg.dll
2010-10-21 13:01:47 ----D---- C:\WINDOWS\system32\Restore
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\srsvc.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\srrstr.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\srclient.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\fltMc.exe
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\fltlib.dll
2010-10-21 13:01:47 ----A---- C:\WINDOWS\system32\drivers\fltMgr.sys
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\mnmdd.dll
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\ils.dll
2010-10-21 13:01:46 ----A---- C:\WINDOWS\system32\drivers\sr.sys
2010-10-21 13:01:45 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2010-10-21 13:01:45 ----A---- C:\WINDOWS\system32\msconf.dll
2010-10-21 13:01:45 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2010-10-21 13:01:42 ----D---- C:\Arquivos de programas\NetMeeting
2010-10-21 13:01:42 ----A---- C:\WINDOWS\system32\msoert2.dll
2010-10-21 13:01:42 ----A---- C:\WINDOWS\system32\msoeacct.dll
2010-10-21 13:01:41 ----A---- C:\WINDOWS\system32\inetres.dll
2010-10-21 13:01:41 ----A---- C:\WINDOWS\system32\inetcomm.dll
2010-10-21 13:01:39 ----D---- C:\Arquivos de programas\Outlook Express
2010-10-21 13:01:39 ----A---- C:\WINDOWS\system32\schedsvc.dll
2010-10-21 13:01:39 ----A---- C:\WINDOWS\system32\mstinit.exe
2010-10-21 13:01:39 ----A---- C:\WINDOWS\system32\mstask.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\isign32.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\inetcfg.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\icwphbk.dll
2010-10-21 13:01:38 ----A---- C:\WINDOWS\system32\icwdial.dll
2010-10-21 13:01:32 ----D---- C:\Arquivos de programas\Arquivos comuns\System
2010-10-21 13:01:30 ----D---- C:\Arquivos de programas\Internet Explorer
2010-10-21 13:00:45 ----D---- C:\Arquivos de programas\ComPlus Applications
2010-10-21 13:00:43 ----A---- C:\WINDOWS\vbaddin.ini
2010-10-21 13:00:43 ----A---- C:\WINDOWS\vb.ini
2010-10-21 13:00:38 ----D---- C:\WINDOWS\Registration
2010-10-21 13:00:30 ----D---- C:\Arquivos de programas\Windows Media Player
2010-10-21 13:00:23 ----D---- C:\Arquivos de programas\Messenger
2010-10-21 13:00:19 ----D---- C:\Arquivos de programas\MSN Gaming Zone
2010-10-21 13:00:19 ----A---- C:\WINDOWS\system32\write.exe
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\sndvol32.exe
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\hticons.dll
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\avwav.dll
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\avtapi.dll
2010-10-21 13:00:09 ----A---- C:\WINDOWS\system32\avmeter.dll
2010-10-21 13:00:08 ----A---- C:\WINDOWS\system32\winchat.exe
2010-10-21 13:00:01 ----A---- C:\WINDOWS\system32\getuname.dll
2010-10-21 13:00:01 ----A---- C:\WINDOWS\system32\charmap.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\winmine.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\sol.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\mshearts.exe
2010-10-21 13:00:00 ----A---- C:\WINDOWS\system32\calc.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tslabels.ini
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tskill.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\tscon.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\shadow.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\rwinsta.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\reset.exe
2010-10-21 12:59:59 ----A---- C:\WINDOWS\system32\freecell.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\regini.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\qwinsta.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\qappsrv.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\msg.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\logoff.exe
2010-10-21 12:59:58 ----A---- C:\WINDOWS\system32\cdmodem.dll
2010-10-21 12:59:51 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\sndrec32.exe
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\mplay32.exe
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\hypertrm.dll
2010-10-21 12:59:50 ----A---- C:\WINDOWS\system32\accwiz.exe
2010-10-21 12:59:49 ----D---- C:\Arquivos de programas\Windows NT
2010-10-21 12:59:49 ----A---- C:\WINDOWS\system32\mspaint.exe
2010-10-21 12:59:49 ----A---- C:\WINDOWS\system32\clipbrd.exe
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\spider.exe
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\drivers\tdtcp.sys
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\drivers\tdpipe.sys
2010-10-21 12:59:48 ----A---- C:\WINDOWS\system32\drivers\rdpwd.sys
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\tsgqec.dll
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2010-10-21 12:59:47 ----A---- C:\WINDOWS\system32\aaclient.dll
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\remotepg.dll
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\mstscax.dll
2010-10-21 12:59:46 ----A---- C:\WINDOWS\system32\mstsc.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\termsrv.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\sessmgr.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdshost.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdpclip.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\rdchost.dll
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\qprocess.exe
2010-10-21 12:59:45 ----A---- C:\WINDOWS\system32\icaapi.dll
2010-10-21 12:59:44 ----D---- C:\WINDOWS\system32\MsDtc
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\mtxoci.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\msdtctm.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2010-10-21 12:59:44 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2010-10-21 12:59:43 ----A---- C:\WINDOWS\system32\xolehlp.dll
2010-10-21 12:59:43 ----A---- C:\WINDOWS\system32\msdtclog.dll
2010-10-21 12:59:43 ----A---- C:\WINDOWS\system32\msdtc.exe
2010-10-21 12:59:42 ----D---- C:\WINDOWS\system32\Com
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\mtxex.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\mtxdm.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\comrepl.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\comaddin.dll
2010-10-21 12:59:42 ----A---- C:\WINDOWS\system32\colbact.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\stclient.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\clbcatex.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\catsrvut.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\catsrvps.dll
2010-10-21 12:59:41 ----A---- C:\WINDOWS\system32\catsrv.dll
2010-10-21 12:59:39 ----A---- C:\WINDOWS\system32\comuid.dll
2010-10-21 12:59:39 ----A---- C:\WINDOWS\system32\comsvcs.dll
2010-10-21 12:59:38 ----A---- C:\WINDOWS\system32\comsnap.dll
2010-10-21 12:59:38 ----A---- C:\WINDOWS\system32\clbcatq.dll
2010-10-21 12:59:31 ----A---- C:\WINDOWS\system32\servdeps.dll
2010-10-21 12:59:30 ----A---- C:\WINDOWS\system32\mmfutil.dll
2010-10-21 12:59:30 ----A---- C:\WINDOWS\system32\licwmi.dll
2010-10-21 12:59:30 ----A---- C:\WINDOWS\system32\cmprops.dll
2010-10-21 12:59:27 ----A---- C:\WINDOWS\system32\drivers\rdpdr.sys
2010-10-21 12:59:26 ----A---- C:\WINDOWS\system32\drivers\termdd.sys
2010-10-21 10:58:27 ----A---- C:\WINDOWS\system32\h323log.txt
2010-10-21 10:53:38 ----A---- C:\WINDOWS\system32\drivers\audstub.sys
2010-10-21 10:52:50 ----A---- C:\WINDOWS\system32\drivers\redbook.sys
2010-10-21 10:52:09 ----A---- C:\WINDOWS\system32\drivers\fetnd5.sys
2010-10-21 10:52:05 ----A---- C:\WINDOWS\system32\usbui.dll
2010-10-21 10:51:51 ----A---- C:\WINDOWS\system32\drivers\UAGP35.SYS
2010-10-21 10:50:39 ----SHD---- C:\WINDOWS\Installer
2010-10-21 10:50:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-21 10:50:38 ----D---- C:\Arquivos de programas\Arquivos comuns\ODBC
2010-10-21 10:50:38 ----A---- C:\WINDOWS\ODBCINST.INI
2010-10-21 10:50:34 ----RD---- C:\Arquivos de programas
2010-10-21 10:50:34 ----D---- C:\Arquivos de programas\Arquivos comuns\SpeechEngines
2010-10-21 10:50:34 ----D---- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared
2010-10-21 10:50:34 ----D---- C:\Arquivos de programas\Arquivos comuns
2010-10-21 10:50:30 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2010-10-21 10:50:30 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2010-10-21 10:50:30 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdur.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2010-10-21 10:50:28 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdru.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2010-10-21 10:50:27 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2010-10-21 10:50:26 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2010-10-21 10:50:26 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2010-10-21 10:50:25 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2010-10-21 10:50:24 ----RA---- C:\WINDOWS\system32\kbdest.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdro.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2010-10-21 10:50:22 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\spxcoins.dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\irclass.dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\dgsetup.dll
2010-10-21 10:50:19 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2010-10-21 10:50:17 ----A---- C:\WINDOWS\TASKMAN.EXE
2010-10-21 10:50:16 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2010-10-21 10:50:16 ----A---- C:\WINDOWS\system32\drivers\irenum.sys
2010-10-21 10:50:16 ----A---- C:\WINDOWS\system32\batt.dll
2010-10-21 10:50:16 ----A---- C:\WINDOWS\NOTEPAD.EXE
2010-10-21 10:50:14 ----A---- C:\WINDOWS\system32\storprop.dll
2010-10-21 10:50:06 ----ASH---- C:\Documents and Settings\All Users\Dados de aplicativos\desktop.ini
2010-10-21 10:50:01 ----RA---- C:\WINDOWS\SET8.tmp
2010-10-21 10:49:58 ----RA---- C:\WINDOWS\SET4.tmp
2010-10-21 10:49:57 ----RA---- C:\WINDOWS\SET3.tmp
2010-10-21 10:49:51 ----D---- C:\WINDOWS\system32\CatRoot2
2010-10-21 10:49:51 ----D---- C:\WINDOWS\system32\CatRoot
2010-10-21 10:49:46 ----SD---- C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft
2010-10-21 10:49:25 ----A---- C:\WINDOWS\setuplog.txt
2010-10-21 10:49:22 ----SHD---- C:\System Volume Information
2010-10-21 10:49:22 ----D---- C:\Documents and Settings
2010-10-21 10:48:34 ----SH---- C:\boot.ini
2010-10-21 10:40:34 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-10-21 10:40:34 ----RSD---- C:\WINDOWS\Fonts
2010-10-21 10:40:34 ----RD---- C:\WINDOWS\Web
2010-10-21 10:40:34 ----HD---- C:\WINDOWS\inf
2010-10-21 10:40:34 ----D---- C:\WINDOWS\WinSxS
2010-10-21 10:40:34 ----D---- C:\WINDOWS\twain_32
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Temp
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\wins
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\wbem
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\usmt
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\spool
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\ShellExt
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\Setup
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\ras
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\pt-BR
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\oobe
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\npp
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\mui
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\inetsrv
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\IME
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\icsxml
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\ias
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\export
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\drivers\etc
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\drivers\disdn
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\drivers
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\dhcp
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\config
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\3com_dmi
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\3076
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\2052
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1054
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1046
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1042
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1041
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1037
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1033
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1031
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1028
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32\1025
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system32
2010-10-21 10:40:34 ----D---- C:\WINDOWS\system
2010-10-21 10:40:34 ----D---- C:\WINDOWS\security
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Resources
2010-10-21 10:40:34 ----D---- C:\WINDOWS\repair
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Provisioning
2010-10-21 10:40:34 ----D---- C:\WINDOWS\PeerNet
2010-10-21 10:40:34 ----D---- C:\WINDOWS\pchealth
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Network Diagnostic
2010-10-21 10:40:34 ----D---- C:\WINDOWS\mui
2010-10-21 10:40:34 ----D---- C:\WINDOWS\msapps
2010-10-21 10:40:34 ----D---- C:\WINDOWS\msagent
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Media
2010-10-21 10:40:34 ----D---- C:\WINDOWS\L2Schemas
2010-10-21 10:40:34 ----D---- C:\WINDOWS\java
2010-10-21 10:40:34 ----D---- C:\WINDOWS\ime
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Help
2010-10-21 10:40:34 ----D---- C:\WINDOWS\ehome
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Driver Cache
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Debug
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Cursors
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Connection Wizard
2010-10-21 10:40:34 ----D---- C:\WINDOWS\Config
2010-10-21 10:40:34 ----D---- C:\WINDOWS\AppPatch
2010-10-21 10:40:34 ----D---- C:\WINDOWS\addins
2010-10-21 10:40:34 ----D---- C:\WINDOWS
2010-10-21 10:40:34 ----ASH---- C:\pagefile.sys
======List of files/folders modified in the last 1 months======
2010-10-21 14:12:37 ----A---- C:\WINDOWS\system.ini
2010-10-21 14:09:21 ----A---- C:\WINDOWS\system32\VModes.exe
2010-10-21 14:07:04 ----A---- C:\WINDOWS\system32\VTTrayp.exe
2010-10-21 14:07:04 ----A---- C:\WINDOWS\system32\VTTimer.exe
2010-10-21 13:04:40 ----A---- C:\WINDOWS\win.ini
2010-10-21 13:04:05 ----ASH---- C:\WINDOWS\fonts\desktop.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 uagp35;Filtro Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-13 44672]
R1 intelppm;Driver de Processador Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-06-27 3972672]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-04-17 42496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 viagfx;viagfx; C:\WINDOWS\system32\DRIVERS\vtmini.sys [2005-12-27 247040]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
S3 WLSetupSvc;Windows Live Setup Service; C:\Arquivos de programas\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
-----------------EOF-----------------
Wings
Cyber Highlander
Registrado
20.3K Mensagens
1.2K Curtidas
1.
*Delete o RSIT e a pasta C:\rsit
2.
*Delete o arquivo C:\salitykiller.exe
3.
*Delete o RegUnlocker
4.
*Acesse o link abaixo:
http://securityresponse.symantec.com/avcenter/UnHookExec.inf
*Clique com o botão direito do mouse na página e selecione "Salvar como"...
*Salve no desktop
*Clique com o botão direito do mouse no arquivo UnHookExec e selecione "Instalar"
5.
*Baixe o Kaspersky Virus Removal Tool e salve-o no desktop
*Instale o programa
*Selecione a opção:
[X] Meu Computador
*Clique em [Start scan]....aguarde. Pode demorar, seja paciente!
*Caso encontre algo, clique [Skip]
*Ao finalizar, clique [Report]
*Uma janela chamada "Detailed report" será aberta
*Clique no sinal [+] ao lado de Autoscan para expandir os eventos encontrados
*Clique com o botão direito do mouse em Autoscan e selecione "Select all"
*Clique novamente com o botão direito do mouse e selecione "Copy"
*Abra o bloco de notas, cole (Ctrl+v) e salve o arquivo no desktop como log.txt
*Feche a janela "Detailed report" do Kasperky
*Na tela principal do Kaspersky clique em [Exit] > [No]
*Cole o relatório log.txt salvo no desktop
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
fazendo download do arquivo...
aquela parte de botao direito- instalar
eu fiz isso porem
não abriu janela nenhuma nem nada, não sei se é normal
acabando o download prossigo como orientado e posto denovo
obrigado pela atenção
Wings
Cyber Highlander
Registrado
20.3K Mensagens
1.2K Curtidas
Sim...ao acessar a página, selecionou "Salvar como..."
Salvou no desktop
Clicando no arquivo Unhookexec.inf com o botão direito do mouse e selecionou "Instalar"
Não abrirá nenhuma janela
Siga com o Kaspersky
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
ok, ta verificando pelo jeito vai demorar 1 pouco..
quando acabar posto aqui
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
acabou, tinha travado em um arquivo e nao percebi por isso a demora..
ai vai o log
Verificação automática: concluído 1 minuto atrás (eventos: 38, objetos: 127061, hora: 00:58:15)
21/10/2010 16:00:28 Tarefa iniciada Ação padrão selecionada
21/10/2010 16:34:31 Detectados: Trojan-Downloader.WMA.GetCodec.r D:\musicaaas\Pagodeeeee\minha razao de viver vava.mp3 Ação padrão selecionada
21/10/2010 16:34:31 Não neutralizado: Trojan-Downloader.WMA.GetCodec.r D:\musicaaas\Pagodeeeee\minha razao de viver vava.mp3 Adiado
21/10/2010 16:42:17 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Copy of Dragon Force - Black Winter Night.wma Ação padrão selecionada
21/10/2010 16:42:17 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Copy of Dragon Force - Black Winter Night.wma Adiado
21/10/2010 16:42:17 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Dragon Force - Body breakdown.wma Ação padrão selecionada
21/10/2010 16:42:17 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Dragon Force - Body breakdown.wma Adiado
21/10/2010 16:42:17 Detectados: Trojan-Downloader.WMA.Wimad.v D:\programas\marcos\Dragon force - Operation Ground And Pound.wma Ação padrão selecionada
21/10/2010 16:42:17 Não neutralizado: Trojan-Downloader.WMA.Wimad.v D:\programas\marcos\Dragon force - Operation Ground And Pound.wma Adiado
21/10/2010 16:42:21 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\roadrunner records united - the dagger.wma Ação padrão selecionada
21/10/2010 16:42:21 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\roadrunner records united - the dagger.wma Adiado
21/10/2010 16:42:22 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - 08 - I-E-A-I-A-I-O.wma Ação padrão selecionada
21/10/2010 16:42:22 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - 08 - I-E-A-I-A-I-O.wma Adiado
21/10/2010 16:42:23 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - Temper (rare).wma Ação padrão selecionada
21/10/2010 16:42:23 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - Temper (rare).wma Adiado
21/10/2010 16:42:49 Detectados: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\006 ingrata tradicao.wma Ação padrão selecionada
21/10/2010 16:42:49 Não neutralizado: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\006 ingrata tradicao.wma Adiado
21/10/2010 16:42:52 Detectados: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\001 cafe amargo.wma Ação padrão selecionada
21/10/2010 16:42:52 Não neutralizado: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\001 cafe amargo.wma Adiado
21/10/2010 16:52:11 Detectados: Trojan-Downloader.WMA.GetCodec.r D:\musicaaas\Pagodeeeee\minha razao de viver vava.mp3 Ação padrão selecionada
21/10/2010 16:58:23 Não neutralizado: Trojan-Downloader.WMA.GetCodec.r D:\musicaaas\Pagodeeeee\minha razao de viver vava.mp3 Ignorado pelo usuário
21/10/2010 16:58:24 Detectados: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\001 cafe amargo.wma Ação padrão selecionada
21/10/2010 16:58:30 Não neutralizado: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\001 cafe amargo.wma Ignorado pelo usuário
21/10/2010 16:58:30 Detectados: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\006 ingrata tradicao.wma Ação padrão selecionada
21/10/2010 16:58:34 Não neutralizado: Trojan-Downloader.WMA.Wimad.x D:\programas\Saved\006 ingrata tradicao.wma Ignorado pelo usuário
21/10/2010 16:58:35 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Copy of Dragon Force - Black Winter Night.wma Ação padrão selecionada
21/10/2010 16:58:38 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Copy of Dragon Force - Black Winter Night.wma Ignorado pelo usuário
21/10/2010 16:58:38 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Dragon Force - Body breakdown.wma Ação padrão selecionada
21/10/2010 16:58:39 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\Dragon Force - Body breakdown.wma Ignorado pelo usuário
21/10/2010 16:58:40 Detectados: Trojan-Downloader.WMA.Wimad.v D:\programas\marcos\Dragon force - Operation Ground And Pound.wma Ação padrão selecionada
21/10/2010 16:58:40 Não neutralizado: Trojan-Downloader.WMA.Wimad.v D:\programas\marcos\Dragon force - Operation Ground And Pound.wma Ignorado pelo usuário
21/10/2010 16:58:41 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - 08 - I-E-A-I-A-I-O.wma Ação padrão selecionada
21/10/2010 16:58:42 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - 08 - I-E-A-I-A-I-O.wma Ignorado pelo usuário
21/10/2010 16:58:42 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - Temper (rare).wma Ação padrão selecionada
21/10/2010 16:58:42 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\System Of A Down - Temper (rare).wma Ignorado pelo usuário
21/10/2010 16:58:43 Detectados: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\roadrunner records united - the dagger.wma Ação padrão selecionada
21/10/2010 16:58:43 Não neutralizado: Trojan-Clicker.WMA.Agent.d D:\programas\marcos\roadrunner records united - the dagger.wma Ignorado pelo usuário
21/10/2010 16:58:44 Tarefa concluída Ação padrão selecionada
Wings
Cyber Highlander
Registrado
20.3K Mensagens
1.2K Curtidas
OK..
Vamos as reinicializações...
1.
*Abra a pasta Virus Removal Tool, localizada no desktop, execute o atalho Start
*Clique em [Exit] > [Yes] > [Sim] > [Sim]
*O PC será reiniciado
*Delete os arquivos setup do Kaspersky e log.txt salvos no desktop
2.
*Baixe o RatsCheddar e salve-o no desktop
*Extraia para o desktop
*Execute o RatsCheddar
*Nas opções:
-Task Manager
-Registry Tools
*Clique em [Enable] > [Exit]
*Reinicie o PC
3.
*Baixe o sality_regkeys e salve-o no desktop
*Extraia o conteúdo para o desktop
*Na pasta SalityRegKeys execute o arquivo SafeBootWinXP.reg e aceite a entrada no registro
*Reinicie o PC
4.
*Baixe o HijackThis e salve-o no desktop
*Execute o HijackThis
*Clique [Do a system scan and save a logfile].
*Cole o relatório
marcosgno
Novo Membro
Registrado
28 Mensagens
0 Curtidas
Desculpa demora, tive quer dar 1 saida
ai vai o relatorio
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:36:54, on 21/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\PaPaInOeL-\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.7.0\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.7.0\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{E05D21BB-F7B1-463B-9A41-8C723ED77F76}: NameServer = 201.10.1.2 201.10.128.3
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
--
End of file - 3121 bytes