Ajuda Rootkit, driver do HD e gerenciamento de disco não aparecem.

Question

Fui pegar um programa via Torrent, dei mole e sa&iacute; executando como administrador de cara antes de verificar.
O PC ficou meio estranho, finalizei o processo da instala&ccedil;&atilde;o. Removi algumas coisas com o combofix, mas ainda tem coisa. Parece que tem um Rootkit que eu n&atilde;o estou sabendo como tirar.
Abaixo log do combofix, da 2&ordf; passada.

Negritei itens que eu estou estranhando, s&atilde;o arquivos que nunca vi no Sistema. Alguns podem at&eacute; ser que sejam do software do celular que instalei a alguns dias, junto com o soft do Bluetooth, n&atilde;o conhe&ccedil;o os arquivos deles.


ComboFix 10-04-05.06 - MezengaAdm 06/04/2010  12:54:54.15.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.55.1046.18.479.193 [GMT -3:00]
Executando de: c:\documents and settings\Bruno\Desktop\ComboFix.exe
.

((((((((((((((((   Arquivos/Ficheiros criados de 2010-03-06 to 2010-04-06  ))))))))))))))))))))))))))))
.

2010-11-01 01:51 . 2009-10-11 19:54	--------	d-----w-	c:\arquivos de programas\Aur&eacute;lio - S&eacute;culo XXI
2010-04-05 01:13 . 2010-04-05 01:13	--------	d-----w-	c:\arquivos de programas\Sony
2010-04-05 01:12 . 2010-04-05 01:12	--------	d-----w-	c:\arquivos de programas\Sony Setup
2010-04-05 00:24 . 2010-04-05 00:30	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Gold Wave Editor
2010-04-04 17:36 . 2010-04-04 17:36	--------	d-----w-	c:\arquivos de programas\Alien Connections
2010-04-02 15:06 . 2007-10-23 12:27	110592	----a-w-	c:\documents and settings\Bruno\Dados de aplicativos\U3	emp\cleanup.exe
2010-04-02 15:06 . 2008-05-02 13:41	3493888	---ha-w-	c:\documents and settings\Bruno\Dados de aplicativos\U3	emp\Launchpad Removal.exe
2010-04-02 15:04 . 2010-04-02 15:06	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\U3
2010-03-19 13:31 . 2010-03-19 13:31	89256	----a-w-	c:\windows\system32\ElbyCDIO.dll
2010-03-18 16:45 . 2010-03-18 16:45	104768	----a-w-	c:\windows\system32\drivers\AnyDVD.sys
2010-03-16 03:01 . 2010-03-16 03:01	--------	d-----w-	c:\documents and settings\MezengaAdm\Bluetooth Software
2010-03-16 01:53 . 2008-04-13 17:46	37888	----a-w-	c:\windows\system32\drivers\bthmodem.sys
2010-03-16 01:44 . 2008-04-13 17:51	101120	----a-w-	c:\windows\system32\drivers\bthpan.sys
2010-03-16 01:43 . 2008-04-14 01:20	8192	----a-w-	c:\windows\system32\wshirda.dll
2010-03-16 01:43 . 2008-04-14 01:20	28672	----a-w-	c:\windows\system32\irmon.dll
2010-03-16 01:43 . 2008-04-13 17:46	59136	----a-w-	c:\windows\system32\driversfcomm.sys
2010-03-16 01:43 . 2008-04-13 17:46	17024	----a-w-	c:\windows\system32\drivers\bthenum.sys
2010-03-16 01:43 . 2008-04-14 01:21	152576	----a-w-	c:\windows\system32\irftp.exe
2010-03-16 01:43 . 2008-04-13 17:46	18944	----a-w-	c:\windows\system32\drivers\BTHUSB.SYS
2010-03-14 02:17 . 2010-03-14 02:17	4710	----a-r-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Microsoft\Installer\{E8AF93FC-52D2-4D64-A664-8CA5B0C29DD2}\_1ca9d03.exe
2010-03-14 02:17 . 2010-03-14 02:17	3638	----a-r-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Microsoft\Installer\{E8AF93FC-52D2-4D64-A664-8CA5B0C29DD2}\_1ca66306.exe
2010-03-14 01:26 . 2010-03-14 01:38	--------	d-----w-	c:\arquivos de programas\YAMAHA
2010-03-12 03:15 . 2007-03-28 15:05	35332	----a-w-	c:\windows\system32\uninst.exe
2010-03-12 03:15 . 2004-04-01 02:38	1350656	----a-w-	c:\windows\system32\Screen Antics.scr
2010-03-12 03:10 . 2010-03-12 03:10	--------	d-----w-	c:\arquivos de programas\Nuganics
2010-03-12 03:10 . 2010-03-12 03:10	1807938	----a-w-	c:\windows\system32\Licking Dog Screen Clean.scr
2010-03-12 02:47 . 2010-04-05 00:30	--------	d-----w-	C:\AfterDark
2010-03-12 02:47 . 2010-03-12 02:47	--------	d-----w-	C:\After Dark
2010-03-12 02:40 . 2010-03-12 02:40	--------	d-----w-	c:\documents and settings\MezengaAdm\WINDOWS
2010-03-12 02:40 . 1994-07-11 06:00	4784	----a-w-	c:\windows\system\SPMME.DRV
2010-03-12 02:34 . 2010-03-12 02:34	--------	d--h--w-	c:\windows\PIF
2010-03-11 01:30 . 2010-03-11 01:30	--------	d-----w-	c:\arquivos de programas\AwinSoft
2010-03-11 00:54 . 2009-10-23 15:28	3558912	-c----w-	c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((   Relat&oacute;rio Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-06 15:43 . 2002-09-11 11:00	86394	----a-w-	c:\windows\system32\perfc016.dat
2010-04-06 15:43 . 2002-09-11 11:00	515454	----a-w-	c:\windows\system32\perfh016.dat
2010-04-06 15:36 . 2009-11-07 15:11	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\Skype
2010-04-06 13:20 . 2009-12-21 01:03	--------	d-----w-	c:\documents and settings\Thamila\Dados de aplicativos\Skype
2010-04-05 03:38 . 2009-03-18 05:19	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\Free Download Manager
2010-04-05 00:51 . 2009-03-18 05:28	--------	d-----w-	c:\arquivos de programas\eMule
2010-03-16 02:59 . 2006-04-12 13:04	593981	----a-w-	c:\windows\system32\wbtapi.dll
2010-03-16 02:59 . 2006-04-12 13:32	1065037	----a-w-	c:\windows\system32\BTNeighborhood.dll
2010-03-14 15:36 . 2009-10-03 18:43	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Free Download Manager
2010-03-14 03:19 . 2010-02-28 19:16	--------	d-----w-	c:\arquivos de programas\Samsung
2010-03-14 03:19 . 2009-03-18 05:11	--------	d--h--w-	c:\arquivos de programas\InstallShield Installation Information
2010-03-11 01:26 . 2009-03-21 20:30	--------	d-----w-	c:\arquivos de programas\WinPcap
2010-03-07 15:46 . 2010-03-07 15:44	28672	----a-w-	c:\windows\system32\hodll.dll
2010-03-07 15:46 . 2010-03-07 15:44	20480	----a-w-	c:\windows\system32\lock.exe
2010-03-07 15:46 . 2010-03-07 15:44	458752	----a-w-	c:\windows\system32\ircsrv.exe
2010-03-07 15:46 . 2010-03-07 15:44	110592	----a-w-	c:\windows\system32\ftpserv.exe
2010-03-07 15:44 . 2010-03-07 15:44	16384	----a-w-	c:\windows\system32svc.exe
2010-03-07 03:22 . 2009-09-04 02:07	--------	d-----w-	c:\arquivos de programas
Lite
2010-03-06 21:12 . 2009-06-18 23:31	--------	d-----w-	c:\arquivos de programas\K-Lite Codec Pack
2010-03-06 21:12 . 2010-03-06 21:12	152576	----a-w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Sun\Java\jre1.6.0_12\lzma.dll
2010-03-06 21:08 . 2010-03-06 21:08	--------	d-----w-	c:\arquivos de programas\WMP11 Integrator
2010-03-06 01:07 . 2010-03-06 01:07	--------	d-----w-	c:\arquivos de programas\WIDCOMM
2010-03-05 03:02 . 2010-03-05 03:02	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Samsung
2010-03-04 04:52 . 2010-03-04 04:52	91176	----a-w-	c:\windows\system32\drivers\btwsecfl.sys
2010-03-04 04:52 . 2009-07-29 17:09	1064960	----a-w-	c:\windows\system32\btrez.dll
2010-03-04 04:47 . 2010-03-04 04:47	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\Samsung
2010-03-04 04:37 . 2010-03-04 04:37	--------	d-----w-	c:\arquivos de programas\DIFX
2010-02-27 13:28 . 2009-09-16 00:52	--------	d-----w-	c:\arquivos de programas\DivX
2010-02-27 13:25 . 2010-02-27 13:25	--------	d-----w-	c:\arquivos de programas\SmartSound Software Inc
2010-02-27 04:37 . 2009-04-05 15:26	--------	d-----w-	c:\documents and settings\All Users\Dados de aplicativos\DVD Shrink
2010-02-27 04:35 . 2009-09-15 05:59	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Ahead
2010-02-21 23:20 . 2010-02-21 23:20	--------	d-----w-	c:\arquivos de programas\Sun
2010-02-21 05:56 . 2009-11-07 14:48	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Skype
2010-02-21 05:49 . 2010-02-13 18:45	--------	d-----w-	c:\arquivos de programas\Windows Updates Downloader
2010-02-21 05:49 . 2010-01-04 23:15	--------	d-----w-	c:\arquivos de programas\SSH Communications Security
2010-02-21 05:12 . 2009-03-10 01:49	18944	----a-w-	c:\windows\system32\midimap.dll
2010-02-13 20:23 . 2009-04-05 15:30	--------	d-----w-	c:\arquivos de programas\Ahead
2010-02-13 18:26 . 2010-02-13 18:26	--------	d-----w-	c:\arquivos de programas\Microsoft
2010-02-13 18:26 . 2009-03-18 02:15	--------	d-----w-	c:\arquivos de programas\Windows Live
2010-02-08 23:15 . 2010-02-08 23:15	--------	d-----w-	c:\arquivos de programas\AKVIS
2010-02-08 23:03 . 2010-02-08 22:41	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\VSO
2010-02-08 22:40 . 2010-02-08 22:40	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Vso
2010-02-08 22:40 . 2010-02-08 22:40	47360	----a-w-	c:\windows\system32\drivers\pcouffin.sys
2010-02-08 22:40 . 2010-02-08 22:40	47360	----a-w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\pcouffin.sys
2010-02-08 22:40 . 2010-02-08 22:40	47360	----a-w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\pcouffin.sys
2010-02-08 22:40 . 2010-02-08 22:40	--------	d-----w-	c:\arquivos de programas\vso
2010-02-08 22:26 . 2010-02-08 22:26	--------	d-----w-	c:\arquivos de programas\WinAVI Video Converter 9.0
2010-01-15 04:43 . 2010-01-15 04:43	25992	----a-w-	c:\windows\system32\pgdfgsvc.exe
2010-01-15 02:40 . 2010-01-15 02:40	155648	----a-w-	c:\windows\system32\libssl32.dll
.

------- Sigcheck -------

[-] 2009-02-15 . 1F39C7BDBA4C5F3F01C4EABF7EDBF4B3 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers	cpip.sys

[-] 2009-03-10 . B0C0BF2504B830BFC1E93CA39F3C75FE . 549376 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2009-03-10 . 3707C65B6B650181CB069908827853A9 . 724992 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2009-03-10 . 7C0E5D593730414B5994A15A6D10C201 . 588288 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2009-03-15 . ABED1DC780B895077945A5D270DAD0F0 . 1554432 . . [6.00.2900.5634] . . c:\windows\explorer.exe

[-] 2009-02-15 . 0FBD5CA4F644DEE9AF687DD0DB6EFA89 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2009-03-10 . D67945A2290E98BB54D7792F09E7504E . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
(((((((((((((((((((((((((((((   SnapShot@2010-04-06_15.40.44   )))))))))))))))))))))))))))))))))))))))))
.
- 2002-09-11 11:00 . 2010-04-06 15:14	77094              c:\windows\system32\perfc009.dat
+ 2002-09-11 11:00 . 2010-04-06 15:43	77094              c:\windows\system32\perfc009.dat
+ 2002-09-11 11:00 . 2010-04-06 15:43	480466              c:\windows\system32\perfh009.dat
- 2002-09-11 11:00 . 2010-04-06 15:14	480466              c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e leg&iacute;timas por defeito n&atilde;o s&atilde;o mostradas. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
AnyDVD=c:\arquivos de programas\SlySoft\AnyDVD\AnyDVDtray.exe [2010-03-19 3353536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NVMixerTray=c:\arquivos de programas\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072]
NvCplDaemon=c:\windows\system32\NvCpl.dll [2005-02-24 5537792]
nwiz=nwiz.exe [2005-02-24 1495040]
DrvIcon=c:\arquivos de programas\VistaDriveIcon\DrvIcon.exe [2008-04-13 49152]
NvMediaCenter=c:\windows\system32\NvMcTray.dll [2005-02-24 86016]
NeroFilterCheck=c:\windows\system32\NeroCheck.exe [2001-07-09 155648]
BluetoothAuthenticationAgent=bthprops.cpl [2008-04-14 110592]
S2kCtl=c:\arquivos de programas\s2kcontrol\S2kCtl.exe [2005-12-03 587776]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
BTTray.lnk - c:\arquivos de programas\WIDCOMM\Bluetooth Software\BTTray.exe [2006-4-12 643133]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
NoSMConfigurePrograms= 1 (0x1)
NoResolveTrack= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
ForceClassicControlPanel= 1 (0x1)
NoSMConfigurePrograms= 1 (0x1)
NoResolveTrack= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	PDBoot.exe\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 20:10	35696	----a-w-	c:\arquivos de programas\Adobe\Reader 9.0\Readereader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2009-03-10 01:53	25088	----a-w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
AntiVirusOverride=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
%windir%\system32\sessmgr.exe=
c:\Arquivos de programas\Free Download Manager\fdm.exe=
c:\Arquivos de programas\eMule\emule.exe=
c:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe=
c:\Arquivos de programas\Skype\Phone\Skype.exe=

R1 Dev_UNIDRV;Dev_UNIDRV;c:\windows\system32\drivers\UNIDRV.SYS [18/4/2009 01:01 6080]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [21/2/2010 20:20 55520]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [21/2/2010 20:20 42048]
R2 BT848;Conexant's BtPCI WDM Video Capture;c:\windows\system32\drivers\BT848.sys [7/4/2009 00:51 371349]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [21/3/2009 17:55 66048]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\drivers\RTL8180.sys [15/2/2009 15:03 185344]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers
pf.sys [29/1/2008 22:24 34448]
S3 PD91Agent;PD91Agent;c:\arquivos de programas\Raxco\PerfectDisk2008\PD91Agent.exe [9/9/2008 13:49 693512]
S3 PD91Engine;PD91Engine;c:\arquivos de programas\Raxco\PerfectDisk2008\PD91Engine.exe [9/9/2008 13:49 906504]
S3 PEEK5;PEEK5 Protocol Driver;c:\ac\bin\Peek5.sys [15/3/2009 23:16 13184]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [6/1/2010 23:40 13532]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [28/2/2010 16:13 28704]

--- =Outros Servi&ccedil;os/Drivers Na Mem&oacute;ria ---

*NewlyCreated* - KNAJTLPI
*Deregistered* - knajtlpi
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = 
IE: Add to &Teleport - c:\arquivos de programas\Teleport Pro	eleport.htm
IE: Baixar com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dllink.htm
IE: Baixar tudo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlall.htm
IE: Baixar v&iacute;deo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlfvideo.htm
IE: Download selecionado pelo Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlselected.htm
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Enviar para Dispositivo &Bluetooth... - c:\arquivos de programas\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {BB231ECA-A5B1-4A6E-B6E5-8DE2D0786B86} = 8.8.8.8,8.8.4.4
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-06 13:03
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ... 

Procurando entradas auto inicializ&aacute;veis ocultas ... 

Procurando ficheiros/arquivos ocultos ... 

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85A2EAC8] CLASSPNP.SYS @ 0xf74dbf28
\Driver\ACPI -> ACPI.sys @ 0xf743ecb8
\Driver\atapi -> atapi.sys @ 0xf73d0852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
 ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
 ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf72c3bb0
 PacketIndicateHandler -> NDIS.sys @ 0xf72b2a0d
 SendHandler -> NDIS.sys @ 0xf72c6b40
user & kernel MBR OK 

**************************************************************************
.
--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_USERS\S-1-5-21-343818398-329068152-1177238915-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,91,bc,f8,05,07,22,6d,42,99,a3,f7,\
2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,91,bc,f8,05,07,22,6d,42,99,a3,f7,\
.
--------------------- DLLs Carregadas Sob os Processos em Execu&ccedil;&atilde;o ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\WININET.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\midimap.dll

- - - - - - - > 'lsass.exe'(620)
c:\windows\system32\WININET.dll
c:\windows\system32\SETUPAPI.dll

- - - - - - - > 'explorer.exe'(3176)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32
tshrui.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\midimap.dll
.
Tempo para conclus&atilde;o: 2010-04-06  13:07:08
ComboFix-quarantined-files.txt  2010-04-06 16:07
ComboFix2.txt  2010-04-06 15:45
ComboFix3.txt  2010-03-09 02:24

Pr&eacute;-execu&ccedil;&atilde;o: 148.959.232 bytes dispon&iacute;veis
P&oacute;s execu&ccedil;&atilde;o: 131.694.592 bytes dispon&iacute;veis

- - End Of File - - DD0869A95474C45B3AC73092689C40B8

Answer

Fa&ccedil;a o download do Malwarebytes:
http://majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

 1) Instale o aplicativo, atualiza-o e efetue uma verifica&ccedil;&atilde;o completa.

  2) Quando terminar o scan., se algum malware foi detectado., clique em (Exibir resultado), e depois clique em (remover selecionados). 
 Abrir&aacute; um Relat&oacute;rio automatico, Copia e cole aqui.

 3) as infec&ccedil;&otilde;es ser&atilde;o enviadas para quarentena., e alguns tipos poder&atilde;o exigir a reinicializa&ccedil;&atilde;o do sistema.

Answer

Feito. Tai o log.

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org
Vers&atilde;o da Base de Dados: 3961
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
6/4/2010 22:52:30
mbam-log-2010-04-06 (22-52-30).txt
Tipo de Verifica&ccedil;&atilde;o: Verifica&ccedil;&atilde;o Completa (C:\|D:\|)

Objetos escaneados: 133251
Tempo decorrido: 40 minuto(s), 48 segundo(s)
Processos de Mem&oacute;ria Infectados: 0
M&oacute;dulos de Mem&oacute;ria Infectados: 0
Chaves de Registro Infectadas: 0
Valores de Registro Infectados: 0
Itens de Dados no Registro Infectados: 0
Pastas Infectadas: 0
Arquivos Infectados: 0
Processos de Mem&oacute;ria Infectados: 
(N&atilde;o foram detectados &iacute;tens maliciosos)
M&oacute;dulos de Mem&oacute;ria Infectados: 
(N&atilde;o foram detectados &iacute;tens maliciosos)
Chaves de Registro Infectadas:
(N&atilde;o foram detectados &iacute;tens maliciosos)
Valores de Registro Infectados:
(N&atilde;o foram detectados &iacute;tens maliciosos)
Itens de Dados no Registro Infectados: 
(N&atilde;o foram detectados &iacute;tens maliciosos)
Pastas Infectadas: 
(N&atilde;o foram detectados &iacute;tens maliciosos)
Arquivos Infectados:
(N&atilde;o foram detectados &iacute;tens maliciosos)

Answer

MalwareBytes-> nada ?? Hum... vamos a uma contra-prova!!

acesse o site descrito abaixo e efetue uma verifica&ccedil;&atilde;o online:

http://www.eset.com/online-scanner

** http://dicasetutoriaisparapc.blogspot.com/2008/09/tutorial-do-antivirus-nod32-online.html **

Answer

[quote=wolf09, post: 4891369]MalwareBytes-> nada ?? Hum... vamos a uma contra-prova!!

acesse o site descrito abaixo e efetue uma verifica&ccedil;&atilde;o online:

http://www.eset.com/online-scanner

** http://dicasetutoriaisparapc.blogspot.com/2008/09/tutorial-do-antivirus-nod32-online.html **[/QUOTE]

Entre responder sua MP e ver essa mensagem, eu busquei algumas a&ccedil;&otilde;es no PC. Estou meio sem tempo, at&eacute; amanha fico dando aula at&eacute; 22:00. 

Eu iniciei com o Hirens Boot Cd, usando o Mini Windows XP dele, para conseguir ver algum arquivo escondido, n&atilde;o vi nenhum arquivo .sys estranho, e retirei aqueles arquivos que tinha negritado no log do combofix. Lock.exe, rsvc.exe e etc. Reiniciei o PC e tamb&eacute;m enviei eles para o virustotal. o rsvc.exe foi detectado por alguns engines com assinaturas gen&eacute;ricas ou heur&iacute;sticas. Acho que esse bichinho &eacute; novo hee :daa: 

Nisso, notei que o Driver do HD n&atilde;o aparecia no Gerenciador de dispositivos. O que me deu certeza que tinha zebra mesmo. Experimentei retirar o driver IDE para ver se na re-detecc&atilde;o o sistema bypassava esse rootkit e tamb&eacute;m troquei o driver padr&atilde;o por um da nvidia (for&ccedil;ado). Ai ele nem detecta o HD nas suas informa&ccedil;&otilde;es. 

Baixei o Gmer Rootkit detector, rodei e ele n&atilde;o acha nada que ele pr&oacute;prio consegue remover. Por&eacute;m ele lista v&aacute;rias coisas suspeitas, lista o driver cdrom.sys como suspeito, lista sempre um driver em configura&ccedil;&otilde;es locais	emp do usu&aacute;rio ativo, mas informando que o arquivo n&atilde;o pode ser encontrado e por ai vai. O detalhe &eacute; que quando eu iniciei com o hirens, que n&atilde;o teria como o arquivo estar escondido, eu limpei os temps todos, as pastas recycler, a system volume information (restaura&ccedil;&atilde;o do sistema) e etc, e mesmo assim ele fica indicando esse arquivo carregado no temp, nisso suspeito que tem algum arquivo, talves o disk.sys que por sua vez carrega algum arquivo tempor&aacute;rio. J&aacute; que toda hora &eacute; detectado um arquivo diferente. A ultima vez detectou um mbr.sys l&aacute; no temp. 

Iniciei pelo console de recupera&ccedil;&atilde;o, listei os servi&ccedil;os, notando principalmente os com tipo de inicializa&ccedil;&atilde;o Boot para ver se aparecia algo estranho e n&atilde;o vi nada (ao menos n&atilde;o percebi), apenas um servi&ccedil;o chamado mup, eu n&atilde;o conhe&ccedil;o, n&atilde;o sei se &eacute; do windows ou n&atilde;o, e nas propriedades do arquivo que ele se referia me pareceu coisa do XP mesmo. Fiz um mbrfix e rodei o chkdsk. 

Tudo continuou doid&atilde;o. O HD n&atilde;o aparece, o chrome (mesmo reinstalando e desinstalando e depois instalando) n&atilde;o funciona. Ele abre, mas n&atilde;o carrega a tela de boas vindas e n&atilde;o vai a nenhuma p&aacute;gina. O resto funciona normal.

Instalei o avira 10, quando botei o rootkit search dele para rodar, ficou parad&atilde;o, n&atilde;o scaneava. 

Por fim, eu iniciei no modo seguro e coloquei o combofix pra rodar, fui deitar um pouco que ele est&aacute; demorando pra rodar acabei dormindo, cedo fui ver, ele n&atilde;o tinha terminado, mas o PC n&atilde;o reiniciou pois estava logado no usu&aacute;rio e como tem senha n&atilde;o tem como ele ter logado sozinho. Parece que ele fechou...

Chegando em casa eu passo o scan online

Answer

ap&oacute;s efetuar a verifica&ccedil;&atilde;o online... se nada for detectado.. acesse o site www.virscan.org e efetue uma an&aacute;lise nos arquivos suspeitos indicados abaixo:

c:\windows\system32\hodll.dll
c:\windows\system32\lock.exe
c:\windows\system32\ircsrv.exe
c:\windows\system32\ftpserv.exe
c:\windows\system32\rsvc.exe

Answer

Valeu pela ajuda cara..

Na hora do almo&ccedil;o, levei alguns rootkits detector pra casa no pen, rodei 2 enquanto almo&ccedil;ava, o m&aacute;ximo que detectou foram chaves de registro ocultas.

Bom, pelo tempo, n&atilde;o daria para rodar o scanner online naquela hora, bootei o PC dinovo pelo Hirens e dessa vez achei os arquivos .sys do Rootkit.

Compactei eles para depois mandar para an&aacute;lise e apaguei. 
Reiniciei o PC e de imediato o HD foi detectado, apareceu no gerenciador de tarefas e etc.

Nem deu tempo de olhar se o Chrome voltou a funcionar, sai vazado para trabalhar. 
Parece que era s&oacute; eles. Achei v&aacute;rios arquivos .sys com nome de letras e n&uacute;meros no System32 e system32\drivers, uns 6 arquivos.

Anexei uma imagem.

Answer

Alguns arquivos referentes a Drivers e/ou servi&ccedil;os possuem nomes com letras e n&uacute;meros como por exemplo na imagem acima postada: arp1394.sys, aspi32.sys, alim1541.sys, agp440.sys... o detalhe &eacute; que como outros exemplos j&aacute; conhecidos alguns malwares podem se camuflar usando nomes id&ecirc;nticos. Mas geralmente quando esses arquivos se encontram na pasta c:\windows\system32\drivers s&atilde;o leg&iacute;timos.

Answer

Na imagem me referia ao 7d2a.sys, e outros com mesma data de modifica&ccedil;&atilde;o (data de hoje)

Tinham mais em outras &aacute;reas. Removi e o problema aparentemente parou.
Chegando a noite em casa eu vou fazer os demais procedimentos que voc&ecirc; indicou, ai ter&aacute; tempo.

------EDIT------

Mandei os arquivos num ZIP para serem analizados. Segue o resultado. Achei que ele daria ao menos em qual dos arquivos internos foi detectado algum virus, mas n&atilde;o.

VirSCAN.org Scanned Report :
Scanned time   : 2010/04/07 20:51:38 (ACT)
Scanner results: 28% Software(10/36) encontrou c&oacute;digo malicioso!
File Name      : 65d2 infectado.rar
File Size      : 1606703 byte
File Type      : RAR archive data, v1d, os
MD5            : e05b21a71e4d223d6441ef23f0ee6aa1
SHA1           : 95cf4c707281151f6a4b4665bbe5a240af2a7af2
Online report  : http://virscan.org/report/deb9af668502525cce97e79d1056cee4.html

Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      4.5.0.8         20100408050136    2010-04-08  5.71   Rootkit.Patched.TDSS!IK
AhnLab V3      2010.04.08.00   2010.04.08        2010-04-08  3.05   -
AntiVir        8.2.1.210       7.10.6.41         2010-04-07  0.93   TR/Patched.Gen
Antiy          2.0.18          20100407.4151698  2010-04-07  0.78   -
Arcavir        2009            201004071818      2010-04-07  0.82   -
Authentium     5.1.1           201004071206      2010-04-07  2.92   -
AVAST!         4.7.4           100407-1          2010-04-07  0.36   -
AVG            8.5.720         271.1.1/2797      2010-04-08  1.23   Hook.CF
BitDefender    7.81008.5595934 7.31134           2010-04-08  4.28   Rootkit.Patched.TDSS.Gen
ClamAV         0.95.3          10714             2010-04-08  0.56   -
Comodo         3.13.579        4535              2010-04-08  1.38   UnclassifiedMalware
CP Secure      1.3.0.5         2010.04.02        2010-04-02  0.00   -
Dr.Web         5.0.2.3300      2010.04.08        2010-04-08  7.96   -
F-Prot         4.4.4.56        20100407          2010-04-07  2.86   -
F-Secure       7.02.73807      2010.04.07.15     2010-04-07  1.57   -
Fortinet       4.0.14          11.671            2010-04-07  1.31   -
GData          19.10963/19.871 20100407          2010-04-07  7.42   -
ViRobot        20100407        2010.04.07        2010-04-07  0.44   -
Ikarus         T3.1.01.80      2010.04.08.75576  2010-04-08  6.09   Rootkit.Patched.TDSS
JiangMin       13.0.900        2010.04.07        2010-04-07  1.38   -
Kaspersky      5.5.10          2010.04.07        2010-04-07  1.27   -
KingSoft       2009.2.5.15     2010.4.7.22       2010-04-07  0.79   -
McAfee         5400.1158       5943              2010-04-06  0.02   -
Microsoft      1.5605          2010.04.08        2010-04-08  7.20   -
Norman         6.04.11         6.04.00           2010-04-07  12.01  -
Panda          9.05.01         2010.04.07        2010-04-07  2.23   Application/KeylogHoddle.A
Trend Micro    9.120-1004      6.978.05          2010-04-07  0.00   -
Quick Heal     10.00           2010.04.07        2010-04-07  8.36   -
Rising         20.0            22.42.03.00       2010-04-08  1.63   -
Sophos         3.06.0          4.52              2010-04-08  3.63   Mal/TDSSRt-A
Sunbelt        3.9.2412.2      6149              2010-04-07  13.62  ], [      LooksLike.Win32.PatchedDriver!A (v)
Symantec       1.3.0.24        20100407.002      2010-04-07  0.59   -
nProtect       20100405.01     7907880           2010-04-05  5.84   -
The Hacker     6.5.2.0         v00257            2010-04-07  1.02   Trojan/Keylogger
VBA32          3.12.12.4       20100406.2034     2010-04-06  4.67   -
VirusBuster    4.5.11.10       10.122.36/2039118 2010-04-07  2.98   -

Pior que baixei 154 MB pra ter isso ai hahaha :daa:

O scanner online t&aacute; baixando e vou deixar rodar assim que acabar.
Ah, to no Chrome dinovo j&aacute;...

Passei o Scanner online, achou 9 arquivos, s&oacute; que foram detec&ccedil;&otilde;es heur&iacute;sticas (provavelmente fulano, ciclano) e s&oacute; nos meus arquivos suspeitos mesmo (keygens e etc). Ent&atilde;o parece que era s&oacute; o rootkit mesmo.

Segue o log do combofix que passei agora depois da limpeza. Ai apareceu as chamadas no registro para o rootkit uma vez que o arquivo n&atilde;o est&aacute; mais na mem&oacute;ria se escondendo.

ComboFix 10-04-05.06 - MezengaAdm 08/04/2010   7:14.20.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.55.1046.18.479.92 [GMT -3:00]
Executando de: c:\documents and settings\MezengaAdm\Desktop\k0mboF1x.exe
.

((((((((((((((((   Arquivos/Ficheiros criados de 2010-03-08 to 2010-04-08  ))))))))))))))))))))))))))))
.

2010-11-01 01:51 . 2009-10-11 19:54	--------	d-----w-	c:\arquivos de programas\Aur&eacute;lio - S&eacute;culo XXI
2010-04-08 01:46 . 2010-04-08 01:46	--------	d-----w-	c:\arquivos de programas\ESET
2010-04-07 15:56 . 2008-04-13 17:40	62976	----a-w-	c:\windows\system32\drivers\cdrom.sys
2010-04-07 10:50 . 2006-04-14 17:00	208896	----a-w-	c:\windows\system32
vuide.exe
2010-04-07 01:42 . 2010-04-07 01:42	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Malwarebytes
2010-04-07 01:41 . 2010-03-29 18:24	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-07 01:41 . 2010-04-07 01:44	--------	d-----w-	c:\arquivos de programas\Malwarebytes' Anti-Malware
2010-04-07 01:41 . 2010-04-07 01:41	--------	d-----w-	c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2010-04-07 01:41 . 2010-03-29 18:24	20824	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-04-06 23:51 . 2010-04-08 01:48	--------	d-----w-	c:\windows\system32
&atilde;o seguro
2010-04-05 01:13 . 2010-04-05 01:13	--------	d-----w-	c:\arquivos de programas\Sony
2010-04-05 01:12 . 2010-04-05 01:12	--------	d-----w-	c:\arquivos de programas\Sony Setup
2010-04-05 00:24 . 2010-04-05 00:30	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Gold Wave Editor
2010-04-04 17:36 . 2010-04-04 17:36	--------	d-----w-	c:\arquivos de programas\Alien Connections
2010-04-02 15:06 . 2007-10-23 12:27	110592	----a-w-	c:\documents and settings\Bruno\Dados de aplicativos\U3	emp\cleanup.exe
2010-04-02 15:06 . 2008-05-02 13:41	3493888	---ha-w-	c:\documents and settings\Bruno\Dados de aplicativos\U3	emp\Launchpad Removal.exe
2010-04-02 15:04 . 2010-04-02 15:06	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\U3
2010-03-19 13:31 . 2010-03-19 13:31	89256	----a-w-	c:\windows\system32\ElbyCDIO.dll
2010-03-18 16:45 . 2010-03-18 16:45	104768	----a-w-	c:\windows\system32\drivers\AnyDVD.sys
2010-03-16 03:01 . 2010-03-16 03:01	--------	d-----w-	c:\documents and settings\MezengaAdm\Bluetooth Software
2010-03-16 01:53 . 2008-04-13 17:46	37888	----a-w-	c:\windows\system32\drivers\bthmodem.sys
2010-03-16 01:44 . 2008-04-13 17:51	101120	----a-w-	c:\windows\system32\drivers\bthpan.sys
2010-03-16 01:43 . 2008-04-14 01:20	8192	----a-w-	c:\windows\system32\wshirda.dll
2010-03-16 01:43 . 2008-04-14 01:20	28672	----a-w-	c:\windows\system32\irmon.dll
2010-03-16 01:43 . 2008-04-13 17:46	59136	----a-w-	c:\windows\system32\driversfcomm.sys
2010-03-16 01:43 . 2008-04-13 17:46	17024	----a-w-	c:\windows\system32\drivers\bthenum.sys
2010-03-16 01:43 . 2008-04-14 01:21	152576	----a-w-	c:\windows\system32\irftp.exe
2010-03-16 01:43 . 2008-04-13 17:46	18944	----a-w-	c:\windows\system32\drivers\BTHUSB.SYS
2010-03-14 01:26 . 2010-03-14 01:38	--------	d-----w-	c:\arquivos de programas\YAMAHA
2010-03-12 03:15 . 2007-03-28 15:05	35332	----a-w-	c:\windows\system32\uninst.exe
2010-03-12 03:15 . 2004-04-01 02:38	1350656	----a-w-	c:\windows\system32\Screen Antics.scr
2010-03-12 03:10 . 2010-03-12 03:10	--------	d-----w-	c:\arquivos de programas\Nuganics
2010-03-12 03:10 . 2010-03-12 03:10	1807938	----a-w-	c:\windows\system32\Licking Dog Screen Clean.scr
2010-03-12 02:40 . 2010-03-12 02:40	--------	d-----w-	c:\documents and settings\MezengaAdm\WINDOWS
2010-03-12 02:40 . 1994-07-11 06:00	4784	----a-w-	c:\windows\system\SPMME.DRV
2010-03-12 02:34 . 2010-03-12 02:34	--------	d--h--w-	c:\windows\PIF
2010-03-11 01:30 . 2010-03-11 01:30	--------	d-----w-	c:\arquivos de programas\AwinSoft
2010-03-11 00:54 . 2009-10-23 15:28	3558912	-c----w-	c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((   Relat&oacute;rio Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-08 01:44 . 2010-04-07 15:56	2470	----a-w-	c:\windows\system32\PerfStringBackup.TMP
2010-04-07 11:53 . 2009-12-21 01:03	--------	d-----w-	c:\documents and settings\Thamila\Dados de aplicativos\Skype
2010-04-07 09:36 . 2009-11-07 15:11	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\Skype
2010-04-07 02:09 . 2009-10-03 18:43	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Free Download Manager
2010-04-05 03:38 . 2009-03-18 05:19	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\Free Download Manager
2010-04-05 00:51 . 2009-03-18 05:28	--------	d-----w-	c:\arquivos de programas\eMule
2010-03-16 02:59 . 2006-04-12 13:04	593981	----a-w-	c:\windows\system32\wbtapi.dll
2010-03-16 02:59 . 2006-04-12 13:32	1065037	----a-w-	c:\windows\system32\BTNeighborhood.dll
2010-03-14 03:19 . 2010-02-28 19:16	--------	d-----w-	c:\arquivos de programas\Samsung
2010-03-14 03:19 . 2009-03-18 05:11	--------	d--h--w-	c:\arquivos de programas\InstallShield Installation Information
2010-03-11 01:26 . 2009-03-21 20:30	--------	d-----w-	c:\arquivos de programas\WinPcap
2010-03-07 03:22 . 2009-09-04 02:07	--------	d-----w-	c:\arquivos de programas
Lite
2010-03-06 21:12 . 2009-06-18 23:31	--------	d-----w-	c:\arquivos de programas\K-Lite Codec Pack
2010-03-06 21:12 . 2010-03-06 21:12	152576	----a-w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Sun\Java\jre1.6.0_12\lzma.dll
2010-03-06 21:08 . 2010-03-06 21:08	--------	d-----w-	c:\arquivos de programas\WMP11 Integrator
2010-03-06 01:07 . 2010-03-06 01:07	--------	d-----w-	c:\arquivos de programas\WIDCOMM
2010-03-05 03:02 . 2010-03-05 03:02	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Samsung
2010-03-04 04:52 . 2010-03-04 04:52	91176	----a-w-	c:\windows\system32\drivers\btwsecfl.sys
2010-03-04 04:52 . 2009-07-29 17:09	1064960	----a-w-	c:\windows\system32\btrez.dll
2010-03-04 04:47 . 2010-03-04 04:47	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\Samsung
2010-03-04 04:37 . 2010-03-04 04:37	--------	d-----w-	c:\arquivos de programas\DIFX
2010-02-27 13:28 . 2009-09-16 00:52	--------	d-----w-	c:\arquivos de programas\DivX
2010-02-27 13:25 . 2010-02-27 13:25	--------	d-----w-	c:\arquivos de programas\SmartSound Software Inc
2010-02-27 04:37 . 2009-04-05 15:26	--------	d-----w-	c:\documents and settings\All Users\Dados de aplicativos\DVD Shrink
2010-02-27 04:35 . 2009-09-15 05:59	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Ahead
2010-02-21 23:20 . 2010-02-21 23:20	--------	d-----w-	c:\arquivos de programas\Sun
2010-02-21 05:56 . 2009-11-07 14:48	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Skype
2010-02-21 05:49 . 2010-02-13 18:45	--------	d-----w-	c:\arquivos de programas\Windows Updates Downloader
2010-02-21 05:49 . 2010-01-04 23:15	--------	d-----w-	c:\arquivos de programas\SSH Communications Security
2010-02-21 05:12 . 2009-03-10 01:49	18944	----a-w-	c:\windows\system32\midimap.dll
2010-02-13 20:23 . 2009-04-05 15:30	--------	d-----w-	c:\arquivos de programas\Ahead
2010-02-13 18:26 . 2010-02-13 18:26	--------	d-----w-	c:\arquivos de programas\Microsoft
2010-02-13 18:26 . 2009-03-18 02:15	--------	d-----w-	c:\arquivos de programas\Windows Live
2010-02-08 23:15 . 2010-02-08 23:15	--------	d-----w-	c:\arquivos de programas\AKVIS
2010-02-08 23:03 . 2010-02-08 22:41	--------	d-----w-	c:\documents and settings\Bruno\Dados de aplicativos\VSO
2010-02-08 22:40 . 2010-02-08 22:40	--------	d-----w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\Vso
2010-02-08 22:40 . 2010-02-08 22:40	47360	----a-w-	c:\windows\system32\drivers\pcouffin.sys
2010-02-08 22:40 . 2010-02-08 22:40	47360	----a-w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\pcouffin.sys
2010-02-08 22:40 . 2010-02-08 22:40	47360	----a-w-	c:\documents and settings\MezengaAdm\Dados de aplicativos\pcouffin.sys
2010-02-08 22:40 . 2010-02-08 22:40	--------	d-----w-	c:\arquivos de programas\vso
2010-02-08 22:26 . 2010-02-08 22:26	--------	d-----w-	c:\arquivos de programas\WinAVI Video Converter 9.0
2010-01-15 04:43 . 2010-01-15 04:43	25992	----a-w-	c:\windows\system32\pgdfgsvc.exe
.

------- Sigcheck -------

[-] 2009-02-15 . 1F39C7BDBA4C5F3F01C4EABF7EDBF4B3 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers	cpip.sys

[-] 2009-03-10 . B0C0BF2504B830BFC1E93CA39F3C75FE . 549376 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2009-03-10 . 3707C65B6B650181CB069908827853A9 . 724992 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2009-03-10 . 7C0E5D593730414B5994A15A6D10C201 . 588288 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2009-03-15 . ABED1DC780B895077945A5D270DAD0F0 . 1554432 . . [6.00.2900.5634] . . c:\windows\explorer.exe

[-] 2009-02-15 . 0FBD5CA4F644DEE9AF687DD0DB6EFA89 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2009-03-10 . D67945A2290E98BB54D7792F09E7504E . 25088 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
(((((((((((((((((((((((((((((   SnapShot@2010-04-06_15.40.44   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 03:02 . 2009-07-12 03:02	51008              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	59728              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	42832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	43344              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	61264              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	62800              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	61760              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	53568              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	63296              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	36688              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	35648              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-12 03:05 . 2009-07-12 03:05	59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-12 03:05 . 2009-07-12 03:05	59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2010-04-07 10:50 . 2008-04-13 13:40	24960              c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\pciidex.sys
+ 2010-04-07 10:50 . 2008-04-13 17:40	96512              c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\atapi.sys
+ 2009-03-03 00:46 . 2006-04-14 17:01	35840              c:\windows\system32\NVCOI.DLL
+ 2010-03-07 15:44 . 2010-03-07 15:44	16384              c:\windows\system32
&atilde;o segurosvc.exe [exclu&iacute;]
+ 2010-03-07 15:44 . 2010-03-07 15:46	20480              c:\windows\system32
&atilde;o seguro\lock.exe[exclu&iacute;]
+ 2010-03-07 15:44 . 2010-03-07 15:46	28672              c:\windows\system32
&atilde;o seguro\hodll.dll [exclu&iacute;]
- 2008-04-13 13:40 . 2008-04-13 13:40	96512              c:\windows\system32\drivers\atapi.sys
+ 2008-04-13 13:40 . 2008-04-13 17:40	96512              c:\windows\system32\drivers\atapi.sys
+ 2010-04-07 10:50 . 2002-09-11 11:00	3456              c:\windows\system32\ReinstallBackups\0020\DriverFiles\i386\pciide.sys
+ 2009-07-12 03:02 . 2009-07-12 03:02	653120              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	569664              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-12 03:05 . 2009-07-12 03:05	225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2010-01-15 02:40 . 2010-01-15 02:40	155648              c:\windows\system32
&atilde;o seguro\libssl32.dll
+ 2010-03-07 15:44 . 2010-03-07 15:46	458752              c:\windows\system32
&atilde;o seguro\ircsrv.exe
+ 2010-03-07 15:44 . 2010-03-07 15:46	110592              c:\windows\system32
&atilde;o seguro\ftpserv.exe
+ 2009-03-17 21:16 . 2010-03-07 21:24	198552              c:\windows\system32
&atilde;o seguro\FNTCACHE.DAT
+ 2010-04-07 15:51 . 2010-04-07 15:51	198552              c:\windows\system32\FNTCACHE.DAT
- 2009-03-17 21:16 . 2010-03-07 21:24	198552              c:\windows\system32\FNTCACHE.DAT
+ 2010-04-07 02:04 . 2010-04-07 02:04	219648              c:\windows\Installer\23240e.msi
+ 2009-07-12 03:02 . 2009-07-12 03:02	3780424              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-12 03:02 . 2009-07-12 03:02	3765048              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e leg&iacute;timas por defeito n&atilde;o s&atilde;o mostradas. 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NVMixerTray=c:\arquivos de programas\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072]
NvCplDaemon=c:\windows\system32\NvCpl.dll [2005-02-24 5537792]
nwiz=nwiz.exe [2005-02-24 1495040]
DrvIcon=c:\arquivos de programas\VistaDriveIcon\DrvIcon.exe [2008-04-13 49152]
NvMediaCenter=c:\windows\system32\NvMcTray.dll [2005-02-24 86016]
NeroFilterCheck=c:\windows\system32\NeroCheck.exe [2001-07-09 155648]
BluetoothAuthenticationAgent=bthprops.cpl [2008-04-14 110592]
S2kCtl=c:\arquivos de programas\s2kcontrol\S2kCtl.exe [2005-12-03 587776]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
BTTray.lnk - c:\arquivos de programas\WIDCOMM\Bluetooth Software\BTTray.exe [2006-4-12 643133]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
NoSMConfigurePrograms= 1 (0x1)
NoResolveTrack= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
ForceClassicControlPanel= 1 (0x1)
NoSMConfigurePrograms= 1 (0x1)
NoResolveTrack= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	PDBoot.exe\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 20:10	35696	----a-w-	c:\arquivos de programas\Adobe\Reader 9.0\Readereader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2009-03-10 01:53	25088	----a-w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
AntiVirusOverride=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
%windir%\system32\sessmgr.exe=
c:\Arquivos de programas\Free Download Manager\fdm.exe=
c:\Arquivos de programas\eMule\emule.exe=
c:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe=
c:\Arquivos de programas\Skype\Phone\Skype.exe=

R1 Dev_UNIDRV;Dev_UNIDRV;c:\windows\system32\drivers\UNIDRV.SYS [18/4/2009 01:01 6080]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [21/2/2010 20:20 55520]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [21/2/2010 20:20 42048]
R2 BT848;Conexant's BtPCI WDM Video Capture;c:\windows\system32\drivers\BT848.sys [7/4/2009 00:51 371349]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [21/3/2009 17:55 66048]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\drivers\RTL8180.sys [15/2/2009 15:03 185344]
S0 0269;0269;c:\windows\system32\drivers\0269.SYS --> c:\windows\system32\drivers\0269.SYS [?]
S1 7d2A;7d2A;\??\c:\windows\system32\drivers\7d2A.SYS --> c:\windows\system32\drivers\7d2A.SYS [?]
S2 fe1B;fe1B;\??\c:\windows\system32\drivers\fe1B.SYS --> c:\windows\system32\drivers\fe1B.SYS [?]
S3 65d2;65d2;\??\c:\windows\system32\65d2.sys --> c:\windows\system32\65d2.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers
pf.sys [29/1/2008 22:24 34448]
S3 PD91Agent;PD91Agent;c:\arquivos de programas\Raxco\PerfectDisk2008\PD91Agent.exe [9/9/2008 13:49 693512]
S3 PD91Engine;PD91Engine;c:\arquivos de programas\Raxco\PerfectDisk2008\PD91Engine.exe [9/9/2008 13:49 906504]
S3 PEEK5;PEEK5 Protocol Driver;c:\ac\bin\Peek5.sys [15/3/2009 23:16 13184]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [6/1/2010 23:40 13532]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [28/2/2010 16:13 28704]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = 
IE: Add to &Teleport - c:\arquivos de programas\Teleport Pro	eleport.htm
IE: Baixar com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dllink.htm
IE: Baixar tudo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlall.htm
IE: Baixar v&iacute;deo com o Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlfvideo.htm
IE: Download selecionado pelo Free Download Manager - file://c:\arquivos de programas\Free Download Manager\dlselected.htm
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Enviar para Dispositivo &Bluetooth... - c:\arquivos de programas\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {BB231ECA-A5B1-4A6E-B6E5-8DE2D0786B86} = 8.8.8.8,8.8.4.4
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-08 07:18
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ&aacute;veis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execu&ccedil;&atilde;o ---------------------

- - - - - - - > 'winlogon.exe'(560)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
c:\windows\system32\midimap.dll

- - - - - - - > 'lsass.exe'(616)
c:\windows\system32\SETUPAPI.dll

- - - - - - - > 'explorer.exe'(1300)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\WININET.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\LINKINFO.dll
c:\windows\system32
tshrui.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\midimap.dll
.
Tempo para conclus&atilde;o: 2010-04-08  07:20:18
ComboFix-quarantined-files.txt  2010-04-08 10:20
ComboFix2.txt  2010-04-07 05:19
ComboFix3.txt  2010-04-07 03:15
ComboFix4.txt  2010-04-06 16:07
ComboFix5.txt  2010-04-07 10:49

Pr&eacute;-execu&ccedil;&atilde;o: 53.035.008 bytes dispon&iacute;veis
P&oacute;s execu&ccedil;&atilde;o: 53.645.312 bytes dispon&iacute;veis

- - End Of File - - 97DC2DEB8AD28240AD2E3CAB93CB6922

Answer

Fa&ccedil;a o download do Avast 5:
http://files.avast.com/iavs5x/setup_av_free.exe

** http://dicasetutoriaisparapc.blogspot.com/2010/01/tutorial-do-avast-5-edicao-gratuita.html **

-- com avast 5 instalado, configurado e devidamente atualizado., programe uma verifica&ccedil;&atilde;o na inicializa&ccedil;&atilde;o do sistema. Abra o aplicativo clique em Escaneamento->Escaneamento ao reiniciar... selecione os itens a serem verificados...clique em agendar e para finalizar clique em Reiniciar o computador. Aguarde a verifica&ccedil;&atilde;o.

Ferramentas

Mover Tópico