Win32.Delf.uv and Hupigon13 return on reboot

[Wardo]

Greetings,

A few hours ago my Avast anti-virus launched a bunch of alerts of infected Temporary Internet files (http://img73.imageshack.us/img73/1585/avastlog.jpg) after I visited a now obviously bad website; I kept telling Avast to delete the files while doing ALT-F4 on Internet Explorer.

Knowing the brown matter had already hit the fan, I opened IE again and deleted all cache: Temporary Internet Files, Cookies and even Form Data and Passwords, neither of which I even use. Knowing from a virtumonde infection in the past that this would not be enough I updated the mighty Spybot and allowed it to scan for trouble. It found the two bastards mentioned in the title: Win32.Delf.uv and Hupigon13.

Spybot supposedly fixed the problems, but I knew this type of pest was not that easy to remove and so I used my PC for a few more hours to do what I had to do before rebooting to see the extent of the damage. At first it seemed terrible: Windows would initialize to a point, the desktop would appear, the icons and the task bar aswell, but the task bar was "frozen" and Ctrl+Alt+Del wouldn't open the task manager. I turn the PC off by holding the power button and attempted to boot in Safe-Mode, but that didn't work as I'd just get a blue-screen and then a reboot before Windows even began initializing, and so I booted normally again and decided to wait it out, and after about 10 minutes everything went back to normal, no slow down or anything.

I ran Spybot again and it detected Win32.Delf.uv and Hupigon13 again, and I ordered it to fix once more.

To run HijackThis I had to rename HijackThis.exe to hello.exe for it to open, and then I got an error right as it began to scan:

"an unexpected error has occured at procedure: modRegistry_IniGetString(sFile=system.ini, sSection=boot, sValue=Shell)
Error #5 - Invalid procedure call or argument"
HJT version 2.0.2

I clicked yes on report the error, then got a No Internet Connection Available box with an Ok button, clicked Ok, then the same error above but with (sFile=win.ini, sSection=windows, sValue=load)

They look like this: http://img73.imageshack.us/img73/9968/hjterror.jpg

After that it produced a log, and here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:40:22, on 19/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\runservice.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Trend Micro\HijackThis\hello.exe
C:\WINDOWS\system32\mspaint.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Arquivos de programas\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www2.rasterwerks.com/game/phosphor/beta1.asp"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/ca..._2.3.7.109.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1235270134703
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD7/JSCDL/j...javadl.sun.com
O16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://cnn-5.vo.llnwd.net/c1/static/...WebUpdater.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Log de eventos EventlogNtLmSsp (EventlogNtLmSsp) - Unknown owner - C:\WINDOWS\system32\adptrmyhelpq.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 7665 bytes

PS.: Teatimer has been off the whole time. And I have backed up the registry with Erunt a few seconds ago.

Ok, by now I know a little better what's going on. I'm not actually "infected" by anything, Avast! seems to have destroyed the invaders early on before they could do extensive damage.

However, something was left over that keeps creating Debugger keys in the registry "Image File Execution Options" with the value "ntsd -d" on a list of programs every time Windows starts. It's relatively harmless, the Windows boot-up simply takes longer as the task bar and task manager (among who knows what else...) remain frozen from 5 to 10 minutes long (even though I can run Spybot, Malwarebytes, etc. from shortcuts or Windows Explorer), but then come back to normal on their own and I can use the computer as usual, no slow downs, redirects, alerts, nothing, and I can remove these keys with Spybot (some keys) or Malwarebytes antimalware (all keys). Besides the debuggers I also get 3 persistent changes to Security Center in the registry (AntiVirusDisableNotify, FirewallDisableNotify, UpdatesDisableNotify).

The other problem is that I cannot boot-up in Safe-mode for some reason, when I try to do so I can see the list of drivers or whatever loading but then I get a very uninformative Blue Screen of Death that reads (translating):

-
A problem was detected and Windows shut down to avoid damage to the computer.

If this is the first time you see this screen reboot. If seen again follow these steps:

Check for virus in the computer. Remove any HDD or HDD controller installed recently. Check the HDD to verify if it's configured and connected properly. Execute CHKDSK /F to verify if the HDD has been corrupted and restart the computer.

Technical information:
*** STOP: 0x0000007B (0xF789E524, 0x00000034, 0x00000000, 0x00000000)
-

A little drastic. Perhaps it's just the boot.ini or some other .ini? Perhaps it's the Rootkit.

Anyway, my problem is basically finding the cause of the debugger keys being created in the registry at every reboot. In looking for it I did the following:

1. Searched for anything suspicious to my untrained eyes in Autoruns. Found digiwet.dll in Windows/System32 and discovered in Google that it was bad. Deleted the file plus its autorun entry on Security Providers.

Then I ran malwarebytes antimalware Quick Scan for the first time, and besides the Debugger keys it also found and deleted "C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent)", probably a left over from an infection from the past.

Then Malwarebytes asked for a reboot, for which I complied.

---Reboot---

2. Same symptoms: task bar and manager remain locked for some minutes but then return to normal on their own. The Debuggers and Security Center disabled notify were back.

This time I decided to do a Full Scan with Malwarebytes antimalware, but the only new thing it found were 2 .dlls on System Restore:

C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP575\A0090274.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP575\A0090275.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Seeing as this wasn't going anywhere I decided to give Rootalyzer a try, but its Quick Scan found nothing and its Deep Scan only found harmless Unknown ADS entries (downloaded games, basically: Prison Tycoon 4, 18 Wheels Long Haul and Freerealms, all clean and downloaded before the infection).

So I tried turning TeaTimer on hoping it would keep the registry still.

---Reboot with TeaTimer on---

No effect, same symptoms as above, Debuggers (and SC Notify) were back, same slow start-up.

And that's it. This is as far as I can go alone, I don't know how to find the cause of the Debuggers being written into the registry. Here's their list from Malwarebytes log:

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 90
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filemon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regmon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyDBG.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regtool.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niu.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2SERVICE.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGNT.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGUARD.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCAN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CASECURITYCENTER.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EKRN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FAMEH32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVSERVER.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWIN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSAV32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSGK32ST.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwadins.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwebupw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFRing3.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArcaCheck.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arcavir.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashEnhcd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcls.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz4.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz_se.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdinit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caav.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caavguiscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccupdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpupdat.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRWEB32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fpscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxup.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navigator.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSTUB.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\preupd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pskdr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SfFnUp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vba32arkit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vba32ldr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zoneband.dll (Security.Hijack) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[katana]

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

1. Please Read All Instructions Carefully
2. If you don't understand something, stop and ask! Don't keep going on.
3. Please do not run any other tools or scans whilst I am helping you
4. Failure to reply within 5 days will result in the topic being closed.
5. Please continue to respond until I give you the "All Clear"
   (Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------



Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

• You must download it to and run it from your Desktop
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When finished, it will produce a log. Please save that log to post in your next reply
• Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper




Installed Programs

Please could you give me a list of the programs that are installed.

• Start HijackThis
• Click on the Misc Tools button
• Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.

[Wardo]

Hello and thank you katana,

Roger that on the rules, however, before visiting this thread I had already begun a Rootkit/malware scan with a renamed GMER.exe. From this point on I won't do anything on my own, as requested, but I did discover something new:

Yesterday I did a scan with GMER and it found a bizarrely named .sys file, I didn't note it down, it was completely random, jmt-a bunch of random letters-.sys, looking it up on Google returned 0 results. GMER said "The system could not find the specified file", and I couldn't find it with Search or manually on Windows/System32/drivers either. On today's scan after turning the PC on and thus on a fresh boot that file is no more on GMER's list, however, a new file has appeared exactly on the same spot: xyaiwrs.sys . It's not on Google either, and "The system could not find the specified fïle" again, and I can't find it on my own either.

If that information is worth anything...

Ok so that's it for my initiative.

---------------------------------------------------

So, I complied as requested:

1. Downloaded Combofix to the Desktop
2. Stopped all monitoring programs (AVast! basically, the "rest" [Windows Defender] was already off)
3. Double-clicked Combofix and followed the prompts with success; it installed the Recovery Console.
4. It produced a log which I saved on the Desktop for ease of reach and shall post below.
5. Re-enabled all the programs previously disabled (which is actually only one, Avast!)

Before I post the log I think I have good news. Whatever Combofix did, if it did anything, seems to be a step forward: when it rebooted the PC the Security Center notifications returned to the Task Bar and complained that my Automatic Updates are turned off (my setting). So perhaps whatever was disabling these notifications is gone at least from this boot. I don't know if the debuggers are back though, I didn't want to move the mouse to check if the task bar was "frozen" while Combofix was producing the log. Anyway, Combofix selected Portuguese as a language, if you need anything translated let me know. For your information:

Arquivo de Programas = Program Files
Dados de Aplicativos = Application Data

I have created myself a c:\Program Files folder which might aswell be called c:\Games because it's where I keep games installed to separate from tools and other software at the default Arquivo de Programas. So when you see a c:\Program Files, pretend it's called c:\Games. Confusing, I know, it's that there are a few sensitive games that won't install on any path other than c:\Program Files. It's not the default or "real" program files though, which is c:\Arquivo de Programas. Yeah, I regret not installing Windows in English too...

Finally, the Combofix log:

ComboFix 09-05-21.03 - Xgamer 22/05/2009 9:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3199.2627 [GMT -3:00]
Executando de: c:\documents and settings\Xgamer\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090519-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\IE4 Error Log.txt
c:\windows\setup.exe
c:\windows\system32\adptrmyhelpq.exe
c:\windows\system32\tmp32.tmp
c:\windows\system32\WINCNMDB.DLL

----- BITS: Sites possivelmente infetados -----

hxxp://msxb-d1.vo.llnw.net:3074
.
((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EVENTLOGNTLMSSP
-------\Service_EventlogNtLmSsp


(((((((((((((((( Arquivos/Ficheiros criados de 2009-04-22 to 2009-05-22 ))))))))))))))))))))))))))))
.

2009-05-22 12:12 . 2009-05-22 12:13 -------- d-----w C:\p2pbackup
2009-05-20 18:17 . 2009-04-06 18:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 18:17 . 2009-04-06 18:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 18:17 . 2009-05-20 18:17 -------- d-----w c:\arquivos de programas\Malwarebytes' Anti-Malware
2009-05-19 12:55 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\REGBACKUP
2009-05-19 12:54 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\ERUNT
2009-05-19 12:25 . 2009-05-19 12:25 -------- d-----w c:\arquivos de programas\Trend Micro
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GamesCafe
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\arquivos de programas\ReflexiveArcade
2009-05-19 01:05 . 2009-05-19 01:05 32 --s-a-w c:\windows\system32\3230355207.dat
2009-05-18 08:13 . 2009-05-18 08:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Dropbox
2009-05-18 08:13 . 2009-05-18 08:13 -------- d-----w c:\arquivos de programas\Dropbox
2009-05-17 02:25 . 2009-05-21 23:42 -------- d-----w c:\arquivos de programas\Sony Online Entertainment
2009-05-16 18:38 . 2009-05-16 18:38 -------- d-----w c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-05-16 18:38 . 2009-05-01 01:02 457248 ----a-w c:\windows\system32\nvudisp.exe
2009-05-16 18:38 . 2009-04-27 03:42 457248 ----a-w c:\windows\system32\NVUNINST.EXE
2009-05-11 04:50 . 2009-05-16 07:58 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-05-06 03:44 . 2009-05-06 04:04 -------- d-----w c:\arquivos de programas\Wurm
2009-05-06 03:41 . 2009-05-06 03:41 65536 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\16\2c0214d0-315845ab-0.1--n\mumblelink.dll
2009-05-06 03:41 . 2009-05-06 03:41 31232 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-dx8.dll
2009-05-06 03:41 . 2009-05-06 03:41 29184 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-raw.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\12\7dbb844c-729fc634-1.0b06--n\gluegen-rt.dll
2009-05-06 03:41 . 2009-05-06 03:41 163328 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\OpenAL32.dll
2009-05-06 03:41 . 2009-05-06 03:41 131072 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\lwjgl.dll
2009-05-06 03:41 . 2009-05-06 03:41 315392 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_awt.dll
2009-05-06 03:41 . 2009-05-06 03:41 114688 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_cg.dll
2009-05-06 02:17 . 2009-05-06 02:17 -------- d-----w c:\arquivos de programas\Netscape
2009-05-01 03:31 . 2009-05-01 03:31 1657376 ----a-w c:\windows\system32\nwiz.exe
2009-05-01 03:31 . 2009-05-01 03:31 449056 ----a-w c:\windows\system32\nvappbar.exe
2009-05-01 03:31 . 2009-05-01 03:31 436768 ----a-w c:\windows\system32\keystone.exe
2009-05-01 03:31 . 2009-05-01 03:31 466944 ----a-w c:\windows\system32\nvshell.dll
2009-05-01 03:31 . 2009-05-01 03:31 1724416 ----a-w c:\windows\system32\nvwdmcpl.dll
2009-05-01 03:31 . 2009-05-01 03:31 1507328 ----a-w c:\windows\system32\nview.dll
2009-05-01 03:31 . 2009-05-01 03:31 1101824 ----a-w c:\windows\system32\nvwimg.dll
2009-05-01 01:02 . 2009-05-01 01:02 9994240 ----a-w c:\windows\system32\nvoglnt.dll
2009-05-01 01:02 . 2009-05-01 01:02 806912 ----a-w c:\windows\system32\nvapi.dll
2009-05-01 01:02 . 2009-05-01 01:02 1720320 ----a-w c:\windows\system32\nvcuda.dll
2009-05-01 01:02 . 2009-05-01 01:02 1579630 ----a-w c:\windows\system32\nvdata.bin
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcodins.dll
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcod.dll
2009-05-01 01:02 . 2009-05-01 01:02 1314816 ----a-w c:\windows\system32\nvcuvenc.dll
2009-04-23 15:59 . 2009-05-19 05:45 138016 ----a-w c:\windows\system32\drivers\pnkbstrk.sys
2009-04-23 15:58 . 2009-05-19 05:45 189392 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-23 15:58 . 2009-04-23 15:58 75064 ----a-w c:\windows\system32\PnkBstrA.exe

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 12:25 . 2007-12-26 09:52 3201 --sha-w c:\windows\system32\mmf.sys
2009-05-22 01:08 . 2007-08-29 20:41 -------- d-----w c:\arquivos de programas\Grumble
2009-05-22 00:59 . 2008-08-25 20:49 -------- d-----w c:\arquivos de programas\Grvid
2009-05-19 10:56 . 2008-09-20 21:20 -------- d-----w c:\arquivos de programas\Spybot - Search & Destroy
2009-05-19 02:40 . 2007-08-25 12:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus
2009-05-18 15:25 . 2008-03-30 10:43 -------- d-----w c:\arquivos de programas\Cheat Engine
2009-05-18 12:39 . 2008-08-21 21:12 -------- d-----w c:\arquivos de programas\Steam
2009-05-18 02:44 . 2007-10-11 03:54 7114736 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus\plugins\azemp\azmplay.exe
2009-05-18 02:11 . 2007-08-25 12:36 -------- d-----w c:\arquivos de programas\Azureus
2009-05-16 18:38 . 2009-02-01 18:57 -------- d-----w c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-05-12 18:04 . 2004-08-04 21:04 -------- d--h--w c:\arquivos de programas\InstallShield Installation Information
2009-05-08 23:57 . 2009-04-21 18:37 -------- d-----w c:\arquivos de programas\America's Army Deploy Client
2009-05-06 04:06 . 2004-08-04 21:49 -------- d-----w c:\arquivos de programas\MSN Messenger
2009-05-01 01:02 . 2009-02-09 16:18 663552 ----a-w c:\windows\system32\nvcuvid.dll
2009-05-01 01:02 . 2006-12-21 03:29 8055584 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 01:02 . 2006-12-21 03:29 5896320 ----a-w c:\windows\system32\nv4_disp.dll
2009-04-23 20:30 . 2008-10-15 20:54 -------- d-----w c:\arquivos de programas\eMule
2009-04-21 23:55 . 2009-04-21 23:55 -------- d-----w c:\arquivos de programas\America's Army
2009-04-21 18:47 . 2009-04-21 18:47 20480 ----a-w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client\dcds\patches\aadc.1.2.4.2.full.exe
2009-04-21 18:41 . 2009-03-10 06:48 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client
2009-04-19 20:17 . 2009-04-17 17:33 -------- d-----w c:\arquivos de programas\ActMak
2009-04-12 09:41 . 2009-04-12 09:41 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-12 09:41 . 2007-10-07 04:04 -------- d-----w c:\arquivos de programas\Java
2009-04-12 09:41 . 2009-04-12 09:38 152576 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-08 06:39 . 2009-04-08 06:38 -------- d-----w c:\arquivos de programas\WolfQuest
2009-04-07 01:38 . 2009-01-20 20:13 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\U3
2009-04-03 06:49 . 2009-01-31 04:43 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Vsk5Online
2009-04-03 06:39 . 2009-04-03 06:37 -------- d-----w c:\arquivos de programas\Replay AV 8
2009-04-03 06:37 . 2009-04-03 06:37 737280 ----a-w c:\windows\iun6002.exe
2009-04-03 06:36 . 2009-04-03 06:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GetRightToGo
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Freecorder
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Conduit
2009-04-03 06:27 . 2009-04-03 05:55 -------- d-----w c:\arquivos de programas\Freecorder Toolbar
2009-03-27 16:35 . 2007-10-03 00:44 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\dvdcss
2009-03-25 23:24 . 2009-03-25 23:02 -------- d-----w c:\arquivos de programas\Lockleo
2009-02-22 03:28 . 1782-01-19 03:14 83888 ----a-w c:\windows\system32\perfc016.dat
2009-02-22 03:28 . 1782-01-19 03:14 479704 ----a-w c:\windows\system32\perfh016.dat
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-16 1953792]
"Adobe Photo Downloader"="c:\arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-04-12 148888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-10 16384000]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Windows Search.lnk - c:\arquivos de programas\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\arquivos de programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Tri Synergy\\UFO Extraterrestrials\\TrueUpdate.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\Atari\\ArmA\\arma.exe"=
"c:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"c:\\Arquivos de programas\\FSFDT\\FWInn\\FWINN.exe"=
"c:\\Arquivos de programas\\FSFDT\\Control Panel\\FSFDTCP.exe"=
"c:\\Program Files\\Atari\\Deer Hunter 2005\\DH2005.exe"=
"c:\\Arquivos de programas\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Arquivos de programas\\GameSpy Arcade\\Aphex.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\dangerouswaters.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Arquivos de programas\\Pando Networks\\Pando\\pando.exe"=
"c:\\Arquivos de programas\\eMule\\emule.exe"=
"c:\\Program Files\\SEGA\\Medieval II Total War\\medieval2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Activision\\Bridge Commander\\stbc.exe"=
"c:\\Program Files\\Vsk5Online\\Vsk5Online.exe"=
"c:\\Arquivos de programas\\Ventrilo\\Ventrilo.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\Steamrun.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\Fallout3.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\FalloutLauncher.exe"=
"c:\\Arquivos de programas\\Steam\\Steam.exe"=
"c:\\Arquivos de programas\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Arquivos de programas\\America's Army\\System\\ArmyOps.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\empire total war\\Empire.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2_sse2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\playgate_120.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56455:TCP"= 56455:TCP:Pando P2P TCP Listening Port
"56455:UDP"= 56455:UDP:Pando P2P UDP Listening Port

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5/7/2006 09:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/3/2008 07:43 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30/3/2008 07:43 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [26/12/2007 06:52 2560]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;c:\windows\system32\drivers\SWUSBFLT.SYS [7/8/2004 20:03 3968]
.
- - - - ORFÃOS REMOVIDOS - - - -

BHO-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET


.
------- Scan Suplementar -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-22 09:25
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,9e,76,9d,4e,a5,38,74,1d,ab,fc,3d,34,0f,57,77,94,a6,85,91,3a,61,0d,
ef,2c,a9,7b,ad,37,da,ec,55,82,20,a3,d9,cf,ba,9f,66,16,fb,14,5e,40,4f,6c,46,\
"??"=hex:1b,76,be,4e,19,34,99,bc,11,c6,b6,2e,a2,9f,c9,54

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:63,36,fe,1f,21,bf,4e,7e,d3,60,58,8b,35,f7,73,86,b1,d6,47,e2,96,
b5,e9,87,eb,af,b6,18,ad,23,63,9a,e9,79,65,e7,a9,54,64,7e,2f,f9,bd,1e,71,c3,\
"rkeysecu"=hex:eb,06,d0,93,9a,85,ee,a1,6e,45,38,68,71,79,23,53

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\A62C3DF982434ABDAD414E772CEE62E6]
"1"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6c,bf,37,a7,d1,d7,c0,b2
"2"=hex:ac,5d,cf,8a,eb,60,b6,ba
"3"=hex:f8,70,08,41,96,4e,89,5a,d8,11,1b,3f,c3,b8,2e,94,f3,ad,38,27,c9,a3,3e,
73,85,97,2a,3d,33,74,cc,4b,d1,b8,c0,bc,a1,9a,e3,af,71,75,43,ee,3b,56,c4,8a,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6e,6a,1d,2f,00,6b,b9,62,3e,79,c0,6d,00,71,75,df,e6,92,bc,0e,a3,f5,1e,a9,\
"7"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,56,a7,02,9d,f0,a0,1d,
cc,28,d9,b1,18,9e,f1,8d,e8,54,e6,61,27,95,2e,52,cc,1c,f7,fa,64,bd,24,b7,82,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,ae,a5,e1,39,c0,fe,a7,12,fb,d4,fe,25,dc,00,56,48,cb,f3,0e,96,93,6e,94,4d,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:72,31,07,4e,cb,fd,20,44,b0,30,08,cc,73,40,ef,7f,03,7e,08,77,1a,71,9b,
32,a0,5d,6a,56,3a,1b,9d,3f,59,3d,58,02,71,57,00,41,67,c8,8e,a7,9b,1c,40,7f,\
"13"=hex:e7,92,97,05,ba,b7,88,9e,85,16,26,36,0f,b2,e3,5a,a3,b8,1f,74,11,d9,0e,
a5,35,1f,db,4c,b4,50,ba,99,05,33,6f,ed,1c,09,d2,1f
"14"=hex:99,f7,bb,1b,0d,9d,88,b4,fa,9e,45,6c,cb,b1,2f,71
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:14,0d,2b,41,dd,9e,f3,8a,7b,48,c2,a6,21,cb,52,28
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:65,2f,cc,ba,3f,19,56,74,70,f2,06,7c,a7,ba,05,4c,3d,1f,99,31,68,53,97,
4d,b7,17,bd,cb,3d,32,2b,06,a6,c0,88,5a,37,c1,39,cd,c7,5a,e9,20,d4,28,74,87,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\B3E62936FE1487AF4E0CC9BD2A26433C]
"1"=hex:df,c7,3a,96,ab,66,13,d2,35,84,aa,2e,3b,c4,59,82
"2"=hex:a5,2d,b1,39,25,57,b6,7c,bd,55,f5,f4,85,30,c7,12
"3"=hex:ff,71,2a,a0,e1,fa,fd,f4,76,36,05,b2,bd,c4,78,4f,17,22,25,5a,bd,6b,bb,
0b,e3,93,49,a9,ee,66,58,2f,a4,2a,9c,fe,75,da,e1,50,28,33,b2,1e,1c,f2,9a,f3,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:df,c7,3a,96,ab,66,13,d2,0e,90,72,68,c4,63,c8,bb,00,5d,70,3b,08,36,97,
bd,ee,04,c1,4a,7c,6f,fd,5f,f7,67,d1,43,f2,ef,e6,1c,89,7c,fa,9f,4c,d6,39,08,\
"7"=hex:93,41,de,56,34,94,a7,b2,13,ca,26,2f,35,a5,e0,53,1e,d5,e7,20,4a,dd,09,
c9,2d,37,7b,a2,3c,71,f4,5e,ed,02,2a,97,fd,fb,2c,72,12,5f,23,ff,c4,2a,48,c4,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,c9,4f,a5,f8,51,27,e9,29,77,5c,86,6d,0a,20,f9,c7,d7,30,8a,47,ce,07,3e,13,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:eb,97,99,7a,65,b9,91,7d,ee,96,33,2e,7e,c5,12,36,66,80,5c,16,18,db,f8,
df,b9,52,b8,ee,31,34,87,75,17,33,ec,40,2b,b3,3d,07,b4,67,e7,22,9b,f8,a1,86,\
"13"=hex:bc,56,46,8c,be,fe,b0,9e,a9,c8,a6,e3,7c,a8,f0,9e,7a,b5,3a,f7,d0,9f,7f,
6b,6b,6f,9a,1a,e8,9b,87,44,36,99,a7,79,53,f4,34,26
"14"=hex:d2,08,a4,82,f1,1a,a0,b4,f5,1f,60,13,49,13,4c,d5
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:df,60,78,8d,35,eb,80,3e,82,79,f2,d5,0b,bb,7d,ee
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:b6,ff,2b,2e,0f,22,1f,03,93,0e,f3,0f,87,f9,4e,67,5c,c8,81,88,cf,56,f8,
bb,6f,5c,8c,63,35,d1,f5,5c,04,ca,19,ef,7e,c6,b8,eb,99,e8,47,13,5f,17,41,7b,\
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'Explorer.EXE'(1740)
c:\arquivos de programas\Dropbox\DropboxExt.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
c:\arquivos de programas\Alwil Software\Avast4\ashServ.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
c:\arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Tempo para conclusão: 2009-05-22 9:35 - Máquina reiniciou
ComboFix-quarantined-files.txt 2009-05-22 12:35

Pré-execução: 24 pasta(s) 57.100.607.488 bytes disponíveis
Pós execução: 23 pasta(s) 56.799.035.392 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5
328 --- E O F --- 2007-08-09 06:45

[Wardo]

Now for the installed programs, I wasn't expecting help this fast so I didn't bother uninstalling P2P programs which I do have (Azureus and eMule). I won't uninstall them untill instructed to, of course.

So here's HJT's Uninstall Manager list:

18 Wheels of Steel: American Long Haul
ActMaker 2.5
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.0 - Português
Adobe Shockwave Player 11
Adobe® Photoshop® Album Starter Edition 3.2
Age of Pirates - Caribbean Tales 1.5
America's Army Deploy Client
ArmA Uninstall
Atualização de Segurança para o Windows Media Player (KB952069)
Atualização de Segurança para o Windows Media Player 10 (KB917734)
Atualização de Segurança para o Windows Media Player 10 (KB936782)
Atualização de Segurança para o Windows Media Player 11 (KB936782)
Atualização de Segurança para o Windows Media Player 11 (KB954154)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127-v2)
Atualização de Segurança para Windows Internet Explorer 7 (KB961260)
Atualização de Segurança para Windows XP (KB938464)
Atualização de Segurança para Windows XP (KB941569)
Atualização de Segurança para Windows XP (KB946648)
Atualização de Segurança para Windows XP (KB950760)
Atualização de Segurança para Windows XP (KB950762)
Atualização de Segurança para Windows XP (KB950974)
Atualização de Segurança para Windows XP (KB951066)
Atualização de Segurança para Windows XP (KB951376-v2)
Atualização de Segurança para Windows XP (KB951698)
Atualização de Segurança para Windows XP (KB951748)
Atualização de Segurança para Windows XP (KB952954)
Atualização de Segurança para Windows XP (KB953839)
Atualização de Segurança para Windows XP (KB954211)
Atualização de Segurança para Windows XP (KB954459)
Atualização de Segurança para Windows XP (KB954600)
Atualização de Segurança para Windows XP (KB955069)
Atualização de Segurança para Windows XP (KB956802)
Atualização de Segurança para Windows XP (KB956803)
Atualização de Segurança para Windows XP (KB956841)
Atualização de Segurança para Windows XP (KB957097)
Atualização de Segurança para Windows XP (KB958644)
Atualização de Segurança para Windows XP (KB958687)
Atualização de Segurança para Windows XP (KB960715)
Atualização para Windows XP (KB942763)
Atualização para Windows XP (KB951072-v2)
Atualização para Windows XP (KB951978)
Atualização para Windows XP (KB955839)
Audacity 1.2.6
avast! Antivirus
Azureus Vuze
B17 - The Mighty Eighth
Battleground Europe: WWIIOL
BattlEye Uninstall
Bus Driver 1.0
CDex extraction audio
Cheat Engine 5.4
Combat Mission Shock Force
Compatibility Pack for the 2007 Office system
Cooking Academy
Covert Operations
Covert Operations Training
Dangerous Waters
Deer Hunter - The 2005 Season
Digital Voice Editor 3
DivX Content Uploader
DivX Web Player
Download Manager 2.3.7
Dream Flashsee v1.3
Dropbox
EA Download Manager
Empire: Total War
eMule
ERUNT 1.1j
Europa Universalis III
Falcon 4.0: Allied Force
Fallout 3
Free Realms Installer
FSFDT FSCopilot
FSFDT FSInn
GamersGate Downloader
GameSpy Arcade
GameTap Web Player
Gangsters
GIMPshop 2.2.8
GPGNet
Grass Roots Trial
GTAIII
Hard Time Trial
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hitman Blood Money
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB915800-v4)
Hotfix para o Windows Media Player 11 (KB939683)
Hotfix para Windows XP (KB952287)
IL-2 Sturmovik 1946
IrfanView (remove only)
Java(TM) 6 Update 13
Java(TM) 6 Update 3
Java(TM) 6 Update 7
JMB36X Raid Configurer
Jurassic Park Operation Genesis
Left 4 Dead
Locomotion
LucasArts' X-Wing Alliance
Malwarebytes' Anti-Malware
Marvell Miniport Driver
Medieval II Total War
Medieval II Total War Kingdoms
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Brazilian Portuguese Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PTB
Microsoft .NET Framework 3.0 Brazilian Portuguese Language Pack
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PTB
Microsoft .NET Framework 3.5 Language Pack SP1 - ptb
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Close Combat: A Bridge Too Far
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Flight Simulator X
Microsoft Flight Simulator X
Microsoft Flight Simulator X Service Pack 1
Microsoft Flight Simulator X: Acceleration
Microsoft Flight Simulator X: Acceleration
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edição 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
Mount&Blade
Mozilla Firefox (3.0.1)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Napoleon's Ambition 2.2
Nero 6 Ultra Edition
Net Transport 1.87.258
Nethergate
NVIDIA Drivers
NVIDIA PhysX
OpenAL
Pacote de Idiomas do Microsoft .NET Framework 3.5 SP1 - PTB
Pacote de Idiomas do Português (Brasil) para Microsoft .NET Framework 3.0
Pacote de Provedor de Serviços de Criptografia para o Microsoft Base Smart Card
Paint.NET v3.36
Pando
PC Probe II
PlayGATE Setup
Prison Tycoon 4
Reach Trial
RealSpeak_Solo_Common_for_Panasonic
RealSpeak_Solo_English_for_Panasonic
RealSpeak_Solo_French_for_Panasonic
RealSpeak_Solo_German_for_Panasonic
RealSpeak_Solo_Italian_for_Panasonic
RealSpeak_Solo_Spanish_for_Panasonic
Realtek High Definition Audio Driver
Replay AV 8
Restaurant Empire
RivaTuner v2.06
SAPI5_Common
SAPI5_English
SDP Downloader
Silent Hunter 4 Wolves of the Pacific
Silent Hunter III
SimCity 4 Rush Hour
SpaceShuttleMission2007 PATCH v1.37
Spybot - Search & Destroy
Star Trek Bridge Commander
Stardock Central
Steam
Supreme Commander
theRestaurant v1.9.1
Translation_iTrans_for_Panasonic
UFO Extraterrestrials
Ventrilo Client
VideoLAN VLC media player 0.8.6c
Virtual E6-B 1.4
Virtual Earth 3D (Beta)
Voice Editing
Vsk5Online
WebIQ Technology Engine
Windows Imaging Component
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Presentation Foundation Language Pack (PTB)
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
WinZip 11.1
WolfQuest
World of Subways Vol.1
Wrecked Trial
Wrestling MPire 2008 (Career Edition) Trial
XML Paper Specification Shared Components Language Pack 1.0
[[FSX]] Carenado MegaPack
----------------------------

To translate:
Atualização de Segurança para = Security Update to
Atualização = Update
Pacote de Idiomas = Language package
Pacote de Provedor de Serviços de Criptografia = Cryptography service provider package

[katana]

REMOVE P2P PROGRAMS

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Azureus Vuze
eMule
Pando

Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected.
The bad guys use P2P filesharing as a major conduit to spread their wares.

Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.


----------------------------------------------------------- -----------------------------------------------------------


Custom CFScript

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  
  

  http://forums.spybot.info/showthread.php?p=313671#post313671
  Suspect::
  c:\windows\system32\3230355207.dat
  Folder::
  c:\Arquivos de programas\Azureus
  c:\Arquivos de programas\Pando Networks
  c:\Arquivos de programas\eMule
  DirLook::
  c:\windows\1C4551A64743409391E41477CD655043.TMP
  Registry::
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "c:\\Arquivos de programas\\Azureus\\Azureus.exe"=-
  "c:\\Arquivos de programas\\Pando Networks\\Pando\\pando.exe"=-
  "c:\\Arquivos de programas\\eMule\\emule.exe"=-
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  "56455:TCP"=-
  "56455:UDP"=-
  
  ADS::

• Save this as CFScript.txt and place it on your desktop.
  
  
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper






Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/par...avwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.




Logs/Information to Post in Reply
Please post the following logs/Information in your reply

• Combofix Log
• Kaspersky Log
• How are things running now, any problems still ?

----------------------------------------------------------- -----------------------------------------------------------


Remove Programs

Older versions of some programs have vulnerabilities that malware can use to infect your system.

Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
click on the program to highlight it, and click on remove.

• Java(TM) 6 Update 3
  Java(TM) 6 Update 7

Now close the Control Panel.

[Wardo]

1. Went to Control Panel and removed: Azureus Vuze, eMule, Pando.

I moved the clean downloaded files to the folder c:\p2pbackup untill I can sort and store them properly.

-

2. Opened notepad, copied and pasted the text from the code box above to the file and saved as CFScript.txt on the Desktop.

3. Dragged CFScript.txt into ComboFix.exe; Combofix fired up and ran. It did not reboot the PC.

The log is below

-

4. Went to the Kaspersky link provided using IE, accepted the terms and downloaded program and database.

5. With no programs open and Avast! and any other real-time scanner, guard, etc. off I selected My Computer from Kaspersky's tab and Scan.

Kaspersky found an old key finder, something quarantined and system restores.

The log is below

-

6. Everything is running fine but to be sure I'd have to reboot and I'm not rebooting without your consent.

-

7. Removed Java Update 3 and 7 via Add/Remove Programs in Control Panel.

If you'd like me to reboot the PC to see what happens let me know.

Logs:

Combofix:

ComboFix 09-05-21.05 - Xgamer 22/05/2009 12:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3199.2722 [GMT -3:00]
Executando de: c:\documents and settings\Xgamer\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Xgamer\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090519-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

file zipped: c:\windows\system32\Suspect_3230355207.dat.vir
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\arquivos de programas\Azureus
c:\arquivos de programas\Azureus\hs_err_pid2692.log
c:\arquivos de programas\Azureus\msvcr71.dll
c:\arquivos de programas\Azureus\plugins\azupdater\azupdater_1.8.5.zip
c:\arquivos de programas\Azureus\plugins\azupdater\azupdater_1.8.8.zip
c:\arquivos de programas\Azureus\plugins\azupdater\azupdaterpatcher_1.8.5.jar
c:\arquivos de programas\Azureus\plugins\azupdater\azupdaterpatcher_1.8.8.jar
c:\arquivos de programas\Azureus\plugins\azupdater\plugin.properties_1.8.5
c:\arquivos de programas\Azureus\plugins\azupdater\plugin.properties_1.8.8
c:\arquivos de programas\Azureus\plugins\azupdater\Updater.jar.bak
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.6.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.6.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.7.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.7.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.0.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.0.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.1.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.1.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.17.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.17.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.2.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.2.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.5.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.5.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.1.6
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.1.7
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.0
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.1
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.17
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.2
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.5
c:\arquivos de programas\eMule
c:\arquivos de programas\eMule\Temp\002.part
c:\arquivos de programas\eMule\Temp\002.part.met
c:\arquivos de programas\eMule\Temp\002.part.met.bak
c:\arquivos de programas\eMule\Temp\003.part
c:\arquivos de programas\eMule\Temp\003.part.met
c:\arquivos de programas\eMule\Temp\003.part.met.bak
c:\arquivos de programas\eMule\Temp\004.part
c:\arquivos de programas\eMule\Temp\004.part.met
c:\arquivos de programas\eMule\Temp\004.part.met.bak
c:\arquivos de programas\eMule\Temp\005.part
c:\arquivos de programas\eMule\Temp\005.part.met
c:\arquivos de programas\eMule\Temp\005.part.met.bak
c:\arquivos de programas\eMule\Temp\007.part
c:\arquivos de programas\eMule\Temp\007.part.met
c:\arquivos de programas\eMule\Temp\007.part.met.bak
c:\arquivos de programas\eMule\Temp\008.part
c:\arquivos de programas\eMule\Temp\008.part.met
c:\arquivos de programas\eMule\Temp\008.part.met.bak
c:\arquivos de programas\eMule\Temp\009.part
c:\arquivos de programas\eMule\Temp\009.part.met
c:\arquivos de programas\eMule\Temp\009.part.met.bak
c:\arquivos de programas\eMule\Temp\010.part
c:\arquivos de programas\eMule\Temp\010.part.met
c:\arquivos de programas\eMule\Temp\010.part.met.bak
c:\arquivos de programas\eMule\Temp\011.part
c:\arquivos de programas\eMule\Temp\011.part.met
c:\arquivos de programas\eMule\Temp\011.part.met.bak
c:\arquivos de programas\eMule\Temp\012.part
c:\arquivos de programas\eMule\Temp\012.part.met
c:\arquivos de programas\eMule\Temp\012.part.met.bak
c:\arquivos de programas\eMule\Temp\013.part
c:\arquivos de programas\eMule\Temp\013.part.met
c:\arquivos de programas\eMule\Temp\013.part.met.bak
c:\arquivos de programas\eMule\Temp\014.part
c:\arquivos de programas\eMule\Temp\014.part.met
c:\arquivos de programas\eMule\Temp\014.part.met.bak
c:\arquivos de programas\eMule\Temp\015.part
c:\arquivos de programas\eMule\Temp\015.part.met
c:\arquivos de programas\eMule\Temp\015.part.met.bak
c:\arquivos de programas\eMule\Temp\016.part
c:\arquivos de programas\eMule\Temp\016.part.met
c:\arquivos de programas\eMule\Temp\016.part.met.bak

.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-04-22 to 2009-05-22 ))))))))))))))))))))))))))))
.

2009-05-22 12:12 . 2009-05-22 15:29 -------- d-----w C:\p2pbackup
2009-05-20 18:17 . 2009-04-06 18:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 18:17 . 2009-04-06 18:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 18:17 . 2009-05-20 18:17 -------- d-----w c:\arquivos de programas\Malwarebytes' Anti-Malware
2009-05-19 12:55 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\REGBACKUP
2009-05-19 12:54 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\ERUNT
2009-05-19 12:25 . 2009-05-19 12:25 -------- d-----w c:\arquivos de programas\Trend Micro
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GamesCafe
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\arquivos de programas\ReflexiveArcade
2009-05-19 01:05 . 2009-05-19 01:05 32 --s-a-w c:\windows\system32\3230355207.dat
2009-05-18 08:13 . 2009-05-18 08:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Dropbox
2009-05-18 08:13 . 2009-05-18 08:13 -------- d-----w c:\arquivos de programas\Dropbox
2009-05-17 02:25 . 2009-05-21 23:42 -------- d-----w c:\arquivos de programas\Sony Online Entertainment
2009-05-16 18:38 . 2009-05-16 18:38 -------- d-----w c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-05-16 18:38 . 2009-05-01 01:02 457248 ----a-w c:\windows\system32\nvudisp.exe
2009-05-16 18:38 . 2009-04-27 03:42 457248 ----a-w c:\windows\system32\NVUNINST.EXE
2009-05-11 04:50 . 2009-05-16 07:58 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-05-06 03:44 . 2009-05-06 04:04 -------- d-----w c:\arquivos de programas\Wurm
2009-05-06 03:41 . 2009-05-06 03:41 65536 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\16\2c0214d0-315845ab-0.1--n\mumblelink.dll
2009-05-06 03:41 . 2009-05-06 03:41 31232 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-dx8.dll
2009-05-06 03:41 . 2009-05-06 03:41 29184 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-raw.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\12\7dbb844c-729fc634-1.0b06--n\gluegen-rt.dll
2009-05-06 03:41 . 2009-05-06 03:41 163328 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\OpenAL32.dll
2009-05-06 03:41 . 2009-05-06 03:41 131072 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\lwjgl.dll
2009-05-06 03:41 . 2009-05-06 03:41 315392 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_awt.dll
2009-05-06 03:41 . 2009-05-06 03:41 114688 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_cg.dll
2009-05-06 02:17 . 2009-05-06 02:17 -------- d-----w c:\arquivos de programas\Netscape
2009-05-01 03:31 . 2009-05-01 03:31 1657376 ----a-w c:\windows\system32\nwiz.exe
2009-05-01 03:31 . 2009-05-01 03:31 449056 ----a-w c:\windows\system32\nvappbar.exe
2009-05-01 03:31 . 2009-05-01 03:31 436768 ----a-w c:\windows\system32\keystone.exe
2009-05-01 03:31 . 2009-05-01 03:31 466944 ----a-w c:\windows\system32\nvshell.dll
2009-05-01 03:31 . 2009-05-01 03:31 1724416 ----a-w c:\windows\system32\nvwdmcpl.dll
2009-05-01 03:31 . 2009-05-01 03:31 1507328 ----a-w c:\windows\system32\nview.dll
2009-05-01 03:31 . 2009-05-01 03:31 1101824 ----a-w c:\windows\system32\nvwimg.dll
2009-05-01 01:02 . 2009-05-01 01:02 9994240 ----a-w c:\windows\system32\nvoglnt.dll
2009-05-01 01:02 . 2009-05-01 01:02 806912 ----a-w c:\windows\system32\nvapi.dll
2009-05-01 01:02 . 2009-05-01 01:02 1720320 ----a-w c:\windows\system32\nvcuda.dll
2009-05-01 01:02 . 2009-05-01 01:02 1579630 ----a-w c:\windows\system32\nvdata.bin
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcodins.dll
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcod.dll
2009-05-01 01:02 . 2009-05-01 01:02 1314816 ----a-w c:\windows\system32\nvcuvenc.dll
2009-04-23 15:59 . 2009-05-19 05:45 138016 ----a-w c:\windows\system32\drivers\pnkbstrk.sys
2009-04-23 15:58 . 2009-05-19 05:45 189392 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-23 15:58 . 2009-04-23 15:58 75064 ----a-w c:\windows\system32\PnkBstrA.exe

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 12:25 . 2007-12-26 09:52 3201 --sha-w c:\windows\system32\mmf.sys
2009-05-22 01:08 . 2007-08-29 20:41 -------- d-----w c:\arquivos de programas\Grumble
2009-05-22 00:59 . 2008-08-25 20:49 -------- d-----w c:\arquivos de programas\Grvid
2009-05-19 10:56 . 2008-09-20 21:20 -------- d-----w c:\arquivos de programas\Spybot - Search & Destroy
2009-05-19 02:40 . 2007-08-25 12:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus
2009-05-18 15:25 . 2008-03-30 10:43 -------- d-----w c:\arquivos de programas\Cheat Engine
2009-05-18 12:39 . 2008-08-21 21:12 -------- d-----w c:\arquivos de programas\Steam
2009-05-18 02:44 . 2007-10-11 03:54 7114736 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus\plugins\azemp\azmplay.exe
2009-05-16 18:38 . 2009-02-01 18:57 -------- d-----w c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-05-12 18:04 . 2004-08-04 21:04 -------- d--h--w c:\arquivos de programas\InstallShield Installation Information
2009-05-08 23:57 . 2009-04-21 18:37 -------- d-----w c:\arquivos de programas\America's Army Deploy Client
2009-05-06 04:06 . 2004-08-04 21:49 -------- d-----w c:\arquivos de programas\MSN Messenger
2009-05-01 01:02 . 2009-02-09 16:18 663552 ----a-w c:\windows\system32\nvcuvid.dll
2009-05-01 01:02 . 2006-12-21 03:29 8055584 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 01:02 . 2006-12-21 03:29 5896320 ----a-w c:\windows\system32\nv4_disp.dll
2009-04-21 23:55 . 2009-04-21 23:55 -------- d-----w c:\arquivos de programas\America's Army
2009-04-21 18:47 . 2009-04-21 18:47 20480 ----a-w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client\dcds\patches\aadc.1.2.4.2.full.exe
2009-04-21 18:41 . 2009-03-10 06:48 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client
2009-04-19 20:17 . 2009-04-17 17:33 -------- d-----w c:\arquivos de programas\ActMak
2009-04-12 09:41 . 2009-04-12 09:41 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-12 09:41 . 2007-10-07 04:04 -------- d-----w c:\arquivos de programas\Java
2009-04-12 09:41 . 2009-04-12 09:38 152576 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-08 06:39 . 2009-04-08 06:38 -------- d-----w c:\arquivos de programas\WolfQuest
2009-04-07 01:38 . 2009-01-20 20:13 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\U3
2009-04-03 06:49 . 2009-01-31 04:43 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Vsk5Online
2009-04-03 06:39 . 2009-04-03 06:37 -------- d-----w c:\arquivos de programas\Replay AV 8
2009-04-03 06:37 . 2009-04-03 06:37 737280 ----a-w c:\windows\iun6002.exe
2009-04-03 06:36 . 2009-04-03 06:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GetRightToGo
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Freecorder
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Conduit
2009-04-03 06:27 . 2009-04-03 05:55 -------- d-----w c:\arquivos de programas\Freecorder Toolbar
2009-03-27 16:35 . 2007-10-03 00:44 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\dvdcss
2009-03-25 23:24 . 2009-03-25 23:02 -------- d-----w c:\arquivos de programas\Lockleo
2009-02-22 03:28 . 1782-01-19 03:14 83888 ----a-w c:\windows\system32\perfc016.dat
2009-02-22 03:28 . 1782-01-19 03:14 479704 ----a-w c:\windows\system32\perfh016.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\1C4551A64743409391E41477CD655043.TMP ----

2009-05-16 18:38 . 2009-05-16 18:38 200704 ----a-w c:\windows\1C4551A64743409391E41477CD655043.TMP\WiseCustomCalla.dll


(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-16 1953792]
"Adobe Photo Downloader"="c:\arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-04-12 148888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-10 16384000]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Windows Search.lnk - c:\arquivos de programas\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\arquivos de programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Tri Synergy\\UFO Extraterrestrials\\TrueUpdate.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\Atari\\ArmA\\arma.exe"=
"c:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"c:\\Arquivos de programas\\FSFDT\\FWInn\\FWINN.exe"=
"c:\\Arquivos de programas\\FSFDT\\Control Panel\\FSFDTCP.exe"=
"c:\\Program Files\\Atari\\Deer Hunter 2005\\DH2005.exe"=
"c:\\Arquivos de programas\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Arquivos de programas\\GameSpy Arcade\\Aphex.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\dangerouswaters.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\SEGA\\Medieval II Total War\\medieval2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Activision\\Bridge Commander\\stbc.exe"=
"c:\\Program Files\\Vsk5Online\\Vsk5Online.exe"=
"c:\\Arquivos de programas\\Ventrilo\\Ventrilo.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\Steamrun.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\Fallout3.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\FalloutLauncher.exe"=
"c:\\Arquivos de programas\\Steam\\Steam.exe"=
"c:\\Arquivos de programas\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Arquivos de programas\\America's Army\\System\\ArmyOps.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\empire total war\\Empire.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2_sse2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\playgate_120.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5/7/2006 09:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/3/2008 07:43 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30/3/2008 07:43 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [26/12/2007 06:52 2560]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;c:\windows\system32\drivers\SWUSBFLT.SYS [7/8/2004 20:03 3968]
.
.
------- Scan Suplementar -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-22 12:44
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,9e,76,9d,4e,a5,38,74,1d,ab,fc,3d,34,0f,57,77,94,a6,85,91,3a,61,0d,
ef,2c,a9,7b,ad,37,da,ec,55,82,20,a3,d9,cf,ba,9f,66,16,fb,14,5e,40,4f,6c,46,\
"??"=hex:1b,76,be,4e,19,34,99,bc,11,c6,b6,2e,a2,9f,c9,54

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:63,36,fe,1f,21,bf,4e,7e,d3,60,58,8b,35,f7,73,86,b1,d6,47,e2,96,
b5,e9,87,eb,af,b6,18,ad,23,63,9a,e9,79,65,e7,a9,54,64,7e,2f,f9,bd,1e,71,c3,\
"rkeysecu"=hex:eb,06,d0,93,9a,85,ee,a1,6e,45,38,68,71,79,23,53

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\A62C3DF982434ABDAD414E772CEE62E6]
"1"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6c,bf,37,a7,d1,d7,c0,b2
"2"=hex:ac,5d,cf,8a,eb,60,b6,ba
"3"=hex:f8,70,08,41,96,4e,89,5a,d8,11,1b,3f,c3,b8,2e,94,f3,ad,38,27,c9,a3,3e,
73,85,97,2a,3d,33,74,cc,4b,d1,b8,c0,bc,a1,9a,e3,af,71,75,43,ee,3b,56,c4,8a,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6e,6a,1d,2f,00,6b,b9,62,3e,79,c0,6d,00,71,75,df,e6,92,bc,0e,a3,f5,1e,a9,\
"7"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,56,a7,02,9d,f0,a0,1d,
cc,28,d9,b1,18,9e,f1,8d,e8,54,e6,61,27,95,2e,52,cc,1c,f7,fa,64,bd,24,b7,82,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,ae,a5,e1,39,c0,fe,a7,12,fb,d4,fe,25,dc,00,56,48,cb,f3,0e,96,93,6e,94,4d,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:72,31,07,4e,cb,fd,20,44,b0,30,08,cc,73,40,ef,7f,03,7e,08,77,1a,71,9b,
32,a0,5d,6a,56,3a,1b,9d,3f,59,3d,58,02,71,57,00,41,67,c8,8e,a7,9b,1c,40,7f,\
"13"=hex:e7,92,97,05,ba,b7,88,9e,85,16,26,36,0f,b2,e3,5a,a3,b8,1f,74,11,d9,0e,
a5,35,1f,db,4c,b4,50,ba,99,05,33,6f,ed,1c,09,d2,1f
"14"=hex:99,f7,bb,1b,0d,9d,88,b4,fa,9e,45,6c,cb,b1,2f,71
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:14,0d,2b,41,dd,9e,f3,8a,7b,48,c2,a6,21,cb,52,28
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:65,2f,cc,ba,3f,19,56,74,70,f2,06,7c,a7,ba,05,4c,3d,1f,99,31,68,53,97,
4d,b7,17,bd,cb,3d,32,2b,06,a6,c0,88,5a,37,c1,39,cd,c7,5a,e9,20,d4,28,74,87,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\B3E62936FE1487AF4E0CC9BD2A26433C]
"1"=hex:df,c7,3a,96,ab,66,13,d2,35,84,aa,2e,3b,c4,59,82
"2"=hex:a5,2d,b1,39,25,57,b6,7c,bd,55,f5,f4,85,30,c7,12
"3"=hex:ff,71,2a,a0,e1,fa,fd,f4,76,36,05,b2,bd,c4,78,4f,17,22,25,5a,bd,6b,bb,
0b,e3,93,49,a9,ee,66,58,2f,a4,2a,9c,fe,75,da,e1,50,28,33,b2,1e,1c,f2,9a,f3,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:df,c7,3a,96,ab,66,13,d2,0e,90,72,68,c4,63,c8,bb,00,5d,70,3b,08,36,97,
bd,ee,04,c1,4a,7c,6f,fd,5f,f7,67,d1,43,f2,ef,e6,1c,89,7c,fa,9f,4c,d6,39,08,\
"7"=hex:93,41,de,56,34,94,a7,b2,13,ca,26,2f,35,a5,e0,53,1e,d5,e7,20,4a,dd,09,
c9,2d,37,7b,a2,3c,71,f4,5e,ed,02,2a,97,fd,fb,2c,72,12,5f,23,ff,c4,2a,48,c4,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,c9,4f,a5,f8,51,27,e9,29,77,5c,86,6d,0a,20,f9,c7,d7,30,8a,47,ce,07,3e,13,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:eb,97,99,7a,65,b9,91,7d,ee,96,33,2e,7e,c5,12,36,66,80,5c,16,18,db,f8,
df,b9,52,b8,ee,31,34,87,75,17,33,ec,40,2b,b3,3d,07,b4,67,e7,22,9b,f8,a1,86,\
"13"=hex:bc,56,46,8c,be,fe,b0,9e,a9,c8,a6,e3,7c,a8,f0,9e,7a,b5,3a,f7,d0,9f,7f,
6b,6b,6f,9a,1a,e8,9b,87,44,36,99,a7,79,53,f4,34,26
"14"=hex:d2,08,a4,82,f1,1a,a0,b4,f5,1f,60,13,49,13,4c,d5
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:df,60,78,8d,35,eb,80,3e,82,79,f2,d5,0b,bb,7d,ee
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:b6,ff,2b,2e,0f,22,1f,03,93,0e,f3,0f,87,f9,4e,67,5c,c8,81,88,cf,56,f8,
bb,6f,5c,8c,63,35,d1,f5,5c,04,ca,19,ef,7e,c6,b8,eb,99,e8,47,13,5f,17,41,7b,\
.
Tempo para conclusão: 2009-05-22 12:45
ComboFix-quarantined-files.txt 2009-05-22 15:45
ComboFix2.txt 2009-05-22 12:35

Pré-execução: 25 pasta(s) 56.852.963.328 bytes disponíveis
Pós execução: 24 pasta(s) 56.862.875.648 bytes disponíveis

Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5
355 --- E O F --- 2007-08-09 06:45

----------------------------------------------------------

Kaspersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, May 22, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, May 22, 2009 16:07:32
Records in database: 2218315
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 362707
Threat name: 3
Infected objects: 8
Suspicious objects: 0
Duration of the scan: 04:13:01


File name / Threat name / Threats count
C:\Downloads\techguy\Keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Downloads\techguy\Keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1
C:\Downloads\techguy\keytool.zip Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Downloads\techguy\keytool.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\adptrmyhelpq.exe.vir Infected: Trojan.Win32.Inject.aapx 1
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP540\A0082799.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP540\A0082799.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP576\A0092432.exe Infected: Trojan.Win32.Inject.aapx 1

The selected area was scanned.

[katana]

Those logs look good

Please reboot and let me know how things are.

[Wardo]

Rebooted.

Well, the Security Center notify remains enabled, but once again the task bar took about 5 minutes to "load" or "unfreeze" or who knows what, during which time Ctrl+Alt+Del wouldn't open the task manager.

I can execute some programs from the Desktop icons while this is occuring, such as Autoruns, which I did, and from it I noticed there were no debuggers on the Image File Execution Options at all, so this is good news and bad news. The good news is that debuggers aren't being written to the registry anymore. The bad news to me is that I was wrong, the debuggers weren't causing the half-hanged start up and now I have a terrible mystery on my hands, and feel pushed one step closer to reformat.

Plus a new symptom: tomorrow I'll be using a Voice Recorder and I decided to unload it on this PC. When I connected it to an USB port I heard a "glitched" version of XP's default USB connecting sound. It's as if the sound played twice, but only the first few miliseconds each time, as if it was interrupted. The device didn't work, it simply doesn't recognize the connection, it doesn't appear in Windows Explorer. However, strangely enough, disconnecting it plays the default sound properly. I tested with two USB memory flash drives and had the same result, in different USB ports. The bizarre thing is that I have an USB joystick connected, which remains connected all the time, and it's working fine.

So I don't know if there's any malware left messing up the windows start-up and USB or if this is scar damage from the infection. Only your ninja powers can tell, katana.

[katana]

Your logs aren't showing anything that would cause USB problems ???

Let's see if we can sort the freezing problem, and then go from there.



Fix With HJT

Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present

O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www2.rasterwerks.com/game/phosphor/beta1.asp"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis



Download Winpatrol It is an excellent startup manager and then some !!

Install Winpatrol, and when running click on the Startup Programs tab
The following items can safely be disabled.

[JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
[36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
[Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
[Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[RTHDCPL] RTHDCPL.EXE
[Alcmtr] ALCMTR.EXE
[NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
[SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"
[nwiz] nwiz.exe /install
[NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
[NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

Just click on each item and then click Disable
(if the program is running, Winpatrol will ask if you wish to stop it)

Reboot your computer and see if that has helped the boot time.

[Wardo]

Sorry for the delay, I've been away for the weekend.

I did as you told but still no go.