Win32.Delf.uv and Hupigon13 return on reboot

Wardo · May 19, 2009

Greetings,

A few hours ago my Avast anti-virus launched a bunch of alerts of infected Temporary Internet files (http://img73.imageshack.us/img73/1585/avastlog.jpg) after I visited a now obviously bad website; I kept telling Avast to delete the files while doing ALT-F4 on Internet Explorer.

Knowing the brown matter had already hit the fan, I opened IE again and deleted all cache: Temporary Internet Files, Cookies and even Form Data and Passwords, neither of which I even use. Knowing from a virtumonde infection in the past that this would not be enough I updated the mighty Spybot and allowed it to scan for trouble. It found the two bastards mentioned in the title: Win32.Delf.uv and Hupigon13.

Spybot supposedly fixed the problems, but I knew this type of pest was not that easy to remove and so I used my PC for a few more hours to do what I had to do before rebooting to see the extent of the damage. At first it seemed terrible: Windows would initialize to a point, the desktop would appear, the icons and the task bar aswell, but the task bar was "frozen" and Ctrl+Alt+Del wouldn't open the task manager. I turn the PC off by holding the power button and attempted to boot in Safe-Mode, but that didn't work as I'd just get a blue-screen and then a reboot before Windows even began initializing, and so I booted normally again and decided to wait it out, and after about 10 minutes everything went back to normal, no slow down or anything.

I ran Spybot again and it detected Win32.Delf.uv and Hupigon13 again, and I ordered it to fix once more.

To run HijackThis I had to rename HijackThis.exe to hello.exe for it to open, and then I got an error right as it began to scan:

"an unexpected error has occured at procedure: modRegistry_IniGetString(sFile=system.ini, sSection=boot, sValue=Shell)
Error #5 - Invalid procedure call or argument"
HJT version 2.0.2

I clicked yes on report the error, then got a No Internet Connection Available box with an Ok button, clicked Ok, then the same error above but with (sFile=win.ini, sSection=windows, sValue=load)

They look like this: http://img73.imageshack.us/img73/9968/hjterror.jpg

After that it produced a log, and here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:40:22, on 19/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\runservice.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Trend Micro\HijackThis\hello.exe
C:\WINDOWS\system32\mspaint.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Arquivos de programas\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www2.rasterwerks.com/game/phosphor/beta1.asp"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1235270134703
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD7/JSCDL/...6u13-windows-i586-jc.cab&BHost=javadl.sun.com
O16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Log de eventos EventlogNtLmSsp (EventlogNtLmSsp) - Unknown owner - C:\WINDOWS\system32\adptrmyhelpq.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 7665 bytes

PS.: Teatimer has been off the whole time. And I have backed up the registry with Erunt a few seconds ago.

Ok, by now I know a little better what's going on. I'm not actually "infected" by anything, Avast! seems to have destroyed the invaders early on before they could do extensive damage.

However, something was left over that keeps creating Debugger keys in the registry "Image File Execution Options" with the value "ntsd -d" on a list of programs every time Windows starts. It's relatively harmless, the Windows boot-up simply takes longer as the task bar and task manager (among who knows what else...) remain frozen from 5 to 10 minutes long (even though I can run Spybot, Malwarebytes, etc. from shortcuts or Windows Explorer), but then come back to normal on their own and I can use the computer as usual, no slow downs, redirects, alerts, nothing, and I can remove these keys with Spybot (some keys) or Malwarebytes antimalware (all keys). Besides the debuggers I also get 3 persistent changes to Security Center in the registry (AntiVirusDisableNotify, FirewallDisableNotify, UpdatesDisableNotify).

The other problem is that I cannot boot-up in Safe-mode for some reason, when I try to do so I can see the list of drivers or whatever loading but then I get a very uninformative Blue Screen of Death that reads (translating):

-
A problem was detected and Windows shut down to avoid damage to the computer.

If this is the first time you see this screen reboot. If seen again follow these steps:

Check for virus in the computer. Remove any HDD or HDD controller installed recently. Check the HDD to verify if it's configured and connected properly. Execute CHKDSK /F to verify if the HDD has been corrupted and restart the computer.

Technical information:
*** STOP: 0x0000007B (0xF789E524, 0x00000034, 0x00000000, 0x00000000)
-

A little drastic. Perhaps it's just the boot.ini or some other .ini? Perhaps it's the Rootkit.

Anyway, my problem is basically finding the cause of the debugger keys being created in the registry at every reboot. In looking for it I did the following:

1. Searched for anything suspicious to my untrained eyes in Autoruns. Found digiwet.dll in Windows/System32 and discovered in Google that it was bad. Deleted the file plus its autorun entry on Security Providers.

Then I ran malwarebytes antimalware Quick Scan for the first time, and besides the Debugger keys it also found and deleted "C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent)", probably a left over from an infection from the past.

Then Malwarebytes asked for a reboot, for which I complied.

---Reboot---

2. Same symptoms: task bar and manager remain locked for some minutes but then return to normal on their own. The Debuggers and Security Center disabled notify were back.

This time I decided to do a Full Scan with Malwarebytes antimalware, but the only new thing it found were 2 .dlls on System Restore:

C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP575\A0090274.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP575\A0090275.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Seeing as this wasn't going anywhere I decided to give Rootalyzer a try, but its Quick Scan found nothing and its Deep Scan only found harmless Unknown ADS entries (downloaded games, basically: Prison Tycoon 4, 18 Wheels Long Haul and Freerealms, all clean and downloaded before the infection).

So I tried turning TeaTimer on hoping it would keep the registry still.

---Reboot with TeaTimer on---

No effect, same symptoms as above, Debuggers (and SC Notify) were back, same slow start-up.

And that's it. This is as far as I can go alone, I don't know how to find the cause of the Debuggers being written into the registry. Here's their list from Malwarebytes log:

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 90
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filemon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regmon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyDBG.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regtool.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niu.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2SERVICE.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGNT.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGUARD.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCAN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CASECURITYCENTER.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EKRN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FAMEH32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVSERVER.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWIN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSAV32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSGK32ST.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwadins.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwebupw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFRing3.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArcaCheck.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arcavir.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashEnhcd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcls.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz4.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz_se.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdinit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caav.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caavguiscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccupdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpupdat.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRWEB32.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fpscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxup.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navigator.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSTUB.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\preupd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pskdr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SfFnUp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vba32arkit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vba32ldr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zoneband.dll (Security.Hijack) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

katana · May 21, 2009

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply
Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Installed Programs

Please could you give me a list of the programs that are installed.

Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.

Wardo · May 22, 2009

Hello and thank you katana,

Roger that on the rules, however, before visiting this thread I had already begun a Rootkit/malware scan with a renamed GMER.exe. From this point on I won't do anything on my own, as requested, but I did discover something new:

Yesterday I did a scan with GMER and it found a bizarrely named .sys file, I didn't note it down, it was completely random, jmt-a bunch of random letters-.sys, looking it up on Google returned 0 results. GMER said "The system could not find the specified file", and I couldn't find it with Search or manually on Windows/System32/drivers either. On today's scan after turning the PC on and thus on a fresh boot that file is no more on GMER's list, however, a new file has appeared exactly on the same spot: xyaiwrs.sys . It's not on Google either, and "The system could not find the specified fïle" again, and I can't find it on my own either.

If that information is worth anything...

Ok so that's it for my initiative.

---------------------------------------------------

So, I complied as requested:

1. Downloaded Combofix to the Desktop
2. Stopped all monitoring programs (AVast! basically, the "rest" [Windows Defender] was already off)
3. Double-clicked Combofix and followed the prompts with success; it installed the Recovery Console.
4. It produced a log which I saved on the Desktop for ease of reach and shall post below.
5. Re-enabled all the programs previously disabled (which is actually only one, Avast!)

Before I post the log I think I have good news. Whatever Combofix did, if it did anything, seems to be a step forward: when it rebooted the PC the Security Center notifications returned to the Task Bar and complained that my Automatic Updates are turned off (my setting). So perhaps whatever was disabling these notifications is gone at least from this boot. I don't know if the debuggers are back though, I didn't want to move the mouse to check if the task bar was "frozen" while Combofix was producing the log. Anyway, Combofix selected Portuguese as a language, if you need anything translated let me know. For your information:

Arquivo de Programas = Program Files
Dados de Aplicativos = Application Data

I have created myself a c:\Program Files folder which might aswell be called c:\Games because it's where I keep games installed to separate from tools and other software at the default Arquivo de Programas. So when you see a c:\Program Files, pretend it's called c:\Games. Confusing, I know, it's that there are a few sensitive games that won't install on any path other than c:\Program Files. It's not the default or "real" program files though, which is c:\Arquivo de Programas. Yeah, I regret not installing Windows in English too...

Finally, the Combofix log:

ComboFix 09-05-21.03 - Xgamer 22/05/2009 9:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3199.2627 [GMT -3:00]
Executando de: c:\documents and settings\Xgamer\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090519-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\IE4 Error Log.txt
c:\windows\setup.exe
c:\windows\system32\adptrmyhelpq.exe
c:\windows\system32\tmp32.tmp
c:\windows\system32\WINCNMDB.DLL

----- BITS: Sites possivelmente infetados -----

hxxp://msxb-d1.vo.llnw.net:3074
.
((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EVENTLOGNTLMSSP
-------\Service_EventlogNtLmSsp

(((((((((((((((( Arquivos/Ficheiros criados de 2009-04-22 to 2009-05-22 ))))))))))))))))))))))))))))
.

2009-05-22 12:12 . 2009-05-22 12:13 -------- d-----w C:\p2pbackup
2009-05-20 18:17 . 2009-04-06 18:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 18:17 . 2009-04-06 18:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 18:17 . 2009-05-20 18:17 -------- d-----w c:\arquivos de programas\Malwarebytes' Anti-Malware
2009-05-19 12:55 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\REGBACKUP
2009-05-19 12:54 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\ERUNT
2009-05-19 12:25 . 2009-05-19 12:25 -------- d-----w c:\arquivos de programas\Trend Micro
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GamesCafe
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\arquivos de programas\ReflexiveArcade
2009-05-19 01:05 . 2009-05-19 01:05 32 --s-a-w c:\windows\system32\3230355207.dat
2009-05-18 08:13 . 2009-05-18 08:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Dropbox
2009-05-18 08:13 . 2009-05-18 08:13 -------- d-----w c:\arquivos de programas\Dropbox
2009-05-17 02:25 . 2009-05-21 23:42 -------- d-----w c:\arquivos de programas\Sony Online Entertainment
2009-05-16 18:38 . 2009-05-16 18:38 -------- d-----w c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-05-16 18:38 . 2009-05-01 01:02 457248 ----a-w c:\windows\system32\nvudisp.exe
2009-05-16 18:38 . 2009-04-27 03:42 457248 ----a-w c:\windows\system32\NVUNINST.EXE
2009-05-11 04:50 . 2009-05-16 07:58 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-05-06 03:44 . 2009-05-06 04:04 -------- d-----w c:\arquivos de programas\Wurm
2009-05-06 03:41 . 2009-05-06 03:41 65536 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\16\2c0214d0-315845ab-0.1--n\mumblelink.dll
2009-05-06 03:41 . 2009-05-06 03:41 31232 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-dx8.dll
2009-05-06 03:41 . 2009-05-06 03:41 29184 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-raw.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\12\7dbb844c-729fc634-1.0b06--n\gluegen-rt.dll
2009-05-06 03:41 . 2009-05-06 03:41 163328 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\OpenAL32.dll
2009-05-06 03:41 . 2009-05-06 03:41 131072 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\lwjgl.dll
2009-05-06 03:41 . 2009-05-06 03:41 315392 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_awt.dll
2009-05-06 03:41 . 2009-05-06 03:41 114688 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_cg.dll
2009-05-06 02:17 . 2009-05-06 02:17 -------- d-----w c:\arquivos de programas\Netscape
2009-05-01 03:31 . 2009-05-01 03:31 1657376 ----a-w c:\windows\system32\nwiz.exe
2009-05-01 03:31 . 2009-05-01 03:31 449056 ----a-w c:\windows\system32\nvappbar.exe
2009-05-01 03:31 . 2009-05-01 03:31 436768 ----a-w c:\windows\system32\keystone.exe
2009-05-01 03:31 . 2009-05-01 03:31 466944 ----a-w c:\windows\system32\nvshell.dll
2009-05-01 03:31 . 2009-05-01 03:31 1724416 ----a-w c:\windows\system32\nvwdmcpl.dll
2009-05-01 03:31 . 2009-05-01 03:31 1507328 ----a-w c:\windows\system32\nview.dll
2009-05-01 03:31 . 2009-05-01 03:31 1101824 ----a-w c:\windows\system32\nvwimg.dll
2009-05-01 01:02 . 2009-05-01 01:02 9994240 ----a-w c:\windows\system32\nvoglnt.dll
2009-05-01 01:02 . 2009-05-01 01:02 806912 ----a-w c:\windows\system32\nvapi.dll
2009-05-01 01:02 . 2009-05-01 01:02 1720320 ----a-w c:\windows\system32\nvcuda.dll
2009-05-01 01:02 . 2009-05-01 01:02 1579630 ----a-w c:\windows\system32\nvdata.bin
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcodins.dll
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcod.dll
2009-05-01 01:02 . 2009-05-01 01:02 1314816 ----a-w c:\windows\system32\nvcuvenc.dll
2009-04-23 15:59 . 2009-05-19 05:45 138016 ----a-w c:\windows\system32\drivers\pnkbstrk.sys
2009-04-23 15:58 . 2009-05-19 05:45 189392 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-23 15:58 . 2009-04-23 15:58 75064 ----a-w c:\windows\system32\PnkBstrA.exe

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 12:25 . 2007-12-26 09:52 3201 --sha-w c:\windows\system32\mmf.sys
2009-05-22 01:08 . 2007-08-29 20:41 -------- d-----w c:\arquivos de programas\Grumble
2009-05-22 00:59 . 2008-08-25 20:49 -------- d-----w c:\arquivos de programas\Grvid
2009-05-19 10:56 . 2008-09-20 21:20 -------- d-----w c:\arquivos de programas\Spybot - Search & Destroy
2009-05-19 02:40 . 2007-08-25 12:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus
2009-05-18 15:25 . 2008-03-30 10:43 -------- d-----w c:\arquivos de programas\Cheat Engine
2009-05-18 12:39 . 2008-08-21 21:12 -------- d-----w c:\arquivos de programas\Steam
2009-05-18 02:44 . 2007-10-11 03:54 7114736 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus\plugins\azemp\azmplay.exe
2009-05-18 02:11 . 2007-08-25 12:36 -------- d-----w c:\arquivos de programas\Azureus
2009-05-16 18:38 . 2009-02-01 18:57 -------- d-----w c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-05-12 18:04 . 2004-08-04 21:04 -------- d--h--w c:\arquivos de programas\InstallShield Installation Information
2009-05-08 23:57 . 2009-04-21 18:37 -------- d-----w c:\arquivos de programas\America's Army Deploy Client
2009-05-06 04:06 . 2004-08-04 21:49 -------- d-----w c:\arquivos de programas\MSN Messenger
2009-05-01 01:02 . 2009-02-09 16:18 663552 ----a-w c:\windows\system32\nvcuvid.dll
2009-05-01 01:02 . 2006-12-21 03:29 8055584 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 01:02 . 2006-12-21 03:29 5896320 ----a-w c:\windows\system32\nv4_disp.dll
2009-04-23 20:30 . 2008-10-15 20:54 -------- d-----w c:\arquivos de programas\eMule
2009-04-21 23:55 . 2009-04-21 23:55 -------- d-----w c:\arquivos de programas\America's Army
2009-04-21 18:47 . 2009-04-21 18:47 20480 ----a-w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client\dcds\patches\aadc.1.2.4.2.full.exe
2009-04-21 18:41 . 2009-03-10 06:48 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client
2009-04-19 20:17 . 2009-04-17 17:33 -------- d-----w c:\arquivos de programas\ActMak
2009-04-12 09:41 . 2009-04-12 09:41 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-12 09:41 . 2007-10-07 04:04 -------- d-----w c:\arquivos de programas\Java
2009-04-12 09:41 . 2009-04-12 09:38 152576 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-08 06:39 . 2009-04-08 06:38 -------- d-----w c:\arquivos de programas\WolfQuest
2009-04-07 01:38 . 2009-01-20 20:13 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\U3
2009-04-03 06:49 . 2009-01-31 04:43 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Vsk5Online
2009-04-03 06:39 . 2009-04-03 06:37 -------- d-----w c:\arquivos de programas\Replay AV 8
2009-04-03 06:37 . 2009-04-03 06:37 737280 ----a-w c:\windows\iun6002.exe
2009-04-03 06:36 . 2009-04-03 06:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GetRightToGo
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Freecorder
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Conduit
2009-04-03 06:27 . 2009-04-03 05:55 -------- d-----w c:\arquivos de programas\Freecorder Toolbar
2009-03-27 16:35 . 2007-10-03 00:44 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\dvdcss
2009-03-25 23:24 . 2009-03-25 23:02 -------- d-----w c:\arquivos de programas\Lockleo
2009-02-22 03:28 . 1782-01-19 03:14 83888 ----a-w c:\windows\system32\perfc016.dat
2009-02-22 03:28 . 1782-01-19 03:14 479704 ----a-w c:\windows\system32\perfh016.dat
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-16 1953792]
"Adobe Photo Downloader"="c:\arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-04-12 148888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-10 16384000]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Windows Search.lnk - c:\arquivos de programas\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\arquivos de programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Tri Synergy\\UFO Extraterrestrials\\TrueUpdate.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\Atari\\ArmA\\arma.exe"=
"c:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"c:\\Arquivos de programas\\FSFDT\\FWInn\\FWINN.exe"=
"c:\\Arquivos de programas\\FSFDT\\Control Panel\\FSFDTCP.exe"=
"c:\\Program Files\\Atari\\Deer Hunter 2005\\DH2005.exe"=
"c:\\Arquivos de programas\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Arquivos de programas\\GameSpy Arcade\\Aphex.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\dangerouswaters.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Arquivos de programas\\Pando Networks\\Pando\\pando.exe"=
"c:\\Arquivos de programas\\eMule\\emule.exe"=
"c:\\Program Files\\SEGA\\Medieval II Total War\\medieval2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Activision\\Bridge Commander\\stbc.exe"=
"c:\\Program Files\\Vsk5Online\\Vsk5Online.exe"=
"c:\\Arquivos de programas\\Ventrilo\\Ventrilo.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\Steamrun.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\Fallout3.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\FalloutLauncher.exe"=
"c:\\Arquivos de programas\\Steam\\Steam.exe"=
"c:\\Arquivos de programas\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Arquivos de programas\\America's Army\\System\\ArmyOps.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\empire total war\\Empire.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2_sse2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\playgate_120.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56455:TCP"= 56455:TCP

ando P2P TCP Listening Port
"56455:UDP"= 56455:UDP

ando P2P UDP Listening Port

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5/7/2006 09:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/3/2008 07:43 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30/3/2008 07:43 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [26/12/2007 06:52 2560]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;c:\windows\system32\drivers\SWUSBFLT.SYS [7/8/2004 20:03 3968]
.
- - - - ORFÃOS REMOVIDOS - - - -

BHO-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET

.
------- Scan Suplementar -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-22 09:25
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,9e,76,9d,4e,a5,38,74,1d,ab,fc,3d,34,0f,57,77,94,a6,85,91,3a,61,0d,
ef,2c,a9,7b,ad,37,da,ec,55,82,20,a3,d9,cf,ba,9f,66,16,fb,14,5e,40,4f,6c,46,\
"??"=hex:1b,76,be,4e,19,34,99,bc,11,c6,b6,2e,a2,9f,c9,54

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:63,36,fe,1f,21,bf,4e,7e,d3,60,58,8b,35,f7,73,86,b1,d6,47,e2,96,
b5,e9,87,eb,af,b6,18,ad,23,63,9a,e9,79,65,e7,a9,54,64,7e,2f,f9,bd,1e,71,c3,\
"rkeysecu"=hex:eb,06,d0,93,9a,85,ee,a1,6e,45,38,68,71,79,23,53

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\A62C3DF982434ABDAD414E772CEE62E6]
"1"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6c,bf,37,a7,d1,d7,c0,b2
"2"=hex:ac,5d,cf,8a,eb,60,b6,ba
"3"=hex:f8,70,08,41,96,4e,89,5a,d8,11,1b,3f,c3,b8,2e,94,f3,ad,38,27,c9,a3,3e,
73,85,97,2a,3d,33,74,cc,4b,d1,b8,c0,bc,a1,9a,e3,af,71,75,43,ee,3b,56,c4,8a,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6e,6a,1d,2f,00,6b,b9,62,3e,79,c0,6d,00,71,75,df,e6,92,bc,0e,a3,f5,1e,a9,\
"7"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,56,a7,02,9d,f0,a0,1d,
cc,28,d9,b1,18,9e,f1,8d,e8,54,e6,61,27,95,2e,52,cc,1c,f7,fa,64,bd,24,b7,82,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,ae,a5,e1,39,c0,fe,a7,12,fb,d4,fe,25,dc,00,56,48,cb,f3,0e,96,93,6e,94,4d,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:72,31,07,4e,cb,fd,20,44,b0,30,08,cc,73,40,ef,7f,03,7e,08,77,1a,71,9b,
32,a0,5d,6a,56,3a,1b,9d,3f,59,3d,58,02,71,57,00,41,67,c8,8e,a7,9b,1c,40,7f,\
"13"=hex:e7,92,97,05,ba,b7,88,9e,85,16,26,36,0f,b2,e3,5a,a3,b8,1f,74,11,d9,0e,
a5,35,1f,db,4c,b4,50,ba,99,05,33,6f,ed,1c,09,d2,1f
"14"=hex:99,f7,bb,1b,0d,9d,88,b4,fa,9e,45,6c,cb,b1,2f,71
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:14,0d,2b,41,dd,9e,f3,8a,7b,48,c2,a6,21,cb,52,28
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:65,2f,cc,ba,3f,19,56,74,70,f2,06,7c,a7,ba,05,4c,3d,1f,99,31,68,53,97,
4d,b7,17,bd,cb,3d,32,2b,06,a6,c0,88,5a,37,c1,39,cd,c7,5a,e9,20,d4,28,74,87,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\B3E62936FE1487AF4E0CC9BD2A26433C]
"1"=hex:df,c7,3a,96,ab,66,13,d2,35,84,aa,2e,3b,c4,59,82
"2"=hex:a5,2d,b1,39,25,57,b6,7c,bd,55,f5,f4,85,30,c7,12
"3"=hex:ff,71,2a,a0,e1,fa,fd,f4,76,36,05,b2,bd,c4,78,4f,17,22,25,5a,bd,6b,bb,
0b,e3,93,49,a9,ee,66,58,2f,a4,2a,9c,fe,75,da,e1,50,28,33,b2,1e,1c,f2,9a,f3,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:df,c7,3a,96,ab,66,13,d2,0e,90,72,68,c4,63,c8,bb,00,5d,70,3b,08,36,97,
bd,ee,04,c1,4a,7c,6f,fd,5f,f7,67,d1,43,f2,ef,e6,1c,89,7c,fa,9f,4c,d6,39,08,\
"7"=hex:93,41,de,56,34,94,a7,b2,13,ca,26,2f,35,a5,e0,53,1e,d5,e7,20,4a,dd,09,
c9,2d,37,7b,a2,3c,71,f4,5e,ed,02,2a,97,fd,fb,2c,72,12,5f,23,ff,c4,2a,48,c4,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,c9,4f,a5,f8,51,27,e9,29,77,5c,86,6d,0a,20,f9,c7,d7,30,8a,47,ce,07,3e,13,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:eb,97,99,7a,65,b9,91,7d,ee,96,33,2e,7e,c5,12,36,66,80,5c,16,18,db,f8,
df,b9,52,b8,ee,31,34,87,75,17,33,ec,40,2b,b3,3d,07,b4,67,e7,22,9b,f8,a1,86,\
"13"=hex:bc,56,46,8c,be,fe,b0,9e,a9,c8,a6,e3,7c,a8,f0,9e,7a,b5,3a,f7,d0,9f,7f,
6b,6b,6f,9a,1a,e8,9b,87,44,36,99,a7,79,53,f4,34,26
"14"=hex:d2,08,a4,82,f1,1a,a0,b4,f5,1f,60,13,49,13,4c,d5
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:df,60,78,8d,35,eb,80,3e,82,79,f2,d5,0b,bb,7d,ee
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:b6,ff,2b,2e,0f,22,1f,03,93,0e,f3,0f,87,f9,4e,67,5c,c8,81,88,cf,56,f8,
bb,6f,5c,8c,63,35,d1,f5,5c,04,ca,19,ef,7e,c6,b8,eb,99,e8,47,13,5f,17,41,7b,\
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'Explorer.EXE'(1740)
c:\arquivos de programas\Dropbox\DropboxExt.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
c:\arquivos de programas\Alwil Software\Avast4\ashServ.exe
c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
c:\arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Tempo para conclusão: 2009-05-22 9:35 - Máquina reiniciou
ComboFix-quarantined-files.txt 2009-05-22 12:35

Pré-execução: 24 pasta(s) 57.100.607.488 bytes disponíveis
Pós execução: 23 pasta(s) 56.799.035.392 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5
328 --- E O F --- 2007-08-09 06:45

Wardo · May 22, 2009

Now for the installed programs, I wasn't expecting help this fast so I didn't bother uninstalling P2P programs which I do have (Azureus and eMule). I won't uninstall them untill instructed to, of course.

So here's HJT's Uninstall Manager list:

18 Wheels of Steel: American Long Haul
ActMaker 2.5
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.0 - Português
Adobe Shockwave Player 11
Adobe® Photoshop® Album Starter Edition 3.2
Age of Pirates - Caribbean Tales 1.5
America's Army Deploy Client
ArmA Uninstall
Atualização de Segurança para o Windows Media Player (KB952069)
Atualização de Segurança para o Windows Media Player 10 (KB917734)
Atualização de Segurança para o Windows Media Player 10 (KB936782)
Atualização de Segurança para o Windows Media Player 11 (KB936782)
Atualização de Segurança para o Windows Media Player 11 (KB954154)
Atualização de Segurança para Windows Internet Explorer 7 (KB938127-v2)
Atualização de Segurança para Windows Internet Explorer 7 (KB961260)
Atualização de Segurança para Windows XP (KB938464)
Atualização de Segurança para Windows XP (KB941569)
Atualização de Segurança para Windows XP (KB946648)
Atualização de Segurança para Windows XP (KB950760)
Atualização de Segurança para Windows XP (KB950762)
Atualização de Segurança para Windows XP (KB950974)
Atualização de Segurança para Windows XP (KB951066)
Atualização de Segurança para Windows XP (KB951376-v2)
Atualização de Segurança para Windows XP (KB951698)
Atualização de Segurança para Windows XP (KB951748)
Atualização de Segurança para Windows XP (KB952954)
Atualização de Segurança para Windows XP (KB953839)
Atualização de Segurança para Windows XP (KB954211)
Atualização de Segurança para Windows XP (KB954459)
Atualização de Segurança para Windows XP (KB954600)
Atualização de Segurança para Windows XP (KB955069)
Atualização de Segurança para Windows XP (KB956802)
Atualização de Segurança para Windows XP (KB956803)
Atualização de Segurança para Windows XP (KB956841)
Atualização de Segurança para Windows XP (KB957097)
Atualização de Segurança para Windows XP (KB958644)
Atualização de Segurança para Windows XP (KB958687)
Atualização de Segurança para Windows XP (KB960715)
Atualização para Windows XP (KB942763)
Atualização para Windows XP (KB951072-v2)
Atualização para Windows XP (KB951978)
Atualização para Windows XP (KB955839)
Audacity 1.2.6
avast! Antivirus
Azureus Vuze
B17 - The Mighty Eighth
Battleground Europe: WWIIOL
BattlEye Uninstall
Bus Driver 1.0
CDex extraction audio
Cheat Engine 5.4
Combat Mission Shock Force
Compatibility Pack for the 2007 Office system
Cooking Academy
Covert Operations
Covert Operations Training
Dangerous Waters
Deer Hunter - The 2005 Season
Digital Voice Editor 3
DivX Content Uploader
DivX Web Player
Download Manager 2.3.7
Dream Flashsee v1.3
Dropbox
EA Download Manager
Empire: Total War
eMule
ERUNT 1.1j
Europa Universalis III
Falcon 4.0: Allied Force
Fallout 3
Free Realms Installer
FSFDT FSCopilot
FSFDT FSInn
GamersGate Downloader
GameSpy Arcade
GameTap Web Player
Gangsters
GIMPshop 2.2.8
GPGNet
Grass Roots Trial
GTAIII
Hard Time Trial
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hitman Blood Money
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB915800-v4)
Hotfix para o Windows Media Player 11 (KB939683)
Hotfix para Windows XP (KB952287)
IL-2 Sturmovik 1946
IrfanView (remove only)
Java(TM) 6 Update 13
Java(TM) 6 Update 3
Java(TM) 6 Update 7
JMB36X Raid Configurer
Jurassic Park Operation Genesis
Left 4 Dead
Locomotion
LucasArts' X-Wing Alliance
Malwarebytes' Anti-Malware
Marvell Miniport Driver
Medieval II Total War
Medieval II Total War Kingdoms
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Brazilian Portuguese Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PTB
Microsoft .NET Framework 3.0 Brazilian Portuguese Language Pack
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PTB
Microsoft .NET Framework 3.5 Language Pack SP1 - ptb
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Close Combat: A Bridge Too Far
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Flight Simulator X
Microsoft Flight Simulator X
Microsoft Flight Simulator X Service Pack 1
Microsoft Flight Simulator X: Acceleration
Microsoft Flight Simulator X: Acceleration
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edição 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
Mount&Blade
Mozilla Firefox (3.0.1)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Napoleon's Ambition 2.2
Nero 6 Ultra Edition
Net Transport 1.87.258
Nethergate
NVIDIA Drivers
NVIDIA PhysX
OpenAL
Pacote de Idiomas do Microsoft .NET Framework 3.5 SP1 - PTB
Pacote de Idiomas do Português (Brasil) para Microsoft .NET Framework 3.0
Pacote de Provedor de Serviços de Criptografia para o Microsoft Base Smart Card
Paint.NET v3.36
Pando
PC Probe II
PlayGATE Setup
Prison Tycoon 4
Reach Trial
RealSpeak_Solo_Common_for_Panasonic
RealSpeak_Solo_English_for_Panasonic
RealSpeak_Solo_French_for_Panasonic
RealSpeak_Solo_German_for_Panasonic
RealSpeak_Solo_Italian_for_Panasonic
RealSpeak_Solo_Spanish_for_Panasonic
Realtek High Definition Audio Driver
Replay AV 8
Restaurant Empire
RivaTuner v2.06
SAPI5_Common
SAPI5_English
SDP Downloader
Silent Hunter 4 Wolves of the Pacific
Silent Hunter III
SimCity 4 Rush Hour
SpaceShuttleMission2007 PATCH v1.37
Spybot - Search & Destroy
Star Trek Bridge Commander
Stardock Central
Steam
Supreme Commander
theRestaurant v1.9.1
Translation_iTrans_for_Panasonic
UFO Extraterrestrials
Ventrilo Client
VideoLAN VLC media player 0.8.6c
Virtual E6-B 1.4
Virtual Earth 3D (Beta)
Voice Editing
Vsk5Online
WebIQ Technology Engine
Windows Imaging Component
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Presentation Foundation Language Pack (PTB)
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
WinZip 11.1
WolfQuest
World of Subways Vol.1
Wrecked Trial
Wrestling MPire 2008 (Career Edition) Trial
XML Paper Specification Shared Components Language Pack 1.0
[[FSX]] Carenado MegaPack
----------------------------

To translate:
Atualização de Segurança para = Security Update to
Atualização = Update
Pacote de Idiomas = Language package
Pacote de Provedor de Serviços de Criptografia = Cryptography service provider package

katana · May 22, 2009

REMOVE P2P PROGRAMS

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Azureus Vuze
eMule
Pando

Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected.
The bad guys use P2P filesharing as a major conduit to spread their wares.

Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.

----------------------------------------------------------- -----------------------------------------------------------

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code:

http://forums.spybot.info/showthread.php?p=313671#post313671
Suspect::
c:\windows\system32\3230355207.dat
Folder::
c:\Arquivos de programas\Azureus
c:\Arquivos de programas\Pando Networks
c:\Arquivos de programas\eMule
DirLook::
c:\windows\1C4551A64743409391E41477CD655043.TMP
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Arquivos de programas\\Azureus\\Azureus.exe"=-
"c:\\Arquivos de programas\\Pando Networks\\Pando\\pando.exe"=-
"c:\\Arquivos de programas\\eMule\\emule.exe"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56455:TCP"=-
"56455:UDP"=-

ADS::

Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Logs/Information to Post in Reply
Please post the following logs/Information in your reply

Combofix Log
Kaspersky Log
How are things running now, any problems still ?

----------------------------------------------------------- -----------------------------------------------------------

Remove Programs

Older versions of some programs have vulnerabilities that malware can use to infect your system.

Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
click on the program to highlight it, and click on remove.

Java(TM) 6 Update 3
Java(TM) 6 Update 7

Now close the Control Panel.

Wardo · May 22, 2009

1. Went to Control Panel and removed: Azureus Vuze, eMule, Pando.

I moved the clean downloaded files to the folder c:\p2pbackup untill I can sort and store them properly.

-

2. Opened notepad, copied and pasted the text from the code box above to the file and saved as CFScript.txt on the Desktop.

3. Dragged CFScript.txt into ComboFix.exe; Combofix fired up and ran. It did not reboot the PC.

The log is below

-

4. Went to the Kaspersky link provided using IE, accepted the terms and downloaded program and database.

5. With no programs open and Avast! and any other real-time scanner, guard, etc. off I selected My Computer from Kaspersky's tab and Scan.

Kaspersky found an old key finder, something quarantined and system restores.

The log is below

-

6. Everything is running fine but to be sure I'd have to reboot and I'm not rebooting without your consent.

-

7. Removed Java Update 3 and 7 via Add/Remove Programs in Control Panel.

If you'd like me to reboot the PC to see what happens let me know.

Logs:

Combofix:

ComboFix 09-05-21.05 - Xgamer 22/05/2009 12:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3199.2722 [GMT -3:00]
Executando de: c:\documents and settings\Xgamer\Desktop\ComboFix.exe
Comandos utilizados :: c:\documents and settings\Xgamer\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090519-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

file zipped: c:\windows\system32\Suspect_3230355207.dat.vir
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\arquivos de programas\Azureus
c:\arquivos de programas\Azureus\hs_err_pid2692.log
c:\arquivos de programas\Azureus\msvcr71.dll
c:\arquivos de programas\Azureus\plugins\azupdater\azupdater_1.8.5.zip
c:\arquivos de programas\Azureus\plugins\azupdater\azupdater_1.8.8.zip
c:\arquivos de programas\Azureus\plugins\azupdater\azupdaterpatcher_1.8.5.jar
c:\arquivos de programas\Azureus\plugins\azupdater\azupdaterpatcher_1.8.8.jar
c:\arquivos de programas\Azureus\plugins\azupdater\plugin.properties_1.8.5
c:\arquivos de programas\Azureus\plugins\azupdater\plugin.properties_1.8.8
c:\arquivos de programas\Azureus\plugins\azupdater\Updater.jar.bak
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.6.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.6.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.7.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.1.7.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.0.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.0.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.1.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.1.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.17.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.17.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.2.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.2.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.5.jar
c:\arquivos de programas\Azureus\plugins\azupnpav\azupnpav_0.2.5.zip
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.1.6
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.1.7
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.0
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.1
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.17
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.2
c:\arquivos de programas\Azureus\plugins\azupnpav\plugin.properties_0.2.5
c:\arquivos de programas\eMule
c:\arquivos de programas\eMule\Temp\002.part
c:\arquivos de programas\eMule\Temp\002.part.met
c:\arquivos de programas\eMule\Temp\002.part.met.bak
c:\arquivos de programas\eMule\Temp\003.part
c:\arquivos de programas\eMule\Temp\003.part.met
c:\arquivos de programas\eMule\Temp\003.part.met.bak
c:\arquivos de programas\eMule\Temp\004.part
c:\arquivos de programas\eMule\Temp\004.part.met
c:\arquivos de programas\eMule\Temp\004.part.met.bak
c:\arquivos de programas\eMule\Temp\005.part
c:\arquivos de programas\eMule\Temp\005.part.met
c:\arquivos de programas\eMule\Temp\005.part.met.bak
c:\arquivos de programas\eMule\Temp\007.part
c:\arquivos de programas\eMule\Temp\007.part.met
c:\arquivos de programas\eMule\Temp\007.part.met.bak
c:\arquivos de programas\eMule\Temp\008.part
c:\arquivos de programas\eMule\Temp\008.part.met
c:\arquivos de programas\eMule\Temp\008.part.met.bak
c:\arquivos de programas\eMule\Temp\009.part
c:\arquivos de programas\eMule\Temp\009.part.met
c:\arquivos de programas\eMule\Temp\009.part.met.bak
c:\arquivos de programas\eMule\Temp\010.part
c:\arquivos de programas\eMule\Temp\010.part.met
c:\arquivos de programas\eMule\Temp\010.part.met.bak
c:\arquivos de programas\eMule\Temp\011.part
c:\arquivos de programas\eMule\Temp\011.part.met
c:\arquivos de programas\eMule\Temp\011.part.met.bak
c:\arquivos de programas\eMule\Temp\012.part
c:\arquivos de programas\eMule\Temp\012.part.met
c:\arquivos de programas\eMule\Temp\012.part.met.bak
c:\arquivos de programas\eMule\Temp\013.part
c:\arquivos de programas\eMule\Temp\013.part.met
c:\arquivos de programas\eMule\Temp\013.part.met.bak
c:\arquivos de programas\eMule\Temp\014.part
c:\arquivos de programas\eMule\Temp\014.part.met
c:\arquivos de programas\eMule\Temp\014.part.met.bak
c:\arquivos de programas\eMule\Temp\015.part
c:\arquivos de programas\eMule\Temp\015.part.met
c:\arquivos de programas\eMule\Temp\015.part.met.bak
c:\arquivos de programas\eMule\Temp\016.part
c:\arquivos de programas\eMule\Temp\016.part.met
c:\arquivos de programas\eMule\Temp\016.part.met.bak

.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-04-22 to 2009-05-22 ))))))))))))))))))))))))))))
.

2009-05-22 12:12 . 2009-05-22 15:29 -------- d-----w C:\p2pbackup
2009-05-20 18:17 . 2009-04-06 18:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 18:17 . 2009-04-06 18:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 18:17 . 2009-05-20 18:17 -------- d-----w c:\arquivos de programas\Malwarebytes' Anti-Malware
2009-05-19 12:55 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\REGBACKUP
2009-05-19 12:54 . 2009-05-19 12:55 -------- d-----w c:\arquivos de programas\ERUNT
2009-05-19 12:25 . 2009-05-19 12:25 -------- d-----w c:\arquivos de programas\Trend Micro
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GamesCafe
2009-05-19 04:15 . 2009-05-19 04:15 -------- d-----w c:\arquivos de programas\ReflexiveArcade
2009-05-19 01:05 . 2009-05-19 01:05 32 --s-a-w c:\windows\system32\3230355207.dat
2009-05-18 08:13 . 2009-05-18 08:15 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Dropbox
2009-05-18 08:13 . 2009-05-18 08:13 -------- d-----w c:\arquivos de programas\Dropbox
2009-05-17 02:25 . 2009-05-21 23:42 -------- d-----w c:\arquivos de programas\Sony Online Entertainment
2009-05-16 18:38 . 2009-05-16 18:38 -------- d-----w c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-05-16 18:38 . 2009-05-01 01:02 457248 ----a-w c:\windows\system32\nvudisp.exe
2009-05-16 18:38 . 2009-04-27 03:42 457248 ----a-w c:\windows\system32\NVUNINST.EXE
2009-05-11 04:50 . 2009-05-16 07:58 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-05-06 03:44 . 2009-05-06 04:04 -------- d-----w c:\arquivos de programas\Wurm
2009-05-06 03:41 . 2009-05-06 03:41 65536 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\16\2c0214d0-315845ab-0.1--n\mumblelink.dll
2009-05-06 03:41 . 2009-05-06 03:41 31232 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-dx8.dll
2009-05-06 03:41 . 2009-05-06 03:41 29184 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\jinput-raw.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\12\7dbb844c-729fc634-1.0b06--n\gluegen-rt.dll
2009-05-06 03:41 . 2009-05-06 03:41 163328 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\OpenAL32.dll
2009-05-06 03:41 . 2009-05-06 03:41 131072 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\22\6bf11e56-732941c5-1.1.4--n\lwjgl.dll
2009-05-06 03:41 . 2009-05-06 03:41 315392 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl.dll
2009-05-06 03:41 . 2009-05-06 03:41 20480 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_awt.dll
2009-05-06 03:41 . 2009-05-06 03:41 114688 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\Deployment\cache\6.0\19\47ad9353-5cc4da4c-1.1.1--n\jogl_cg.dll
2009-05-06 02:17 . 2009-05-06 02:17 -------- d-----w c:\arquivos de programas\Netscape
2009-05-01 03:31 . 2009-05-01 03:31 1657376 ----a-w c:\windows\system32\nwiz.exe
2009-05-01 03:31 . 2009-05-01 03:31 449056 ----a-w c:\windows\system32\nvappbar.exe
2009-05-01 03:31 . 2009-05-01 03:31 436768 ----a-w c:\windows\system32\keystone.exe
2009-05-01 03:31 . 2009-05-01 03:31 466944 ----a-w c:\windows\system32\nvshell.dll
2009-05-01 03:31 . 2009-05-01 03:31 1724416 ----a-w c:\windows\system32\nvwdmcpl.dll
2009-05-01 03:31 . 2009-05-01 03:31 1507328 ----a-w c:\windows\system32\nview.dll
2009-05-01 03:31 . 2009-05-01 03:31 1101824 ----a-w c:\windows\system32\nvwimg.dll
2009-05-01 01:02 . 2009-05-01 01:02 9994240 ----a-w c:\windows\system32\nvoglnt.dll
2009-05-01 01:02 . 2009-05-01 01:02 806912 ----a-w c:\windows\system32\nvapi.dll
2009-05-01 01:02 . 2009-05-01 01:02 1720320 ----a-w c:\windows\system32\nvcuda.dll
2009-05-01 01:02 . 2009-05-01 01:02 1579630 ----a-w c:\windows\system32\nvdata.bin
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcodins.dll
2009-05-01 01:02 . 2009-05-01 01:02 143360 ----a-w c:\windows\system32\nvcod.dll
2009-05-01 01:02 . 2009-05-01 01:02 1314816 ----a-w c:\windows\system32\nvcuvenc.dll
2009-04-23 15:59 . 2009-05-19 05:45 138016 ----a-w c:\windows\system32\drivers\pnkbstrk.sys
2009-04-23 15:58 . 2009-05-19 05:45 189392 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-23 15:58 . 2009-04-23 15:58 75064 ----a-w c:\windows\system32\PnkBstrA.exe

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 12:25 . 2007-12-26 09:52 3201 --sha-w c:\windows\system32\mmf.sys
2009-05-22 01:08 . 2007-08-29 20:41 -------- d-----w c:\arquivos de programas\Grumble
2009-05-22 00:59 . 2008-08-25 20:49 -------- d-----w c:\arquivos de programas\Grvid
2009-05-19 10:56 . 2008-09-20 21:20 -------- d-----w c:\arquivos de programas\Spybot - Search & Destroy
2009-05-19 02:40 . 2007-08-25 12:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus
2009-05-18 15:25 . 2008-03-30 10:43 -------- d-----w c:\arquivos de programas\Cheat Engine
2009-05-18 12:39 . 2008-08-21 21:12 -------- d-----w c:\arquivos de programas\Steam
2009-05-18 02:44 . 2007-10-11 03:54 7114736 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Azureus\plugins\azemp\azmplay.exe
2009-05-16 18:38 . 2009-02-01 18:57 -------- d-----w c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-05-12 18:04 . 2004-08-04 21:04 -------- d--h--w c:\arquivos de programas\InstallShield Installation Information
2009-05-08 23:57 . 2009-04-21 18:37 -------- d-----w c:\arquivos de programas\America's Army Deploy Client
2009-05-06 04:06 . 2004-08-04 21:49 -------- d-----w c:\arquivos de programas\MSN Messenger
2009-05-01 01:02 . 2009-02-09 16:18 663552 ----a-w c:\windows\system32\nvcuvid.dll
2009-05-01 01:02 . 2006-12-21 03:29 8055584 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 01:02 . 2006-12-21 03:29 5896320 ----a-w c:\windows\system32\nv4_disp.dll
2009-04-21 23:55 . 2009-04-21 23:55 -------- d-----w c:\arquivos de programas\America's Army
2009-04-21 18:47 . 2009-04-21 18:47 20480 ----a-w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client\dcds\patches\aadc.1.2.4.2.full.exe
2009-04-21 18:41 . 2009-03-10 06:48 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\America's Army Deploy Client
2009-04-19 20:17 . 2009-04-17 17:33 -------- d-----w c:\arquivos de programas\ActMak
2009-04-12 09:41 . 2009-04-12 09:41 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-12 09:41 . 2007-10-07 04:04 -------- d-----w c:\arquivos de programas\Java
2009-04-12 09:41 . 2009-04-12 09:38 152576 ----a-w c:\documents and settings\Xgamer\Dados de aplicativos\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-08 06:39 . 2009-04-08 06:38 -------- d-----w c:\arquivos de programas\WolfQuest
2009-04-07 01:38 . 2009-01-20 20:13 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\U3
2009-04-03 06:49 . 2009-01-31 04:43 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Vsk5Online
2009-04-03 06:39 . 2009-04-03 06:37 -------- d-----w c:\arquivos de programas\Replay AV 8
2009-04-03 06:37 . 2009-04-03 06:37 737280 ----a-w c:\windows\iun6002.exe
2009-04-03 06:36 . 2009-04-03 06:36 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\GetRightToGo
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Freecorder
2009-04-03 06:27 . 2009-04-03 05:56 -------- d-----w c:\arquivos de programas\Conduit
2009-04-03 06:27 . 2009-04-03 05:55 -------- d-----w c:\arquivos de programas\Freecorder Toolbar
2009-03-27 16:35 . 2007-10-03 00:44 -------- d-----w c:\documents and settings\Xgamer\Dados de aplicativos\dvdcss
2009-03-25 23:24 . 2009-03-25 23:02 -------- d-----w c:\arquivos de programas\Lockleo
2009-02-22 03:28 . 1782-01-19 03:14 83888 ----a-w c:\windows\system32\perfc016.dat
2009-02-22 03:28 . 1782-01-19 03:14 479704 ----a-w c:\windows\system32\perfh016.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\1C4551A64743409391E41477CD655043.TMP ----

2009-05-16 18:38 . 2009-05-16 18:38 200704 ----a-w c:\windows\1C4551A64743409391E41477CD655043.TMP\WiseCustomCalla.dll

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-04-01 08:14 1163264 ----a-w c:\arquivos de programas\Dropbox\DropboxExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-16 1953792]
"Adobe Photo Downloader"="c:\arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-04-12 148888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-10 16384000]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-05-01 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Windows Search.lnk - c:\arquivos de programas\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\arquivos de programas\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Tri Synergy\\UFO Extraterrestrials\\TrueUpdate.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
"c:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Program Files\\Atari\\ArmA\\arma.exe"=
"c:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"c:\\Arquivos de programas\\FSFDT\\FWInn\\FWINN.exe"=
"c:\\Arquivos de programas\\FSFDT\\Control Panel\\FSFDTCP.exe"=
"c:\\Program Files\\Atari\\Deer Hunter 2005\\DH2005.exe"=
"c:\\Arquivos de programas\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Arquivos de programas\\GameSpy Arcade\\Aphex.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\dangerouswaters.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\SEGA\\Medieval II Total War\\medieval2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Activision\\Bridge Commander\\stbc.exe"=
"c:\\Program Files\\Vsk5Online\\Vsk5Online.exe"=
"c:\\Arquivos de programas\\Ventrilo\\Ventrilo.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\dangerous waters\\Steamrun.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\Fallout3.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\fallout 3\\FalloutLauncher.exe"=
"c:\\Arquivos de programas\\Steam\\Steam.exe"=
"c:\\Arquivos de programas\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Arquivos de programas\\America's Army\\System\\ArmyOps.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\empire total war\\Empire.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\WW2_sse2.exe"=
"c:\\Program Files\\CRS\\Battleground Europe\\playgate_120.exe"=
"c:\\Arquivos de programas\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5/7/2006 09:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [30/3/2008 07:43 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [30/3/2008 07:43 20560]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [26/12/2007 06:52 2560]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;c:\windows\system32\drivers\SWUSBFLT.SYS [7/8/2004 20:03 3968]
.
.
------- Scan Suplementar -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-22 12:44
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,9e,76,9d,4e,a5,38,74,1d,ab,fc,3d,34,0f,57,77,94,a6,85,91,3a,61,0d,
ef,2c,a9,7b,ad,37,da,ec,55,82,20,a3,d9,cf,ba,9f,66,16,fb,14,5e,40,4f,6c,46,\
"??"=hex:1b,76,be,4e,19,34,99,bc,11,c6,b6,2e,a2,9f,c9,54

[HKEY_USERS\S-1-5-21-583907252-823518204-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:63,36,fe,1f,21,bf,4e,7e,d3,60,58,8b,35,f7,73,86,b1,d6,47,e2,96,
b5,e9,87,eb,af,b6,18,ad,23,63,9a,e9,79,65,e7,a9,54,64,7e,2f,f9,bd,1e,71,c3,\
"rkeysecu"=hex:eb,06,d0,93,9a,85,ee,a1,6e,45,38,68,71,79,23,53

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347]
"1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae,
25
"2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b,
c3
"3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48,
8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\A62C3DF982434ABDAD414E772CEE62E6]
"1"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6c,bf,37,a7,d1,d7,c0,b2
"2"=hex:ac,5d,cf,8a,eb,60,b6,ba
"3"=hex:f8,70,08,41,96,4e,89,5a,d8,11,1b,3f,c3,b8,2e,94,f3,ad,38,27,c9,a3,3e,
73,85,97,2a,3d,33,74,cc,4b,d1,b8,c0,bc,a1,9a,e3,af,71,75,43,ee,3b,56,c4,8a,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,6a,73,4a,48,57,d9,26,5d,d7,11,8b,51,ce,1c,37,b2,8b,15,99,5d,9d,47,
61,6e,6a,1d,2f,00,6b,b9,62,3e,79,c0,6d,00,71,75,df,e6,92,bc,0e,a3,f5,1e,a9,\
"7"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,56,a7,02,9d,f0,a0,1d,
cc,28,d9,b1,18,9e,f1,8d,e8,54,e6,61,27,95,2e,52,cc,1c,f7,fa,64,bd,24,b7,82,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,ae,a5,e1,39,c0,fe,a7,12,fb,d4,fe,25,dc,00,56,48,cb,f3,0e,96,93,6e,94,4d,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:72,31,07,4e,cb,fd,20,44,b0,30,08,cc,73,40,ef,7f,03,7e,08,77,1a,71,9b,
32,a0,5d,6a,56,3a,1b,9d,3f,59,3d,58,02,71,57,00,41,67,c8,8e,a7,9b,1c,40,7f,\
"13"=hex:e7,92,97,05,ba,b7,88,9e,85,16,26,36,0f,b2,e3,5a,a3,b8,1f,74,11,d9,0e,
a5,35,1f,db,4c,b4,50,ba,99,05,33,6f,ed,1c,09,d2,1f
"14"=hex:99,f7,bb,1b,0d,9d,88,b4,fa,9e,45,6c,cb,b1,2f,71
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:14,0d,2b,41,dd,9e,f3,8a,7b,48,c2,a6,21,cb,52,28
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:65,2f,cc,ba,3f,19,56,74,70,f2,06,7c,a7,ba,05,4c,3d,1f,99,31,68,53,97,
4d,b7,17,bd,cb,3d,32,2b,06,a6,c0,88,5a,37,c1,39,cd,c7,5a,e9,20,d4,28,74,87,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\B3E62936FE1487AF4E0CC9BD2A26433C]
"1"=hex:df,c7,3a,96,ab,66,13,d2,35,84,aa,2e,3b,c4,59,82
"2"=hex:a5,2d,b1,39,25,57,b6,7c,bd,55,f5,f4,85,30,c7,12
"3"=hex:ff,71,2a,a0,e1,fa,fd,f4,76,36,05,b2,bd,c4,78,4f,17,22,25,5a,bd,6b,bb,
0b,e3,93,49,a9,ee,66,58,2f,a4,2a,9c,fe,75,da,e1,50,28,33,b2,1e,1c,f2,9a,f3,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:df,c7,3a,96,ab,66,13,d2,0e,90,72,68,c4,63,c8,bb,00,5d,70,3b,08,36,97,
bd,ee,04,c1,4a,7c,6f,fd,5f,f7,67,d1,43,f2,ef,e6,1c,89,7c,fa,9f,4c,d6,39,08,\
"7"=hex:93,41,de,56,34,94,a7,b2,13,ca,26,2f,35,a5,e0,53,1e,d5,e7,20,4a,dd,09,
c9,2d,37,7b,a2,3c,71,f4,5e,ed,02,2a,97,fd,fb,2c,72,12,5f,23,ff,c4,2a,48,c4,\
"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,2e,4e,96,8c,7e,a3,52,
64,c9,4f,a5,f8,51,27,e9,29,77,5c,86,6d,0a,20,f9,c7,d7,30,8a,47,ce,07,3e,13,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:d0,71,12,cb,08,b7,a7,d6
"10"=hex:81,20,8f,ab,28,6a,52,9c
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:eb,97,99,7a,65,b9,91,7d,ee,96,33,2e,7e,c5,12,36,66,80,5c,16,18,db,f8,
df,b9,52,b8,ee,31,34,87,75,17,33,ec,40,2b,b3,3d,07,b4,67,e7,22,9b,f8,a1,86,\
"13"=hex:bc,56,46,8c,be,fe,b0,9e,a9,c8,a6,e3,7c,a8,f0,9e,7a,b5,3a,f7,d0,9f,7f,
6b,6b,6f,9a,1a,e8,9b,87,44,36,99,a7,79,53,f4,34,26
"14"=hex:d2,08,a4,82,f1,1a,a0,b4,f5,1f,60,13,49,13,4c,d5
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:df,60,78,8d,35,eb,80,3e,82,79,f2,d5,0b,bb,7d,ee
"22"=hex:81,20,8f,ab,28,6a,52,9c
"15"=hex:b6,ff,2b,2e,0f,22,1f,03,93,0e,f3,0f,87,f9,4e,67,5c,c8,81,88,cf,56,f8,
bb,6f,5c,8c,63,35,d1,f5,5c,04,ca,19,ef,7e,c6,b8,eb,99,e8,47,13,5f,17,41,7b,\
.
Tempo para conclusão: 2009-05-22 12:45
ComboFix-quarantined-files.txt 2009-05-22 15:45
ComboFix2.txt 2009-05-22 12:35

Pré-execução: 25 pasta(s) 56.852.963.328 bytes disponíveis
Pós execução: 24 pasta(s) 56.862.875.648 bytes disponíveis

Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5
355 --- E O F --- 2007-08-09 06:45

----------------------------------------------------------

Kaspersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, May 22, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, May 22, 2009 16:07:32
Records in database: 2218315
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 362707
Threat name: 3
Infected objects: 8
Suspicious objects: 0
Duration of the scan: 04:13:01

File name / Threat name / Threats count
C:\Downloads\techguy\Keyfinder.exe Infected: not-a-virus

SWTool.Win32.RAS.g 1
C:\Downloads\techguy\Keyfinder.exe Infected: not-a-virus

SWTool.Win32.RAS.a 1
C:\Downloads\techguy\keytool.zip Infected: not-a-virus

SWTool.Win32.RAS.g 1
C:\Downloads\techguy\keytool.zip Infected: not-a-virus

SWTool.Win32.RAS.a 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\adptrmyhelpq.exe.vir Infected: Trojan.Win32.Inject.aapx 1
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP540\A0082799.exe Infected: not-a-virus

SWTool.Win32.RAS.g 1
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP540\A0082799.exe Infected: not-a-virus

SWTool.Win32.RAS.a 1
C:\System Volume Information\_restore{3331B449-BD5D-4804-8D93-10C46EA8D30C}\RP576\A0092432.exe Infected: Trojan.Win32.Inject.aapx 1

The selected area was scanned.

katana · May 22, 2009

Those logs look good

Please reboot and let me know how things are.

Wardo · May 23, 2009

Rebooted.

Well, the Security Center notify remains enabled, but once again the task bar took about 5 minutes to "load" or "unfreeze" or who knows what, during which time Ctrl+Alt+Del wouldn't open the task manager.

I can execute some programs from the Desktop icons while this is occuring, such as Autoruns, which I did, and from it I noticed there were no debuggers on the Image File Execution Options at all, so this is good news and bad news. The good news is that debuggers aren't being written to the registry anymore. The bad news to me is that I was wrong, the debuggers weren't causing the half-hanged start up and now I have a terrible mystery on my hands, and feel pushed one step closer to reformat. :sad:

Plus a new symptom: tomorrow I'll be using a Voice Recorder and I decided to unload it on this PC. When I connected it to an USB port I heard a "glitched" version of XP's default USB connecting sound. It's as if the sound played twice, but only the first few miliseconds each time, as if it was interrupted. The device didn't work, it simply doesn't recognize the connection, it doesn't appear in Windows Explorer. However, strangely enough, disconnecting it plays the default sound properly. I tested with two USB memory flash drives and had the same result, in different USB ports. The bizarre thing is that I have an USB joystick connected, which remains connected all the time, and it's working fine.

So I don't know if there's any malware left messing up the windows start-up and USB or if this is scar damage from the infection. Only your ninja powers can tell, katana.

katana · May 23, 2009

Your logs aren't showing anything that would cause USB problems ???

Let's see if we can sort the freezing problem, and then go from there.

Fix With HJT

Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present

O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www2.rasterwerks.com/game/phosphor/beta1.asp"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe

- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis

Download Winpatrol It is an excellent startup manager and then some !!

Install Winpatrol, and when running click on the Startup Programs tab
The following items can safely be disabled.

[JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
[36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
[Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
[Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[RTHDCPL] RTHDCPL.EXE
[Alcmtr] ALCMTR.EXE
[NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
[SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"
[nwiz] nwiz.exe /install
[NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
[NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

Just click on each item and then click Disable
(if the program is running, Winpatrol will ask if you wish to stop it)

Reboot your computer and see if that has helped the boot time.

Wardo · May 26, 2009

Sorry for the delay, I've been away for the weekend.

I did as you told but still no go.

katana · May 26, 2009

Wardo said:
I did as you told but still no go.

No need to apologise

No go with the freezing Task Bar, or the the USB problem ?

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.

Wardo · May 26, 2009

Both. My USB Joystick works perfectly fine, and I don't dare disconnecting it, but anything else I connect when the PC is already on doesn't register, it's as if nothing happened, no tray icon, nothing on Windows Explorer, and even the default sound for a USB connection is weird: normally it's a two musical notes sound, but only the first note plays, and three times. Go figure.

And the start-up is simply crazy. Before the infection this PC would boot up in mere seconds. It wasn't a boot-up, it was a lightning, this PC would start up faster than the speed of light, before the light of the Power On LED indicator could reach my eyes and the electric signal of the video card arrive at the monitor the OS was already up and running, I just couldn't see it yet because light travels oh so slow... It was a clean PC and had very few garbage clogging it up, and now it's slightly but annoyingly FUBAR just because a few days ago I carelessly clicked on a search result from Google without double-checking the information to see if it was a fake site (you know, when your searched keywords appear next to non-sensical jumbo that has nothing to do with them). The internet has become a mine-field, and I only wish I could shoot back and mine the lower orifices of malware writes.

If we can't fix the start-up, at least I'm glad we got rid of the malware, we beat them, we didn't go down without putting up a fight.

Anyway, the logs:

log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Xgamer at 2009-05-26 11:16:04
Microsoft Windows XP Professional Service Pack 3
System drive C: has 55 GB (18%) free of 305 GB
Total RAM: 3199 MB (88% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:09, on 26/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Arquivos de programas\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\runservice.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Xgamer\Desktop\RSIT.exe
C:\Arquivos de programas\Trend Micro\HijackThis\Xgamer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Arquivos de programas\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinPatrol] C:\Arquivos de programas\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} (WebIQ Engine Application Object) -
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1235270134703
O16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: MGOO - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Xgamer\CONFIG~1\Temp\MGOO.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 6004 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Facilitador de Leitor de Link Adobe PDF - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Arquivos de programas\Java\jre6\bin\ssv.dll [2009-04-12 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C56CB6B0-0D96-11D6-8C65-B2868B609932}]
NTIECatcher Class - C:\Arquivos de programas\Xi\NetTransport 2\NTIEHelper.dll [2003-12-15 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll [2009-04-12 35840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"WinPatrol"=C:\Arquivos de programas\BillP Studios\WinPatrol\winpatrol.exe [2009-04-20 337216]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-03-30 200064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Arquivos de programas\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"
"C:\Program Files\Tri Synergy\UFO Extraterrestrials\TrueUpdate.exe"="C:\Program Files\Tri Synergy\UFO Extraterrestrials\TrueUpdate.exe:*:Enabled:TrueUpdate 2.0 Client"
"C:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe"="C:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:*:Enabled:Supreme Commander"
"C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe"="C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander"
"C:\Program Files\Atari\ArmA\arma.exe"="C:\Program Files\Atari\ArmA\arma.exe:*:Enabled:ArmA"
"C:\Program Files\Microsoft Games\Microsoft Flight Simulator X\fsx.exe"="C:\Program Files\Microsoft Games\Microsoft Flight Simulator X\fsx.exe:*:Enabled:Microsoft Flight Simulator®"
"C:\Arquivos de programas\FSFDT\FWInn\FWINN.exe"="C:\Arquivos de programas\FSFDT\FWInn\FWINN.exe:*:Enabled:FSInn Application"
"C:\Arquivos de programas\FSFDT\Control Panel\FSFDTCP.exe"="C:\Arquivos de programas\FSFDT\Control Panel\FSFDTCP.exe:*:Enabled:FSFDT Control Panel"
"C:\Program Files\Atari\Deer Hunter 2005\DH2005.exe"="C:\Program Files\Atari\Deer Hunter 2005\DH2005.exe:*:Enabled

H2005"
"C:\Arquivos de programas\Electronic Arts\EADM\Core.exe"="C:\Arquivos de programas\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Arquivos de programas\GameSpy Arcade\Aphex.exe"="C:\Arquivos de programas\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\Arquivos de programas\Steam\steamapps\common\dangerous waters\dangerouswaters.exe"="C:\Arquivos de programas\Steam\steamapps\common\dangerous waters\dangerouswaters.exe:*:Enabled:S.C.S. - Dangerous Waters"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8"
"C:\Program Files\SEGA\Medieval II Total War\medieval2.exe"="C:\Program Files\SEGA\Medieval II Total War\medieval2.exe:*:Enabled:Medieval II Total War"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Activision\Bridge Commander\stbc.exe"="C:\Program Files\Activision\Bridge Commander\stbc.exe:*:Enabled:stbc"
"C:\Program Files\Vsk5Online\Vsk5Online.exe"="C:\Program Files\Vsk5Online\Vsk5Online.exe:*:Enabled:Vsk5Online"
"C:\Arquivos de programas\Ventrilo\Ventrilo.exe"="C:\Arquivos de programas\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\Arquivos de programas\Steam\steamapps\common\dangerous waters\Steamrun.exe"="C:\Arquivos de programas\Steam\steamapps\common\dangerous waters\Steamrun.exe:*:Enabled

angerous Waters"
"C:\Arquivos de programas\Steam\steamapps\common\fallout 3\Fallout3.exe"="C:\Arquivos de programas\Steam\steamapps\common\fallout 3\Fallout3.exe:*:Enabled:Fallout3"
"C:\Arquivos de programas\Steam\steamapps\common\fallout 3\FalloutLauncher.exe"="C:\Arquivos de programas\Steam\steamapps\common\fallout 3\FalloutLauncher.exe:*:Enabled:Fallout 3"
"C:\Arquivos de programas\Steam\Steam.exe"="C:\Arquivos de programas\Steam\Steam.exe:*:Enabled:Steam"
"C:\Arquivos de programas\America's Army Deploy Client\AADeployClient.exe"="C:\Arquivos de programas\America's Army Deploy Client\AADeployClient.exe:*:Enabled:AADeployClient"
"C:\Arquivos de programas\America's Army\System\ArmyOps.exe"="C:\Arquivos de programas\America's Army\System\ArmyOps.exe:*:Enabled:ArmyOps"
"C:\Arquivos de programas\Steam\steamapps\common\empire total war\Empire.exe"="C:\Arquivos de programas\Steam\steamapps\common\empire total war\Empire.exe:*:Enabled:Empire: Total War"
"C:\Arquivos de programas\MSN Messenger\msnmsgr.exe"="C:\Arquivos de programas\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Arquivos de programas\MSN Messenger\livecall.exe"="C:\Arquivos de programas\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\CRS\Battleground Europe\WW2.exe"="C:\Program Files\CRS\Battleground Europe\WW2.exe:*:Enabled

ractice Offline"
"C:\Program Files\CRS\Battleground Europe\WW2_sse2.exe"="C:\Program Files\CRS\Battleground Europe\WW2_sse2.exe:*:Enabled:WW2_sse2.exe"
"C:\Program Files\CRS\Battleground Europe\playgate_120.exe"="C:\Program Files\CRS\Battleground Europe\playgate_120.exe:*:Enabled

laygate_120.exe"
"C:\Arquivos de programas\Steam\steamapps\common\left 4 dead\left4dead.exe"="C:\Arquivos de programas\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"
"C:\Arquivos de programas\MSN Messenger\msnmsgr.exe"="C:\Arquivos de programas\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Arquivos de programas\MSN Messenger\livecall.exe"="C:\Arquivos de programas\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======List of files/folders created in the last 1 months======

2009-05-26 11:16:04 ----D---- C:\rsit
2009-05-25 21:18:10 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-05-25 21:18:06 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-05-25 21:18:00 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-05-25 21:17:49 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-05-25 21:17:44 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-05-25 21:17:39 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-05-25 21:17:31 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-05-25 21:17:27 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-05-25 21:17:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-05-25 21:17:06 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-05-25 20:44:52 ----D---- C:\Documents and Settings\Xgamer\Dados de aplicativos\WinPatrol
2009-05-25 20:44:46 ----D---- C:\Arquivos de programas\BillP Studios
2009-05-22 18:13:03 ----SHD---- C:\RECYCLER
2009-05-22 12:45:36 ----A---- C:\ComboFix.txt
2009-05-22 12:30:58 ----SHD---- C:\Config.Msi
2009-05-22 09:25:03 ----A---- C:\avenger.txt
2009-05-22 09:22:14 ----A---- C:\Boot.bak
2009-05-22 09:22:09 ----RASHD---- C:\cmdcons
2009-05-22 09:20:52 ----A---- C:\WINDOWS\zip.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\SWSC.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\SWREG.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\sed.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\PEV.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\NIRCMD.exe
2009-05-22 09:20:52 ----A---- C:\WINDOWS\grep.exe
2009-05-22 09:20:48 ----D---- C:\WINDOWS\ERDNT
2009-05-22 09:20:46 ----D---- C:\Qoobox
2009-05-22 09:12:14 ----D---- C:\p2pbackup
2009-05-20 15:17:16 ----D---- C:\Arquivos de programas\Malwarebytes' Anti-Malware
2009-05-19 09:55:25 ----D---- C:\Arquivos de programas\REGBACKUP
2009-05-19 09:54:54 ----D---- C:\Arquivos de programas\ERUNT
2009-05-19 09:25:21 ----D---- C:\Arquivos de programas\Trend Micro
2009-05-19 01:15:55 ----D---- C:\Documents and Settings\Xgamer\Dados de aplicativos\GamesCafe
2009-05-19 01:15:30 ----D---- C:\Arquivos de programas\ReflexiveArcade
2009-05-18 05:13:41 ----D---- C:\Documents and Settings\Xgamer\Dados de aplicativos\Dropbox
2009-05-18 05:13:33 ----D---- C:\Arquivos de programas\Dropbox
2009-05-16 23:25:05 ----D---- C:\Arquivos de programas\Sony Online Entertainment
2009-05-16 15:38:45 ----D---- C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP
2009-05-16 15:38:31 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-05-16 15:38:12 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-05-12 15:09:37 ----A---- C:\ZipCodec.txt
2009-05-11 01:50:46 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2009-05-06 00:44:12 ----D---- C:\Arquivos de programas\Wurm
2009-05-05 23:17:56 ----D---- C:\Arquivos de programas\Netscape
2009-05-01 00:31:10 ----A---- C:\WINDOWS\system32\nwiz.exe
2009-05-01 00:31:08 ----A---- C:\WINDOWS\system32\nvappbar.exe
2009-05-01 00:31:08 ----A---- C:\WINDOWS\system32\keystone.exe
2009-05-01 00:31:06 ----A---- C:\WINDOWS\system32\nvwimg.dll
2009-05-01 00:31:06 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll
2009-05-01 00:31:06 ----A---- C:\WINDOWS\system32\nvshell.dll
2009-05-01 00:31:06 ----A---- C:\WINDOWS\system32\nview.dll
2009-05-01 00:30:58 ----A---- C:\WINDOWS\system32\nvcplui.exe
2009-05-01 00:30:48 ----A---- C:\WINDOWS\system32\nvwddi.dll
2009-05-01 00:30:36 ----A---- C:\WINDOWS\system32\nvwss.dll
2009-05-01 00:30:30 ----A---- C:\WINDOWS\system32\nvvitvs.dll
2009-05-01 00:30:26 ----A---- C:\WINDOWS\system32\nvmobls.dll
2009-05-01 00:30:26 ----A---- C:\WINDOWS\system32\nvmccss.dll
2009-05-01 00:30:24 ----A---- C:\WINDOWS\system32\nvgames.dll
2009-05-01 00:30:18 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2009-05-01 00:30:18 ----A---- C:\WINDOWS\system32\nvdisps.dll
2009-05-01 00:30:18 ----A---- C:\WINDOWS\system32\nvcolor.exe
2009-05-01 00:30:16 ----A---- C:\WINDOWS\system32\nvmctray.dll
2009-05-01 00:30:16 ----A---- C:\WINDOWS\system32\nvcpl.dll
2009-05-01 00:30:14 ----A---- C:\WINDOWS\system32\nvmccs.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvcuda.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvcodins.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvcod.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvapi.dll

======List of files/folders modified in the last 1 months======

2009-05-26 11:15:55 ----D---- C:\WINDOWS\Prefetch
2009-05-26 07:29:46 ----D---- C:\WINDOWS\Temp
2009-05-25 22:34:16 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-25 22:27:43 ----D---- C:\WINDOWS\system32
2009-05-25 22:27:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-05-25 22:23:44 ----D---- C:\WINDOWS
2009-05-25 22:23:21 ----D---- C:\Arquivos de programas\Internet Explorer
2009-05-25 22:23:20 ----D---- C:\WINDOWS\system32\wbem
2009-05-25 22:23:20 ----D---- C:\WINDOWS\AppPatch
2009-05-25 22:22:19 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-25 21:18:34 ----HD---- C:\WINDOWS\inf
2009-05-25 21:18:29 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-05-25 21:18:28 ----D---- C:\WINDOWS\system32\pt-br
2009-05-25 21:18:16 ----D---- C:\WINDOWS\ie7updates
2009-05-25 21:18:13 ----A---- C:\WINDOWS\imsins.BAK
2009-05-25 21:17:47 ----HD---- C:\WINDOWS\$hf_mig$
2009-05-25 21:17:17 ----D---- C:\WINDOWS\system32\CatRoot
2009-05-25 20:56:46 ----D---- C:\WINDOWS\system32\drivers
2009-05-25 20:44:46 ----D---- C:\Arquivos de programas
2009-05-22 20:13:42 ----D---- C:\WINDOWS\Minidump
2009-05-22 17:59:15 ----SHD---- C:\WINDOWS\Installer
2009-05-22 17:59:10 ----D---- C:\Arquivos de programas\Java
2009-05-22 17:59:09 ----D---- C:\Arquivos de programas\Arquivos comuns
2009-05-22 17:52:01 ----D---- C:\Downloads
2009-05-22 12:44:10 ----N---- C:\WINDOWS\system.ini
2009-05-22 09:35:13 ----D---- C:\WINDOWS\repair
2009-05-22 09:23:53 ----D---- C:\WINDOWS\system32\config
2009-05-22 09:22:15 ----RASH---- C:\boot.ini
2009-05-22 09:13:28 ----A---- C:\WINDOWS\NeroDigital.ini
2009-05-21 22:08:08 ----D---- C:\Arquivos de programas\Grumble
2009-05-21 21:59:23 ----D---- C:\Arquivos de programas\Grvid
2009-05-19 07:56:38 ----D---- C:\Arquivos de programas\Spybot - Search & Destroy
2009-05-19 02:45:31 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-05-18 23:40:14 ----D---- C:\Documents and Settings\Xgamer\Dados de aplicativos\Azureus
2009-05-18 12:25:57 ----D---- C:\Arquivos de programas\Cheat Engine
2009-05-18 09:39:16 ----D---- C:\Arquivos de programas\Steam
2009-05-16 15:39:05 ----D---- C:\WINDOWS\Help
2009-05-16 15:38:42 ----D---- C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-05-12 15:04:09 ----HD---- C:\Arquivos de programas\InstallShield Installation Information
2009-05-12 15:04:03 ----D---- C:\Program Files
2009-05-08 20:57:55 ----D---- C:\Arquivos de programas\America's Army Deploy Client
2009-05-07 00:16:30 ----A---- C:\WINDOWS\system32\MRT.exe
2009-05-06 01:06:30 ----D---- C:\Arquivos de programas\MSN Messenger
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2009-04-30 22:02:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2006-10-19 12664]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 intelppm;Driver de Processador Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40448]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
R3 GcKernel;Microsoft SideWinder Value Add - Filter Driver; C:\WINDOWS\system32\DRIVERS\GcKernel.sys [2008-04-13 59136]
R3 HDAudBus;Driver de Barramento Microsoft UAA para High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HIDSwvd;Microsoft SideWinder Virtual HID Device Mini-Driver; C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys [2001-08-17 2688]
R3 HidUsb;Driver de classe HID da Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-08-10 4603904]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-12 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver; C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys [2001-08-17 3968]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-03-30 230400]
S3 Arp1394;Protocolo cliente 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 RivaTuner32;RivaTuner32; \??\C:\Arquivos de programas\RivaTuner v2.06\RivaTuner32.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 LicCtrlService;LicCtrl Service; C:\WINDOWS\runservice.exe [2007-12-26 2560]
R2 MDM;Machine Debug Manager; C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-05-01 168004]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-04-23 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-05-19 189392]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S3 aspnet_state;Serviço de estado do ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 ICDSPTSV;Sony SPTI Service for DVE; C:\WINDOWS\system32\IcdSptSv.exe [2003-04-01 69632]
S3 IDriverT;InstallDriver Table Manager; C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MGOO;MGOO; C:\DOCUME~1\Xgamer\CONFIG~1\Temp\MGOO.exe [2009-05-22 392064]
S3 ose;Office Source Engine; C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Serviço de Compartilhamento de Pastas Messenger do USN Journal Reader; C:\Arquivos de programas\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 WMPNetworkSvc;Serviço de Compartilhamento de Rede do Windows Media Player; C:\Arquivos de programas\Windows Media Player\WMPNetwk.exe [2006-11-02 914944]
S4 NetTcpPortSharing;Serviço de Compartilhamento de Porta Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
------------------------------------------------------------------------
info.txt:

info.txt logfile of random's system information tool 1.06 2009-05-26 11:16:12

======Uninstall list======

[[FSX]] Carenado MegaPack-->C:\Program Files\Microsoft Games\Microsoft Flight Simulator X\[[FSX]].Carenado.MegaPack.Uninstal.exe
-->MsiExec /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
18 Wheels of Steel: American Long Haul -->C:\Program Files\18 Wheels of Steel American Long Haul\uninst.exe
ActMaker 2.5-->"C:\Arquivos de programas\ActMak\unins000.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.0 - Português-->MsiExec.exe /I{AC76BA86-7AD7-1046-7B44-A81000000003}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Adobe® Photoshop® Album Starter Edition 3.2-->MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
Age of Pirates - Caribbean Tales 1.5-->"C:\Program Files\Playlogic\Age of Pirates - Caribbean Tales\unins000.exe"
America's Army Deploy Client-->MsiExec.exe /I{6D6204C8-6B1D-4FBA-ADA9-CB6DFF9BF80D}
ArmA Uninstall-->C:\Program files\Atari\ArmA\UnInstall.exe
Atualização Crítica para o Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Atualização de Segurança para o Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Atualização de Segurança para o Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Atualização de Segurança para o Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Atualização de Segurança para o Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Atualização de Segurança para o Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Atualização de Segurança para Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Atualização de Segurança para Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Atualização de Segurança para Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Atualização de Segurança para Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Atualização para Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Atualização para Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Atualização para Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Atualização para Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Audacity 1.2.6-->"C:\Arquivos de programas\Audacity\unins000.exe"
avast! Antivirus-->C:\Arquivos de programas\Alwil Software\Avast4\aswRunDll.exe "C:\Arquivos de programas\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
B17 - The Mighty Eighth-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{63B263C2-1B61-11D4-8B6D-00C0F01F6881}\setup.exe" SetupCheck
Battleground Europe: WWIIOL -->C:\PROGRA~1\CRS\BATTLE~1\UNWISE.EXE C:\PROGRA~1\CRS\BATTLE~1\INSTALL.LOG
BattlEye Uninstall-->C:\Program files\Atari\ArmA\BattlEye\UnInstallBE.exe
Bus Driver 1.0-->C:\Program Files\Bus Driver\uninst.exe
CDex extraction audio-->"C:\Arquivos de programas\CDex_170b2\uninstall.exe"
Cheat Engine 5.4-->"C:\Arquivos de programas\Cheat Engine\unins000.exe"
Combat Mission Shock Force-->"C:\Program Files\Battlefront\Combat Mission Shock Force\unins000.exe"
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Cooking Academy-->MsiExec.exe /I{BACABC87-15A6-42AD-9859-934702250AA1}
Covert Operations Training-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Red Storm Entertainment\Covert Operations Training\DeIsL1.isu" -c"C:\Program Files\Red Storm Entertainment\Covert Operations Training\_ISREG32.DLL"
Covert Operations-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Red Storm Entertainment\Covert Operations\Uninst.isu"
Dangerous Waters-->"C:\Arquivos de programas\Steam\steam.exe" steam://uninstall/1600
Deer Hunter - The 2005 Season-->"C:\Program Files\Atari\Deer Hunter 2005\unins000.exe"
Digital Voice Editor 3-->C:\Arquivos de programas\InstallShield Installation Information\{6CCC133E-9A2F-4CAA-8866-75D029CD3AB3}\setup.exe -runfromtemp -l0x0009 UNINSTALL /z -removeonly
DivX Content Uploader-->C:\Arquivos de programas\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player-->C:\Arquivos de programas\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Download Manager 2.3.7-->C:\Arquivos de programas\Download Manager\uninst.exe
Dream Flashsee v1.3-->"C:\Arquivos de programas\Dream Flashsee\unins000.exe"
Dropbox-->"C:\Arquivos de programas\Dropbox\Uninstall.exe"
EA Download Manager-->C:\ARQUIV~1\ARQUIV~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EF7E931D-DC84-471B-8DB6-A83358095474} /l1046
Empire: Total War-->"C:\Arquivos de programas\Steam\steam.exe" steam://uninstall/10500
ERUNT 1.1j-->"C:\Arquivos de programas\ERUNT\unins000.exe"
Europa Universalis III-->"C:\Program Files\Paradox Interactive\Europa Universalis III\unins000.exe"
Falcon 4.0: Allied Force-->MsiExec.exe /I{7A65E382-1843-4B46-861B-1BECB8354911}
Fallout 3-->"C:\Arquivos de programas\Steam\steam.exe" steam://uninstall/22300
Free Realms Installer-->C:\Arquivos de programas\Sony Online Entertainment\uninst.exe
FSFDT FSCopilot-->C:\Arquivos de programas\FSFDT\uninstallFSCopilot.exe
FSFDT FSInn-->C:\Arquivos de programas\FSFDT\uninstallFSInn.exe
GamersGate Downloader-->"C:\WINDOWS\unins000.exe"
GameSpy Arcade-->C:\ARQUIV~1\GAMESP~1\UNWISE.EXE C:\ARQUIV~1\GAMESP~1\INSTALL.LOG
GameTap Web Player-->C:\Arquivos de programas\InstallShield Installation Information\{1C338B34-1BFB-4BAD-B4A3-7B71A2E221F6}\setup.exe -runfromtemp -l0x0009 -removeonly
Gangsters-->C:\WINDOWS\IsUninst.exe -f"C:\Arquivos de programas\Hothouse Creations\Gangsters\Uninst.isu"
GIMPshop 2.2.8-->C:\Arquivos de programas\GIMPshop\uninst.exe
GPGNet-->MsiExec.exe /I{C194D333-B84A-4BB7-B35E-060732D98DC4}
Grass Roots Trial-->C:\Program Files\MDickie\Grass Roots Trial\Uninstal.exe
GTAIII-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{92B94569-6683-4617-8C54-EB27A1B51B30}\Setup.exe" -l0x9
Hard Time Trial-->C:\Program Files\MDickie\Hard Time Trial\Uninstal.exe
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hitman Blood Money-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}\setup.exe" -l0x9 -removeonly
Hotfix for Microsoft .NET Framework 3.0 (KB932471)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
Hotfix para o Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix para Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix para Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
IL-2 Sturmovik 1946-->C:\ARQUIV~1\ARQUIV~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{79438F1E-DEC3-443D-9DCD-FECE2D68C605} /l1033
IrfanView (remove only)-->C:\Arquivos de programas\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
JMB36X Raid Configurer-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\setup.exe" -l0x9 -removeonly
Jurassic Park Operation Genesis-->C:\ARQUIV~1\ARQUIV~1\INSTAL~1\Driver\8\INTEL3~1\IDriver.exe /M{A347C572-F7B4-43A3-BD51-FFC99184F70D} /l1033
Left 4 Dead-->"C:\Arquivos de programas\Steam\steam.exe" steam://uninstall/500
Locomotion-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{77F45E76-E897-42CA-A9FE-5F56817D875C}\Setup.exe" -l0x9
LucasArts' X-Wing Alliance-->C:\WINDOWS\uninst.exe -f"C:\Program Files\LucasArts\XWingAlliance\DeIsL1.isu"
Malwarebytes' Anti-Malware-->"C:\Arquivos de programas\Malwarebytes' Anti-Malware\unins000.exe"
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Medieval II Total War Kingdoms-->"C:\Arquivos de programas\InstallShield Installation Information\{177703DE-D3F6-4E57-9212-E56A5C6F1164}\setup.exe" -runfromtemp -l0x0009 -removeonly
Medieval II Total War-->"C:\Arquivos de programas\InstallShield Installation Information\{A9D0745C-BABD-472B-8AF0-FAF888D31046}\setup.exe" -runfromtemp -l0x0009 -removeonly
Microsoft .NET Framework 1.1 Brazilian Portuguese Language Pack-->MsiExec.exe /X{0CBADDF4-2CF6-4CDB-B4F5-29B8FCA7FE07}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - PTB-->MsiExec.exe /I{3F31F3B5-C1FF-3708-8611-869DE39C0CB6}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Brazilian Portuguese Language Pack-->MsiExec.exe /X{F407D6FB-D3AD-44CC-B77B-5B3F0FF1F22C}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - PTB-->MsiExec.exe /I{B1FA73D8-AB79-3A2E-81AC-DBBAC155B2FE}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - ptb-->MsiExec.exe /I{1438B41C-658C-35B7-9253-780F2E0A0B8E}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Close Combat: A Bridge Too Far-->C:\Program Files\Microsoft Games\A Bridge Too Far\Uninstal.exe /uninstall
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Flight Simulator X Service Pack 1-->c:\WINDOWS\system32\msiexec.exe /qb /l*vx "%TEMP%\FlightSimPatchUninstall.log" /uninstall {92635E02-4C29-4A8F-AA82-7B8B95C823D3} /package {9527A496-5DF9-412A-ADC7-168BA5379CA6}
Microsoft Flight Simulator X: Acceleration-->C:\WINDOWS\system32\msiexec.exe /qb /l*vx "%TEMP%\FlightSimUninstall.log" /uninstall {A9729B90-D37B-4A69-B66A-7436AC1F7274}
Microsoft Flight Simulator X: Acceleration-->MsiExec.exe /I{A9729B90-D37B-4A69-B66A-7436AC1F7274}
Microsoft Flight Simulator X-->C:\ARQUIV~1\ARQUIV~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{9527A496-5DF9-412A-ADC7-168BA5379CA6}
Microsoft Flight Simulator X-->MsiExec.exe /X{9527A496-5DF9-412A-ADC7-168BA5379CA6}
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{FD052FB9-FE90-4438-B355-15EDC89D8FB1}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edição 2003-->MsiExec.exe /I{90110416-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Windows Media Video 9 VCM-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall
Mount&Blade-->C:\Program Files\Mount&Blade\uninstall.exe
Mozilla Firefox (3.0.1)-->C:\Arquivos de programas\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Napoleon's Ambition 2.2-->"C:\Program Files\Paradox Interactive\Europa Universalis III\unins001.exe"
Nero 6 Ultra Edition-->C:\Arquivos de programas\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Net Transport 1.87.258-->"C:\Arquivos de programas\Xi\NetTransport 2\unins000.exe"
Nethergate-->MsiExec.exe /I{1DED5EFD-410A-48DB-909A-2B2022BB50D2}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
OpenAL-->"C:\Arquivos de programas\OpenAL\oalinst.exe" /U
Pacote de Idiomas do Microsoft .NET Framework 3.5 SP1 - PTB-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - ptb\setup.exe
Pacote de Idiomas do Português (Brasil) para Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 Brazilian Portuguese Language Pack\setup.exe
Pacote de Provedor de Serviços de Criptografia para o Microsoft Base Smart Card-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Paint.NET v3.36-->MsiExec.exe /X{43602F34-1AA3-44FB-AEB2-D08C2C73743F}
PC Probe II-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}\Setup.exe" -l0x9
PlayGATE Setup-->C:\ARQUIV~1\Playnet\Playgate\UNWISE.EXE C:\ARQUIV~1\Playnet\Playgate\INSTALL.LOG
Prison Tycoon 4-->"C:\Arquivos de programas\InstallShield Installation Information\{79211375-1316-45BB-B598-AEF886398855}\setup.exe" -runfromtemp -l0x0009 -removeonly
Reach Trial-->C:\Program Files\MDickie\Reach Trial\Uninstal.exe
RealSpeak_Solo_Common_for_Panasonic-->MsiExec.exe /I{C52BEBC0-4A0C-42FB-B7EC-FAD0A14DD64E}
RealSpeak_Solo_English_for_Panasonic-->MsiExec.exe /I{DA12E3FF-60E1-43E0-8E64-C43890A596AE}
RealSpeak_Solo_French_for_Panasonic-->MsiExec.exe /I{5004A142-87B7-4CD5-AF7B-C1E536407762}
RealSpeak_Solo_German_for_Panasonic-->MsiExec.exe /I{68E7B6EF-A939-48E5-80BB-1E8F04E8957E}
RealSpeak_Solo_Italian_for_Panasonic-->MsiExec.exe /I{AAE21ECF-17ED-4374-A066-89B3ECF42734}
RealSpeak_Solo_Spanish_for_Panasonic-->MsiExec.exe /I{50CB5066-3109-4FC5-B491-C1B82671B909}
Realtek High Definition Audio Driver-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x416 -removeonly
Replay AV 8-->C:\WINDOWS\iun6002.exe "C:\Arquivos de Programas\Replay AV 8\uninstallRAV8.ini"
Restaurant Empire-->C:\PROGRA~1\Enlight\RESTAU~1\UNWISE.EXE C:\PROGRA~1\Enlight\RESTAU~1\INSTALL.LOG
RivaTuner v2.06-->"C:\Arquivos de programas\RivaTuner v2.06\uninstall.exe"
SAPI5_Common-->MsiExec.exe /I{50B631C6-6E91-4D7B-A4E0-81E7FA8D5B3D}
SAPI5_English-->MsiExec.exe /I{4922C9E7-CD91-496A-A73B-0FDF9D54B44F}
SDP Downloader-->MsiExec.exe /I{B547CB8D-549A-436E-97B5-E79F911B11E2}
Silent Hunter 4 Wolves of the Pacific-->C:\Arquivos de programas\InstallShield Installation Information\{0D005F09-A5F4-473B-A901-5735C6AF5628}\setup.exe -runfromtemp -l0x0009 -removeonly
Silent Hunter III-->C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\8\Intel 32\IDriver.exe /M{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}
SimCity 4 Rush Hour-->C:\Program Files\Maxis\SimCity 4\EAUninstall.exe
SpaceShuttleMission2007 PATCH v1.37-->"C:\Program Files\SpaceShuttleMission2007\unins000.exe"
Spybot - Search & Destroy-->"C:\Arquivos de programas\Spybot - Search & Destroy\unins000.exe"
Star Trek Bridge Commander-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Activision\Bridge Commander\stbc.isu"
Stardock Central-->C:\ARQUIV~1\Stardock\SDCENT~1\UNWISE.EXE C:\ARQUIV~1\Stardock\SDCENT~1\INSTALL.LOG
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Supreme Commander-->C:\Arquivos de programas\InstallShield Installation Information\{25A1E6A4-2DBD-4AC0-8650-8EA9A45B183D}\setup.exe -runfromtemp -l0x0009 -removeonly
theRestaurant v1.9.1-->MsiExec.exe /I{93609D4E-7FF3-42D8-A6F1-BBABE9CB1FFC}
Translation_iTrans_for_Panasonic-->MsiExec.exe /I{C0DA8486-6C3A-4A38-AAC3-543A31F9F889}
UFO Extraterrestrials-->"C:\WINDOWS\UFO Extraterrestrials\uninstall.exe" "/U:C:\Program Files\Tri Synergy\UFO Extraterrestrials\Uninstall\uninstall.xml"
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
VideoLAN VLC media player 0.8.6c-->C:\Arquivos de programas\VideoLAN\VLC\uninstall.exe
Virtual E6-B 1.4-->C:\WINDOWS\st6unst.exe -n "C:\Arquivos de programas\Virtual E6-B\ST6UNST.LOG"
Virtual Earth 3D (Beta)-->MsiExec.exe /I{619B8475-0F48-41B7-A370-5147F7092989}
Voice Editing-->RunDll32 C:\ARQUIV~1\ARQUIV~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Arquivos de programas\InstallShield Installation Information\{44CE6902-84EA-11D6-887E-00609721D519}\setup.exe"
Vsk5Online-->"C:\Program Files\Vsk5Online\unins000.exe"
WebIQ Technology Engine-->C:\WINDOWS\system32\WebIQEngineSetup.exe u
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{37FD253D-5064-4034-8CEC-CC3995F823A4}
Windows Media Format 11 runtime-->"C:\Arquivos de programas\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Arquivos de programas\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (PTB)-->MsiExec.exe /X{93676FC6-C7DB-45A6-A62B-74A324F17313}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Search 4.0-->"C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinPatrol 2009-->C:\ARQUIV~1\BILLPS~1\WINPAT~1\Setup.exe /remove /q0
WinRAR archiver-->C:\Arquivos de programas\WinRAR\uninstall.exe
WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
WolfQuest-->MsiExec.exe /X{DD8F704E-B850-4775-9DFD-D3DE1775132B}
World of Subways Vol.1-->C:\Arquivos de programas\InstallShield Installation Information\{891570B1-75CB-4281-8A00-742274F44973}\setup.exe -runfromtemp -l0x0009 -removeonly
Wrecked Trial-->C:\Program Files\MDickie\Wrecked Trial\Uninstal.exe
Wrestling MPire 2008 (Career Edition) Trial-->C:\Program Files\MDickie\Wrestling MPire 2008 (Career Edition)\Uninstal.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

=====HijackThis Backups=====

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') [2009-05-25]
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') [2009-05-25]
O4 - Global Startup: Windows Search.lnk = C:\Arquivos de programas\Windows Desktop Search\WindowsSearch.exe [2009-05-25]

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 090522-0]

======System event log======

Computer Name: QUAD-XGAMER
Event Code: 4226
Message: TCP/IP alcançou o limite de segurança imposto sobre o número de tentativas de conexão TCP simultâneas.

Record Number: 29622
Source Name: Tcpip
Time Written: 20090330182718.000000-180
Event Type: aviso
User:

Computer Name: QUAD-XGAMER
Event Code: 4226
Message: TCP/IP alcançou o limite de segurança imposto sobre o número de tentativas de conexão TCP simultâneas.

Record Number: 29621
Source Name: Tcpip
Time Written: 20090330163844.000000-180
Event Type: aviso
User:

Computer Name: QUAD-XGAMER
Event Code: 4201
Message: O sistema detectou que o adaptador de rede \DEVICE\TCPIP_{1F90AFB7-AA13-420D-BEB4-95DB6C5FE87B} foi conectado à rede
e iniciou uma operação normal no adaptador de rede.

Record Number: 29620
Source Name: Tcpip
Time Written: 20090330162837.000000-180
Event Type: Informações
User:

Computer Name: QUAD-XGAMER
Event Code: 8033
Message: O localizador forçou uma eleição na rede \Device\NetBT_Tcpip_{1F90AFB7-AA13-420D-BEB4-95DB6C5FE87B} porque um localizador mestre tinha sido finalizado.

Record Number: 29619
Source Name: BROWSER
Time Written: 20090330144743.000000-180
Event Type: Informações
User:

Computer Name: QUAD-XGAMER
Event Code: 7035
Message: O serviço RivaTuner32 recebeu com êxito um controle Iniciar.

Record Number: 29618
Source Name: Service Control Manager
Time Written: 20090330144705.000000-180
Event Type: Informações
User: QUAD-XGAMER\Xgamer

=====Application event log=====

Computer Name: QUAD-XGAMER
Event Code: 1041
Message: O Windows não pode consultar a entrada de Registro DllName para {7B849a69-220F-451E-B3FE-2CB811AF94AE}, e ela não será carregada. Isso provavelmente foi causado por um registro incorreto.

Record Number: 9128
Source Name: Userenv
Time Written: 20090319211938.000000-180
Event Type: Erro
User: AUTORIDADE NT\SYSTEM

Computer Name: QUAD-XGAMER
Event Code: 1041
Message: O Windows não pode consultar a entrada de Registro DllName para {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, e ela não será carregada. Isso provavelmente foi causado por um registro incorreto.

Record Number: 9127
Source Name: Userenv
Time Written: 20090319194838.000000-180
Event Type: Erro
User: AUTORIDADE NT\SYSTEM

Computer Name: QUAD-XGAMER
Event Code: 1041
Message: O Windows não pode consultar a entrada de Registro DllName para {7B849a69-220F-451E-B3FE-2CB811AF94AE}, e ela não será carregada. Isso provavelmente foi causado por um registro incorreto.

Record Number: 9126
Source Name: Userenv
Time Written: 20090319194838.000000-180
Event Type: Erro
User: AUTORIDADE NT\SYSTEM

Computer Name: QUAD-XGAMER
Event Code: 1041
Message: O Windows não pode consultar a entrada de Registro DllName para {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, e ela não será carregada. Isso provavelmente foi causado por um registro incorreto.

Record Number: 9125
Source Name: Userenv
Time Written: 20090319193338.000000-180
Event Type: Erro
User: AUTORIDADE NT\SYSTEM

Computer Name: QUAD-XGAMER
Event Code: 1041
Message: O Windows não pode consultar a entrada de Registro DllName para {7B849a69-220F-451E-B3FE-2CB811AF94AE}, e ela não será carregada. Isso provavelmente foi causado por um registro incorreto.

Record Number: 9124
Source Name: Userenv
Time Written: 20090319193338.000000-180
Event Type: Erro
User: AUTORIDADE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0f07
"NUMBER_OF_PROCESSORS"=4
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

katana · May 26, 2009

There is nothing to explain the slower startup ?

Let's just try this for the USB problem

Warning. Please note that this fix is specific for this poster and should not be used by anyone else:

1. Before we make changes to your registry, we need to make a back up of the key that we are going to work on:

To back up the key please do the following

Copy the contents of the Code Box below to Notepad.
Name the file export.bat
Change the "Save as Type" to All Files
and Save it on the desktop

Code:

regedit /e C:\export-USB1.reg "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer"
regedit /e C:\export-USB2.reg "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer"

Double-click the export.bat file
The backup file will be placed in your C:\ directory as export-run.reg .

If there is a fatal error you can simply double click on the export-run.reg you just created to restore the registry to the state it was in before you began.
Warning. Do not click it except if I tell you to do so. Double clicking it will reintroduce the maleware to your computer and can have other unexpected effects.

2. Please do this:

Copy the contents of the Code Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
and Save it on the desktop

Code:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000
"NoDriveAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000000

Make sure there are NO blank lines before REGEDIT4

Then double-click on the fix.reg file, and when it prompts to merge say yes.

Try your USB drives now.

Wardo · May 29, 2009

Done as instructed, still having the same issue.

katana · May 29, 2009

Please open this page
http://support.microsoft.com/kb/925196

scroll down to the FixIt icon and follow the instructions there.

Let me know if this helps.

Wardo · Jun 3, 2009

When I attempt to delete those entries I get an error message saying that it's not possible to delete them, there was an error in the process, and they remain where they are, just as before.

katana · Jun 3, 2009

Did you use the "FixIt" tool, or did you try to delete them manually ?

Wardo · Jun 10, 2009

I tried using the Fixit tool.

katana · Jun 10, 2009

Unfortunately you are now outside my area of knowledge, so I'm going to have to recommend that you visit one of the tech forums for assistance.

http://www.techsupportforum.com/
http://www.bleepingcomputer.com/forums/
http://forums.whatthetech.com/forums.html

All the forums above have good support for software/OS problems, and I'm sure they will be able to help.

----------------------------------------------------------- -----------------------------------------------------------

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Please delete RSIT.exe and C:\RSIT (entire folder)
You can also delete any logs we have produced, and empty your Recycle bin.

Uninstall Combofix

This will clear your System Volume Information restore points and remove all the infected files that were quarantined
Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.

----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean.

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy <<< A must have program
- It includes host protection and registry protection
- A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware <<< A New and effective program
a-squared Free <<< A good "realtime" or "on demand" scanner
superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol
- An excellent startup manager and then some !!
- Notifies you if programs are added to startup
- Allows delayed startup
- A must have addition
SpywareBlaster 4.0
- SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2
- SpywareGuard provides real-time protection against spyware.
- Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut
- Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS
- This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
- For information on how to download and install, please read this tutorial by WinHelp2002.
- Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
    - Change the Download signed ActiveX controls to Prompt
    - Change the Download unsigned ActiveX controls to Disable
    - Change the Initialise and script ActiveX controls not marked as safe to Disable
    - Change the Installation of desktop items to Prompt
    - Change the Launching programs and files in an IFRAME to Prompt
    - Change the Navigate sub-frames across different domains to Prompt
    - When all these settings have been made, click on the OK button.
    - If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
- FireFox
  - With many addons available that make customization easy this is a very popular choice
  - NoScript and AdBlockPlus addons are essential
- Opera
  - Another popular alternative
- Netscape
  - Another popular alternative
  - Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner
- Free and very simple to use
CCleaner
- Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

Wardo · Jun 17, 2009

Uninstalled Combofix as requested.

Yup, everything is ok, so you can archive this.

Thank you very much for your assistance. I'd never be able to clean this PC without your help.

About the USB and start-up problem, perhaps it can be fixed, I'll look for help and see what I can do.

Sorry for the slow reply, I've been extremely busy.

Win32.Delf.uv and Hupigon13 return on reboot

New member

Security Expert-Emeritus

New member

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member