Tech Support Forum - View Single Post - Crash/Slow system

kornflakes · 06-20-2008, 06:33 PM

ComboFix log:

ComboFix 08-06-20.1 - Gabriel 2008-06-20 21:02:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.251 [GMT -3:00]
Executando de: C:\Documents and Settings\Gabriel\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Gabriel\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-PTB.exe
* Criado um novo ponto de restauro
.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM2bc421cf.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\fttutlwa.ini
C:\WINDOWS\system32\gbvnntsy.dll
C:\WINDOWS\system32\hgGaaApp.dll
C:\WINDOWS\system32\keboimvk.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\myukdjpy.ini
C:\WINDOWS\system32\ppAaaGgh.ini
C:\WINDOWS\system32\ppAaaGgh.ini2
C:\WINDOWS\system32\rqRJYpqq.dll
C:\WINDOWS\system32\xcfqecei.ini
C:\WINDOWS\system32\ystnnvbg.ini

.
((((((((((((((((((((((( Ficheiros criados de 2008-05-21 to 2008-06-21 ))))))))))))))))))))))))))))))))
.

2008-06-20 21:09 . 2008-06-20 21:09 110,419 --a------ C:\WINDOWS\BM2bc421cf.xml
2008-06-20 19:00 . 2008-06-20 19:00 79,872 --a------ C:\WINDOWS\system32\ypjdkuym.dll
2008-06-20 18:59 . 2008-06-20 18:59 99,328 --a------ C:\WINDOWS\system32\rkubljsv.dll
2008-06-20 18:59 . 2008-06-20 18:59 90,624 --a------ C:\WINDOWS\system32\njgodlks.dll
2008-06-17 21:40 . 2008-06-17 21:40 <DIR> d-------- C:\Deckard
2008-06-16 21:16 . 2008-06-16 21:17 <DIR> d-------- C:\Arquivos de programas\Panda Security
2008-05-28 14:31 . 2008-06-14 21:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-28 14:31 . 2008-05-28 14:31 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-26 22:06 . 2008-05-26 22:06 <DIR> d-------- C:\Arquivos de programas\Alcohol Soft

.
((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-21 00:20 9,864,992 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-21 00:07 137,300 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-20 06:23 2,857,984 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-06-20 06:23 1,784,832 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-06-17 23:48 --------- d-----w C:\Arquivos de programas\VisualSubSync
2008-06-17 23:45 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information
2008-06-17 23:42 --------- d-----w C:\Arquivos de programas\Arquivos comuns\element5 Shared
2008-06-17 22:01 1,993,263 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-06-16 22:54 1,656,832 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-06-16 22:54 1,113,600 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-06-16 15:35 2,981,376 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-06-16 15:35 1,634,304 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-06-14 18:28 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2008-06-08 02:06 --------- d--h--w C:\Arquivos de programas\Zero G Registry
2008-06-08 02:05 --------- d-----w C:\Arquivos de programas\Macromedia
2008-06-08 02:04 --------- d-----w C:\Arquivos de programas\CyberLink
2008-06-08 02:03 --------- d-----w C:\Arquivos de programas\Corel
2008-06-07 15:43 2,915,840 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-06-07 15:22 --------- d-----w C:\Arquivos de programas\Backup Reg EasyCleaner
2008-06-07 15:17 --------- d-----w C:\Arquivos de programas\Soldat
2008-06-07 15:17 --------- d-----w C:\Arquivos de programas\Real Alternative
2008-06-07 15:17 --------- d-----w C:\Arquivos de programas\DAP
2008-05-31 09:40 --------- d-----w C:\Arquivos de programas\BitComet
2008-05-27 00:56 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-13 01:58 --------- d-----w C:\Arquivos de programas\Winamp
2008-05-11 18:56 --------- d-----w C:\Documents and Settings\Gabriel\Dados de aplicativos\AdobeUM
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,292,288 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-05 12:56 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Blizzard Entertainment
2008-04-28 21:17 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\MailFrontier
2008-04-28 15:04 --------- d-----w C:\Arquivos de programas\DAEMON Tools
2008-04-28 05:17 --------- d-----w C:\Documents and Settings\Gabriel\Dados de aplicativos\MailFrontier
2008-04-28 05:15 --------- d-----w C:\Arquivos de programas\Eset
2008-04-28 05:10 --------- d-----w C:\Arquivos de programas\Zone Labs
2008-04-25 20:13 --------- d-----w C:\Documents and Settings\Gabriel\Dados de aplicativos\Hamachi
2008-04-21 20:28 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-04-21 07:02 661,504 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-25 04:49 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:49 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll
2006-08-26 03:15 1,514 -c--a-w C:\Documents and Settings\Gabriel\Dados de aplicativos\WWB7_32.DAT
2007-05-11 00:40 848 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6552f18-9ef9-4bc9-9cee-eb4c51c18b1d}]
2008-06-20 18:59 99328 --a------ C:\WINDOWS\system32\rkubljsv.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22 7618560]
"nwiz"="nwiz.exe" [2006-06-01 17:22 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 17:22 86016]
"ASUS Probe"="c:\arquivos de programas\ASUS\Probe\AsusProb.exe" [2002-12-06 15:07 617984]
"ZoneAlarm Client"="C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016]
"WinampAgent"="C:\Arquivos de programas\Winamp\winampa.exe" [2008-04-01 15:49 36352]
"28f71253"="C:\WINDOWS\system32\ypjdkuym.dll" [2008-06-20 19:00 79872]
"BM2bc421cf"="C:\WINDOWS\system32\njgodlks.dll" [2008-06-20 18:59 90624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:45 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MFZ0"= MyFlashZip0.ax

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^winsys2.exe]
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\winsys2.exe
backup=C:\WINDOWS\pss\winsys2.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Gabriel^Menu Iniciar^Programas^Inicializar^Adobe Gamma.lnk]
path=C:\Documents and Settings\Gabriel\Menu Iniciar\Programas\Inicializar\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Gabriel^Menu Iniciar^Programas^Inicializar^PowerReg Scheduler.exe]
path=C:\Documents and Settings\Gabriel\Menu Iniciar\Programas\Inicializar\PowerReg Scheduler.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\28f71253]
C:\WINDOWS\system32\gbvnntsy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-12-22 04:23 221568 C:\Arquivos de programas\Alcohol Soft\Alcohol 120\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM2bc421cf]
C:\WINDOWS\system32\fefccwwn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
C:\Arquivos de programas\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 00:45 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2006-11-12 07:48 157592 C:\Arquivos de programas\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a--c--- 2004-04-17 12:41 196608 c:\ARQUIV~1\ARQUIV~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a--c--- 2004-04-13 06:07 69632 C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Arquivos de programas\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 13:24 1694208 C:\Arquivos de programas\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-06-01 17:22 7618560 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-06-01 17:22 86016 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2006-03-15 20:07 421888 C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 2006-05-05 22:55 155648 C:\Arquivos de programas\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
C:\Arquivos de programas\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
--a--c--- 2003-05-30 09:42 585728 C:\Arquivos de programas\Analog Devices\SoundMAX\smax4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a--c--- 2003-05-29 16:28 790528 C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-04-09 14:31 1271032 D:\jogos\steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-11-10 13:03 36975 C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra--c--- 2006-03-30 16:45 313472 C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3 (0x3)
"mi-raysat_3dsmax8"=2 (0x2)
"CAISafe"=3 (0x3)
"Adobe LM Service"=3 (0x3)
"SoundMAX Agent Service (default)"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=
"C:\\Arquivos de programas\\Autodesk\\backburner\\monitor.exe"=
"C:\\Arquivos de programas\\Autodesk\\backburner\\manager.exe"=
"C:\\Arquivos de programas\\Autodesk\\backburner\\server.exe"=
"D:\\jogos\\The All-Seeing Eye\\eye.exe"=
"D:\\3dsmax7\\3dsmax.exe"=
"C:\\Arquivos de programas\\backburner 2\\monitor.exe"=
"C:\\Arquivos de programas\\backburner 2\\manager.exe"=
"C:\\Arquivos de programas\\backburner 2\\server.exe"=
"C:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"D:\\jogos\\Soldat\\Soldat.exe"=
"C:\\Arquivos de programas\\DAP\\DAP.exe"=
"D:\\jogos\\steam\\steamapps\\mazzo_igor\\counter-strike\\hl.exe"=
"D:\\Downloads\\wow\\WoW-2.0.0-enUS-Installer-downloader.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22320:TCP"= 22320:TCP:BitComet 22320 TCP
"22320:UDP"= 22320:UDP:BitComet 22320 UDP
"64666:TCP"= 64666:TCP:BitComet 64666 TCP
"64666:UDP"= 64666:UDP:BitComet 64666 UDP
"64591:TCP"= 64591:TCP:BitComet 64591 TCP
"64591:UDP"= 64591:UDP:BitComet 64591 UDP
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

S3 npkycryp;npkycryp;D:\jogos\ro\DevRO\npkycryp.sys []
S3 XDva014;XDva014;C:\WINDOWS\system32\XDva014.sys []
S3 XDva112;XDva112;C:\WINDOWS\system32\XDva112.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f32b014-83db-11dc-8fb0-0013d4afa7b9}]
\Shell\AutoRun\command - H:\NTsys.exe
\Shell\explore\Command - H:\NTsys.exe
\Shell\open\Command - H:\NTsys.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-20 21:08:55
Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso
Ficheiros ocultos: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\ypjdkuym.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Tempo para conclusÆo: 2008-06-20 21:27:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-21 00:27:15

Pre-Run: 5,356,830,720 bytes disponíveis
Post-Run: 5,254,467,584 bytes dispon¡veis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTB.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

245 --- E O F --- 2008-06-12 14:00:20

hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:30:43, on 20/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe
C:\Arquivos de programas\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\ARQUIV~1\MOZILL~1\FIREFOX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Arquivos de programas\DAP\DAPBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {d1b81c15-c4be-eec9-9cb4-9fe981f2556c} - {c6552f18-9ef9-4bc9-9cee-eb4c51c18b1d} - C:\WINDOWS\system32\rkubljsv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUS Probe] c:\arquivos de programas\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"
O4 - HKLM\..\Run: [28f71253] rundll32.exe "C:\WINDOWS\system32\ypjdkuym.dll",b
O4 - HKLM\..\Run: [BM2bc421cf] Rundll32.exe "C:\WINDOWS\system32\njgodlks.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download with &DAP - C:\ARQUIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARQUIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARQUIV~1\DAP\DAP.EXE
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {0FF588E0-0913-4CBC-BEC6-422A2D96B7FB} (AuditionWebCtrl Class) - http://www.audition.com.br/activex/AuditionWeb.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/.../GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1145935759890
O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://cabalonline.net/Com/CabalWebLauncher.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/contr...terActiveX.cab
O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Arquivos de programas\Extensis\Extensis Suitcase 11\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6435 bytes

06-20-2008, 06:33 PM	#6 (permalink)
kornflakes Registered User Join Date: Jun 2008 Posts: 9 OS: winXP	Re: Crash/Slow system - Trojan.Win32.Monder.gen ComboFix log: ComboFix 08-06-20.1 - Gabriel 2008-06-20 21:02:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.251 [GMT -3:00] Executando de: C:\Documents and Settings\Gabriel\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Gabriel\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-PTB.exe * Criado um novo ponto de restauro . ((((((((((((((((((((((((((((((((((((( Outras Exclusäes ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BM2bc421cf.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\fttutlwa.ini C:\WINDOWS\system32\gbvnntsy.dll C:\WINDOWS\system32\hgGaaApp.dll C:\WINDOWS\system32\keboimvk.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\myukdjpy.ini C:\WINDOWS\system32\ppAaaGgh.ini C:\WINDOWS\system32\ppAaaGgh.ini2 C:\WINDOWS\system32\rqRJYpqq.dll C:\WINDOWS\system32\xcfqecei.ini C:\WINDOWS\system32\ystnnvbg.ini . ((((((((((((((((((((((( Ficheiros criados de 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))) . 2008-06-20 21:09 . 2008-06-20 21:09 110,419 --a------ C:\WINDOWS\BM2bc421cf.xml 2008-06-20 19:00 . 2008-06-20 19:00 79,872 --a------ C:\WINDOWS\system32\ypjdkuym.dll 2008-06-20 18:59 . 2008-06-20 18:59 99,328 --a------ C:\WINDOWS\system32\rkubljsv.dll 2008-06-20 18:59 . 2008-06-20 18:59 90,624 --a------ C:\WINDOWS\system32\njgodlks.dll 2008-06-17 21:40 . 2008-06-17 21:40 <DIR> d-------- C:\Deckard 2008-06-16 21:16 . 2008-06-16 21:17 <DIR> d-------- C:\Arquivos de programas\Panda Security 2008-05-28 14:31 . 2008-06-14 21:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-28 14:31 . 2008-05-28 14:31 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-26 22:06 . 2008-05-26 22:06 <DIR> d-------- C:\Arquivos de programas\Alcohol Soft . ((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-21 00:20 9,864,992 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-21 00:07 137,300 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-20 06:23 2,857,984 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp 2008-06-20 06:23 1,784,832 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp 2008-06-17 23:48 --------- d-----w C:\Arquivos de programas\VisualSubSync 2008-06-17 23:45 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information 2008-06-17 23:42 --------- d-----w C:\Arquivos de programas\Arquivos comuns\element5 Shared 2008-06-17 22:01 1,993,263 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2008-06-16 22:54 1,656,832 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp 2008-06-16 22:54 1,113,600 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp 2008-06-16 15:35 2,981,376 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2008-06-16 15:35 1,634,304 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2008-06-14 18:28 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll 2008-06-08 02:06 --------- d--h--w C:\Arquivos de programas\Zero G Registry 2008-06-08 02:05 --------- d-----w C:\Arquivos de programas\Macromedia 2008-06-08 02:04 --------- d-----w C:\Arquivos de programas\CyberLink 2008-06-08 02:03 --------- d-----w C:\Arquivos de programas\Corel 2008-06-07 15:43 2,915,840 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2008-06-07 15:22 --------- d-----w C:\Arquivos de programas\Backup Reg EasyCleaner 2008-06-07 15:17 --------- d-----w C:\Arquivos de programas\Soldat 2008-06-07 15:17 --------- d-----w C:\Arquivos de programas\Real Alternative 2008-06-07 15:17 --------- d-----w C:\Arquivos de programas\DAP 2008-05-31 09:40 --------- d-----w C:\Arquivos de programas\BitComet 2008-05-27 00:56 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-05-13 01:58 --------- d-----w C:\Arquivos de programas\Winamp 2008-05-11 18:56 --------- d-----w C:\Documents and Settings\Gabriel\Dados de aplicativos\AdobeUM 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:15 1,292,288 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-05 12:56 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Blizzard Entertainment 2008-04-28 21:17 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\MailFrontier 2008-04-28 15:04 --------- d-----w C:\Arquivos de programas\DAEMON Tools 2008-04-28 05:17 --------- d-----w C:\Documents and Settings\Gabriel\Dados de aplicativos\MailFrontier 2008-04-28 05:15 --------- d-----w C:\Arquivos de programas\Eset 2008-04-28 05:10 --------- d-----w C:\Arquivos de programas\Zone Labs 2008-04-25 20:13 --------- d-----w C:\Documents and Settings\Gabriel\Dados de aplicativos\Hamachi 2008-04-21 20:28 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2008-04-21 07:02 661,504 ----a-w C:\WINDOWS\system32\wininet.dll 2008-03-25 04:49 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:49 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll 2006-08-26 03:15 1,514 -c--a-w C:\Documents and Settings\Gabriel\Dados de aplicativos\WWB7_32.DAT 2007-05-11 00:40 848 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 Nota entradas vazias & leg¡timas por defeito nÆo sÆo mostradas. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c6552f18-9ef9-4bc9-9cee-eb4c51c18b1d}] 2008-06-20 18:59 99328 --a------ C:\WINDOWS\system32\rkubljsv.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22 7618560] "nwiz"="nwiz.exe" [2006-06-01 17:22 1519616 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 17:22 86016] "ASUS Probe"="c:\arquivos de programas\ASUS\Probe\AsusProb.exe" [2002-12-06 15:07 617984] "ZoneAlarm Client"="C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016] "WinampAgent"="C:\Arquivos de programas\Winamp\winampa.exe" [2008-04-01 15:49 36352] "28f71253"="C:\WINDOWS\system32\ypjdkuym.dll" [2008-06-20 19:00 79872] "BM2bc421cf"="C:\WINDOWS\system32\njgodlks.dll" [2008-06-20 18:59 90624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:45 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MFZ0"= MyFlashZip0.ax [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^winsys2.exe] path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\winsys2.exe backup=C:\WINDOWS\pss\winsys2.exeCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Gabriel^Menu Iniciar^Programas^Inicializar^Adobe Gamma.lnk] path=C:\Documents and Settings\Gabriel\Menu Iniciar\Programas\Inicializar\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Gabriel^Menu Iniciar^Programas^Inicializar^PowerReg Scheduler.exe] path=C:\Documents and Settings\Gabriel\Menu Iniciar\Programas\Inicializar\PowerReg Scheduler.exe backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\28f71253] C:\WINDOWS\system32\gbvnntsy.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] --a------ 2007-12-22 04:23 221568 C:\Arquivos de programas\Alcohol Soft\Alcohol 120\axcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM2bc421cf] C:\WINDOWS\system32\fefccwwn.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] C:\Arquivos de programas\SlySoft\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 00:45 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2006-11-12 07:48 157592 C:\Arquivos de programas\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a--c--- 2004-04-17 12:41 196608 c:\ARQUIV~1\ARQUIV~1\INSTAL~1\UPDATE~1\isuspm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a--c--- 2004-04-13 06:07 69632 C:\Arquivos de programas\Arquivos comuns\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Arquivos de programas\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 13:24 1694208 C:\Arquivos de programas\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2006-06-01 17:22 7618560 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2006-06-01 17:22 86016 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2006-03-15 20:07 421888 C:\Arquivos de programas\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a--c--- 2006-05-05 22:55 155648 C:\Arquivos de programas\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] C:\Arquivos de programas\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a--c--- 2003-05-30 09:42 585728 C:\Arquivos de programas\Analog Devices\SoundMAX\smax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a--c--- 2003-05-29 16:28 790528 C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-04-09 14:31 1271032 D:\jogos\steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2005-11-10 13:03 36975 C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra--c--- 2006-03-30 16:45 313472 C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "mnmsrvc"=3 (0x3) "mi-raysat_3dsmax8"=2 (0x2) "CAISafe"=3 (0x3) "Adobe LM Service"=3 (0x3) "SoundMAX Agent Service (default)"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Arquivos de programas\\Messenger\\msmsgs.exe"= "C:\\Arquivos de programas\\Autodesk\\backburner\\monitor.exe"= "C:\\Arquivos de programas\\Autodesk\\backburner\\manager.exe"= "C:\\Arquivos de programas\\Autodesk\\backburner\\server.exe"= "D:\\jogos\\The All-Seeing Eye\\eye.exe"= "D:\\3dsmax7\\3dsmax.exe"= "C:\\Arquivos de programas\\backburner 2\\monitor.exe"= "C:\\Arquivos de programas\\backburner 2\\manager.exe"= "C:\\Arquivos de programas\\backburner 2\\server.exe"= "C:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "D:\\jogos\\Soldat\\Soldat.exe"= "C:\\Arquivos de programas\\DAP\\DAP.exe"= "D:\\jogos\\steam\\steamapps\\mazzo_igor\\counter-strike\\hl.exe"= "D:\\Downloads\\wow\\WoW-2.0.0-enUS-Installer-downloader.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "22320:TCP"= 22320:TCP:BitComet 22320 TCP "22320:UDP"= 22320:UDP:BitComet 22320 UDP "64666:TCP"= 64666:TCP:BitComet 64666 TCP "64666:UDP"= 64666:UDP:BitComet 64666 UDP "64591:TCP"= 64591:TCP:BitComet 64591 TCP "64591:UDP"= 64591:UDP:BitComet 64591 UDP "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 S3 npkycryp;npkycryp;D:\jogos\ro\DevRO\npkycryp.sys [] S3 XDva014;XDva014;C:\WINDOWS\system32\XDva014.sys [] S3 XDva112;XDva112;C:\WINDOWS\system32\XDva112.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f32b014-83db-11dc-8fb0-0013d4afa7b9}] \Shell\AutoRun\command - H:\NTsys.exe \Shell\explore\Command - H:\NTsys.exe \Shell\open\Command - H:\NTsys.exe . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-20 21:08:55 Windows 5.1.2600 Service Pack 2 NTFS Procurando processos ocultos ... Procurando entradas auto inicializ veis ocultas ... Procurando ficheiros ocultos ... Varredura completada com sucesso Ficheiros ocultos: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\ypjdkuym.dll . ------------------------ Other Running Processes ------------------------ . C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvsvc32.exe C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************ . Tempo para conclusÆo: 2008-06-20 21:27:19 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-21 00:27:15 Pre-Run: 5,356,830,720 bytes disponíveis Post-Run: 5,254,467,584 bytes dispon¡veis WindowsXP-KB310994-SP2-Pro-BootDisk-PTB.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 245 --- E O F --- 2008-06-12 14:00:20 hijackthis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:30:43, on 20/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe C:\Arquivos de programas\Winamp\winampa.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe C:\ARQUIV~1\MOZILL~1\FIREFOX.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Arquivos de programas\DAP\DAPBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: {d1b81c15-c4be-eec9-9cb4-9fe981f2556c} - {c6552f18-9ef9-4bc9-9cee-eb4c51c18b1d} - C:\WINDOWS\system32\rkubljsv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ASUS Probe] c:\arquivos de programas\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe" O4 - HKLM\..\Run: [28f71253] rundll32.exe "C:\WINDOWS\system32\ypjdkuym.dll",b O4 - HKLM\..\Run: [BM2bc421cf] Rundll32.exe "C:\WINDOWS\system32\njgodlks.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Download with &DAP - C:\ARQUIV~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\ARQUIV~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARQUIV~1\DAP\DAP.EXE O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {0FF588E0-0913-4CBC-BEC6-422A2D96B7FB} (AuditionWebCtrl Class) - http://www.audition.com.br/activex/AuditionWeb.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/.../GAME_UNO1.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1145935759890 O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://cabalonline.net/Com/CabalWebLauncher.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CEA3052D-65B9-44E2-A501-5E14024BC66F} (TricksterActiveX Control) - http://www.tricksteronline.com/contr...terActiveX.cab O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} - http://www.gamengame.com/KALogoutComponent.cab O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Bonjour Service - Unknown owner - C:\Arquivos de programas\Extensis\Extensis Suitcase 11\Bonjour\mDNSResponder.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 6435 bytes