Trying again...
Tks
ComboFix 08-11-09.01 - Butterfly 2008-11-09 16:05:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1033.18.1403 [GMT -5:00]
Executando de: c:\documents and settings\Butterfly\Desktop\ComboFix.exe
* Criado um novo ponto de restauro
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Butterfly\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\awtSljjK.dll
c:\windows\system32\bdjulmsk.ini
c:\windows\system32\bszip.dll
c:\windows\system32\dbyhlk.dll
c:\windows\system32\ddcccaYs.dll
c:\windows\system32\dfdopceg.dll
c:\windows\system32\geBuUkiI.dll
c:\windows\system32\gyjdxp.dll
c:\windows\system32\IhPppXyb.ini
c:\windows\system32\IhPppXyb.ini2
c:\windows\system32\imqrcf.dll
c:\windows\system32\khfGyxuU.dll
c:\windows\system32\KjjlStwa.ini
c:\windows\system32\KjjlStwa.ini2
c:\windows\system32\ksmlujdb.dll
c:\windows\system32\mlJaBUOe.dll
c:\windows\system32\MSINET.oca
c:\windows\system32\oltrlcte.dll
c:\windows\system32\tdqqejgq.dll
c:\windows\system32\x64
c:\windows\wiaserviv.log
.
(((((((((((((((( Arquivos/Ficheiros criados de 2008-10-09 to 2008-11-09 ))))))))))))))))))))))))))))
.
2008-11-09 14:59 . 2008-11-09 15:00 3,043,976 -ra------ c:\program files\ComboFix.exe
2008-11-09 12:29 . 2008-11-09 12:31 <DIR> d-------- C:\rsit
2008-11-09 11:17 . 2008-11-09 11:56 250 --a------ c:\windows\gmer.ini
2008-11-09 09:57 . 2008-11-09 09:57 <DIR> d-------- c:\program files\gmer
2008-11-09 09:56 . 2008-11-09 09:57 747,873 --a------ c:\program files\gmer.zip
2008-11-09 09:48 . 2008-11-09 09:48 305,705 --a------ c:\program files\RSIT.exe
2008-11-09 09:21 . 2008-11-09 09:21 <DIR> d-------- c:\program files\Trend Micro
2008-11-08 18:24 . 2008-11-08 18:24 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-08 18:22 . 2008-11-08 18:23 19,153,264 --a------ c:\program files\aaw2008.exe
2008-11-08 16:24 . 2008-11-09 11:06 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-08 16:24 . 2008-11-09 09:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-08 16:02 . 2008-11-08 16:19 7,478,208 --a------ c:\program files\windows-kb890830-v2.3.exe
2008-11-08 16:02 . 2008-11-08 16:50 1,892 --ahs---- c:\windows\system32\uEKnmnmp.ini
2008-11-08 11:36 . 2008-11-08 11:36 <DIR> d-------- c:\windows\system32\sX3i19
2008-11-08 11:36 . 2008-11-08 11:36 <DIR> d-------- c:\temp\PRE45
2008-11-08 11:05 . 2006-06-20 08:40 692,224 --a------ c:\windows\system32\lxctdrs.dll
2008-11-08 11:05 . 2006-07-11 13:54 335,872 --a------ c:\windows\system32\lxctcoin.dll
2008-11-08 11:05 . 2006-05-18 06:01 65,536 --a------ c:\windows\system32\lxctcaps.dll
2008-11-08 11:05 . 2006-05-03 09:31 61,440 --a------ c:\windows\system32\lxctcnv4.dll
2008-11-08 11:05 . 2005-06-23 21:37 40,960 --a------ c:\windows\system32\lxctvs.dll
2008-11-08 11:04 . 2006-07-10 18:34 40,960 --a------ c:\windows\system32\lxctpmon.dll
2008-11-08 11:04 . 2006-07-10 18:34 32,768 --a------ c:\windows\system32\LXCTFXPU.DLL
2008-11-08 11:04 . 2006-07-10 18:36 12,288 --a------ c:\windows\system32\lxctpmrc.dll
2008-11-08 11:02 . 2008-11-08 11:05 <DIR> d-------- c:\program files\Lexmark 5400 Series
2008-11-08 08:00 . 2008-10-09 14:25 1,221,008 --a------ c:\windows\system32\zpeng25.dll
2008-11-08 07:50 . 2008-11-08 07:50 <DIR> d-------- c:\windows\system32\scripting
2008-11-08 07:50 . 2008-11-08 07:50 <DIR> d-------- c:\windows\system32\en
2008-11-08 07:50 . 2008-11-08 07:50 <DIR> d-------- c:\windows\system32\bits
2008-11-08 07:50 . 2008-11-08 07:50 <DIR> d-------- c:\windows\l2schemas
2008-11-08 07:48 . 2008-11-08 07:50 <DIR> d-------- c:\windows\ServicePackFiles
2008-11-02 14:03 . 2008-11-02 14:03 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-02 14:03 . 2008-11-02 14:03 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-10-27 17:55 . 2008-09-08 05:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-27 17:51 . 2008-08-14 05:11 2,189,184 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-27 17:51 . 2008-08-14 05:09 2,145,280 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-27 17:51 . 2008-08-14 04:33 2,066,048 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-27 17:51 . 2008-08-14 04:33 2,023,936 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-27 17:51 . 2008-09-15 07:12 1,846,400 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-27 17:46 . 2008-05-01 09:33 331,776 --------- c:\windows\system32\dllcache\msadce.dll
2008-10-27 17:45 . 2008-04-11 14:04 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll
2008-10-27 17:43 . 2008-10-15 11:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-22 20:16 . 2008-11-09 09:06 54,156 --ah----- c:\windows\QTFont.qfn
2008-10-22 20:16 . 2008-10-22 20:16 1,409 --a------ c:\windows\QTFont.for
2008-10-22 17:02 . 2008-10-22 17:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\RLUHVKKCYG
2008-10-19 17:49 . 2008-10-19 17:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\XRUHVKKCYG
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-09 21:14 166,157,856 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-09 21:10 --------- d-----w c:\program files\Lx_cats
2008-11-09 21:08 2,222,876 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-08 23:24 --------- d-----w c:\program files\Lavasoft
2008-11-08 22:56 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-08 16:03 --------- d-----w c:\program files\Lexmark Toolbar
2008-11-06 12:47 --------- d-----w c:\program files\BadgeHelp
2008-11-02 19:03 --------- d-----w c:\program files\Java
2008-10-30 12:07 --------- d-----w c:\program files\NetExchange Pro3.0
2008-10-20 03:11 387 ----a-w C:\Board.Dat
2008-10-09 19:25 73,104 ----a-w c:\windows\zllsputility.exe
2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-10-02 00:03 --------- d-----w c:\program files\activePDF
2008-09-27 16:11 --------- d-----w c:\program files\FinePixViewer
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-06 21:30 1,201,351 ----a-w c:\program files\hidemyip.exe
2008-08-30 05:53 151,552 ----a-w c:\windows\system32\securenet.dll
2008-08-27 08:24 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-08-14 10:09 2,145,280 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 10:04 138,496 ------w c:\windows\system32\dllcache\afd.sys
2008-08-14 09:33 2,023,936 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-07-10 23:48 27,579,280 ----a-w c:\program files\zaAvSetup_70_483_000_en.exe
2008-07-06 20:52 214,430 ----a-w c:\program files\handytweakers.zip
2008-05-29 00:22 5,452,082 ----a-w c:\program files\K-Meleon1.1.5en-US.exe
2008-04-18 22:53 210,416 ----a-w c:\program files\zaavSetup_en.exe
2008-02-13 02:57 2,869,264 ----a-w c:\program files\dotNetFx35setup.exe
2008-01-12 22:09 21,216,112 ----a-w c:\program files\aaw2007.exe
2007-05-11 19:31 6,006,832 ----a-w c:\program files\Firefox Setup 2.0.0.3.exe
2007-04-09 21:51 900,168 ----a-w c:\program files\pi19299.exe
2007-04-03 20:23 454,381 ----a-w c:\program files\pipe.rar
2007-03-28 21:26 5,696,136 ----a-w c:\program files\R143248.EXE
2007-03-10 00:39 16,918,488 ----a-w c:\program files\SystemMechanic7.exe
2007-04-01 19:07 88 --sha-r c:\windows\system32\
03C2D086F5.sys
2007-04-01 19:09 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"HideMyIP2008"="c:\program files\Hide My IP 2008\HideMyIP2008.exe" [2008-04-12 913408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"SMSystemAnalyzer"="c:\program files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2008-05-06 764776]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-21 185896]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904]
"lxctmon.exe"="c:\program files\Lexmark 5400 Series\lxctmon.exe" [2006-06-20 286720]
"Lexmark 5400 Series Fax Server"="c:\program files\Lexmark 5400 Series\fm3032.exe" [2006-07-10 294912]
"EzPrint"="c:\program files\Lexmark 5400 Series\ezprint.exe" [2006-06-06 98304]
"LXCTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-06-07 106496]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\Ad-Watch.exe" [2008-11-08 2468200]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 c:\windows\stsystra.exe]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-06-24 303104]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=dbyhlk.dll imqrcf.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2006-08-28 22:57 395776 c:\program files\Dell Support\DSAgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2005-11-01 04:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2006-06-06 22:05 98304 c:\program files\Lexmark 5400 Series\ezprint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-07-27 17:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-07-27 17:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 5400 Series Fax Server]
--a------ 2006-07-10 18:30 294912 c:\program files\Lexmark 5400 Series\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxctmon.exe]
--a------ 2006-06-20 08:37 286720 c:\program files\Lexmark 5400 Series\lxctmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2001-08-16 22:41 28738 c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
--------- 2003-09-10 03:24 20480 c:\program files\NetWaiting\netwaiting.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
--------- 2002-02-04 21:32 53248 c:\program files\REGSHAVE\REGSHAVE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\lxctcoms.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\system32\\sessmgr.exe"=
R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-05-02 566120]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-05-02 566120]
R3 SecureSrv;SecureSrv;c:\program files\Hide My IP 2008\SecureSrv.exe [2008-09-05 110880]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\DRIVERS\gan_adapter.sys [2006-09-27 10664]
S3 NAL;Nal Service ;c:\windows\system32\Drivers\iqvw32.sys [2006-06-05 24064]
S4 BCSWAP;BCSWAP;c:\windows\system32\drivers\BCSWAP.sys [2007-01-16 91496]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{296afdda-4e0a-11dd-88cc-001676baf5ec}]
\Shell\AutoRun\command - F:\autorun.exe
\Shell\phone\command - F:\autorun.exe
.
- - - - ORFÃOS REMOVIDOS - - - -
BHO-{B0B3393C-62D1-44D8-ABF5-08E0F067F29E} - c:\windows\system32\mlJaBUOe.dll
BHO-{E20DF4ED-4254-44D6-BDC1-4D4861DC83D3} - c:\windows\system32\awtSljjK.dll
HKCU-Run-cdloader - c:\documents and settings\Butterfly\Application Data\mjusbsp\cdloader2.exe
HKCU-Run-brastk - c:\windows\system32\brastk.exe
HKLM-Run-SiteAdvisor - c:\program files\SiteAdvisor\6172\SiteAdv.exe
HKLM-Run-14a3f3b1 - c:\windows\system32\ksmlujdb.dll
HKLM-Run-Logitech Hardware Abstraction Layer - KHALMNPR.EXE
ShellExecuteHooks-{B0B3393C-62D1-44D8-ABF5-08E0F067F29E} - c:\windows\system32\mlJaBUOe.dll
.
------- Scan Suplementar -------
.
FireFox -: Profile - c:\documents and settings\Butterfly\Application Data\Mozilla\Firefox\Profiles\n5ta2hek.default\
.
.
------- Associação de arquivos/ficheiros -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-11-09 16:11:49
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
PROCESSOS: c:\windows\system32\lsass.exe
-> c:\windows\system32\securenet.dll
.
------------------------ Outros Processos em Execução ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\ZoneLabs\avsys\ScanningProcess.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\ZoneLabs\avsys\ScanningProcess.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lxctcoms.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\SiteAdvisor\6261\SAService.exe
c:\windows\system32\UTSCSI.EXE
.
**************************************************************************
.
Tempo para conclusão: 2008-11-09 16:21:52 - Máquina reiniciou [Butterfly]
ComboFix-quarantined-files.txt 2008-11-09 21:20:44
Pré-execução: 287,602,909,184 bytes free
Pós execução: 287,504,506,880 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
267 --- E O F --- 2008-11-08 12:57:15