[Closed] Trojan-Clicker.Win32.Delf.cbe

ari5av Topic Starter

Post #1May 14, 2009, 5:25 PM UTC

Hi,

I've my laptop infected with the Trojan-Clicker.Win32.Delf.cbe and until now I followed several tips that appear in this forum and so far unable to resolve the problem.
Already used the "Malwarebytes' Anti-Malware" and "comboFix " and I have only this report but still with virus. Please, can someone help me?

Thanks,

ComboFix 09-05-13.04 - ccardoso 14-05-2009 17:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.351.2070.18.2046.1423 [GMT 1:00]
Executando de: c:\documents and settings\CCARDOSO\Ambiente de trabalho\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\CCARDOSO\Application Data\02000000cefd8f7e579C.manifest
c:\documents and settings\CCARDOSO\Application Data\02000000cefd8f7e579O.manifest
c:\documents and settings\CCARDOSO\Application Data\02000000cefd8f7e579P.manifest
c:\documents and settings\CCARDOSO\Application Data\02000000cefd8f7e579S.manifest
c:\documents and settings\CCARDOSO\Application Data\inst.exe
c:\windows\GnuHashes.ini
c:\windows\IE4 Error Log.txt
c:\windows\sv.ini
c:\windows\system32\GroupPolicy000.dat

.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-04-14 to 2009-05-14 ))))))))))))))))))))))))))))
.

2009-05-14 16:04 . 2009-05-14 16:04 ——– d—–w c:\windows\LastGood
2009-05-14 13:32 . 2009-05-14 13:32 ——– d—–w c:\documents and settings\CCARDOSO\Application Data\bdlrbaom
2009-05-14 12:15 . 2009-05-14 12:15 ——– d—–w c:\documents and settings\CCARDOSO\Application Data\Malwarebytes
2009-05-14 12:15 . 2009-04-06 14:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-14 12:15 . 2009-04-06 14:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-14 12:15 . 2009-05-14 12:15 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-14 12:15 . 2009-05-14 12:15 ——– d—–w c:\programas\Malwarebytes' Anti-Malware
2009-05-14 12:06 . 2009-05-14 12:06 664 —-a-w c:\windows\system32\d3d9caps.dat
2009-05-11 13:33 . 2009-05-11 13:33 ——– d—–w c:\documents and settings\NetworkService\Application Data\bdlrbaom
2009-05-07 09:38 . 2009-05-13 23:44 ——– d—–w c:\documents and settings\CCARDOSO\Application Data\PC Tools
2009-05-03 16:00 . 2009-05-03 16:09 ——– d—–w C:\Zyzoom_Kaspersky_Internet_Security_7.0.0.125
2009-05-02 23:43 . 2009-05-02 23:43 ——– d—–w c:\documents and settings\CCARDOSO\fontconfig
2009-05-02 23:42 . 2009-05-02 23:49 ——– d—–w c:\documents and settings\CCARDOSO\.smplayer
2009-05-02 23:41 . 2009-05-02 23:41 ——– d—–w c:\programas\SMPlayer
2009-04-22 17:18 . 2009-04-22 17:19 ——– d—–w C:\513457aa92192285afba
2009-04-21 18:35 . 2009-04-21 18:35 615 —-a-w c:\windows\system32\Tm5sFH0.vbs
2009-04-19 15:14 . 2009-04-19 15:14 ——– d—–w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-19 15:14 . 2009-04-19 15:14 ——– d—–w c:\programas\Media Player Classic
2009-04-19 15:14 . 2009-04-19 15:14 ——– d—–w c:\programas\QuickTime Alternative
2009-04-19 15:12 . 2009-04-19 15:12 37270 —-a-w c:\windows\system32\OggDSUninst.exe
2009-04-19 15:11 . 2009-04-19 15:11 ——– d—–w c:\programas\Combined Community Codec Pack
2009-04-18 23:37 . 2009-04-18 23:37 ——– d—–w c:\programas\Amond Software

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-14 11:31 . 2008-05-27 08:40 2401 —-a-w c:\windows\system32\drivers\AlKernel.sys
2009-05-14 11:01 . 2008-05-26 12:11 353212 —-a-w c:\windows\system32\nvModes.dat
2009-05-14 11:00 . 2004-08-04 10:00 84074 —-a-w c:\windows\system32\perfc016.dat
2009-05-14 11:00 . 2004-08-04 10:00 492600 —-a-w c:\windows\system32\perfh016.dat
2009-05-13 12:01 . 2009-04-12 16:12 ——– d—–w c:\programas\AviSynth 2.5
2009-05-13 12:00 . 2009-04-12 16:12 ——– d—–w c:\programas\AVI ReComp
2009-05-11 22:36 . 2008-06-18 18:13 256 —-a-w c:\windows\system32\pool.bin
2009-05-10 17:40 . 2009-05-10 17:40 0 —-a-w c:\windows\system32\1BD.tmp
2009-05-07 08:11 . 2009-05-07 08:11 0 —-a-w c:\windows\system32\BC.tmp
2009-05-05 07:32 . 2009-05-05 07:32 0 —-a-w c:\windows\system32\109.tmp
2009-04-29 08:53 . 2009-04-29 08:53 0 —-a-w c:\windows\system32\C58.tmp
2009-04-29 08:53 . 2009-04-29 08:53 0 —-a-w c:\windows\system32\C57.tmp
2009-04-27 09:56 . 2009-04-27 09:56 0 —-a-w c:\windows\system32\146.tmp
2009-04-26 14:00 . 2008-05-27 12:06 ——– d—–w c:\programas\Symantec AntiVirus
2009-04-23 09:20 . 2009-04-23 09:20 0 —-a-w c:\windows\system32\258D.tmp
2009-04-22 14:36 . 2009-04-22 14:36 0 —-a-w c:\windows\system32\23AA.tmp
2009-04-18 18:19 . 2008-07-09 14:12 ——– d—–w c:\programas\Mozilla Thunderbird
2009-04-12 20:39 . 2009-02-22 15:51 ——– d—–w c:\programas\ratDVD
2009-04-12 16:48 . 2009-04-12 16:48 ——– d—–w c:\programas\Kingdia Software
2009-04-12 16:13 . 2009-04-12 16:13 ——– d—–w c:\programas\Gabest
2009-04-12 16:13 . 2009-04-12 16:13 ——– d—–w c:\programas\Xvid
2009-04-09 17:37 . 2009-04-07 18:04 ——– d—–w c:\programas\auroPRO Beta
2009-04-08 15:34 . 2009-04-08 15:34 ——– d—–w c:\programas\Ficheiros comuns\Skype
2009-04-08 15:34 . 2008-05-28 15:30 ——– d—–r c:\programas\Skype
2009-04-06 09:44 . 2009-04-05 16:31 47360 —-a-w c:\documents and settings\CCARDOSO\Application Data\pcouffin.sys
2009-04-05 16:31 . 2009-04-05 16:31 47360 —-a-w c:\windows\system32\drivers\pcouffin.sys
2009-04-04 14:45 . 2008-06-17 00:50 ——– d—–w c:\programas\Java
2009-04-04 14:25 . 2009-01-14 18:49 ——– d—–w c:\programas\Microsoft Silverlight
2009-03-20 18:51 . 2009-03-20 18:48 ——– d—–w c:\programas\Microsoft
2009-03-20 18:50 . 2008-05-28 16:47 ——– d—–w c:\programas\Windows Live
2009-03-20 18:50 . 2009-03-20 18:50 ——– d—–w c:\programas\Microsoft SQL Server Compact Edition
2009-03-20 18:48 . 2009-03-20 18:48 ——– d—–w c:\programas\Windows Live SkyDrive
2009-03-20 17:11 . 2009-03-20 17:11 ——– d—–w c:\programas\Ficheiros comuns\Windows Live
2009-03-09 04:19 . 2009-01-08 10:02 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-06 14:20 . 2004-08-04 10:00 286720 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:07 . 2006-03-04 03:34 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 17:09 . 2004-08-04 10:00 78336 —-a-w c:\windows\system32\ieencode.dll
2005-11-15 14:32 . 2005-11-15 14:32 3638 —-a-r c:\programas\Ficheiros comuns\Altiris_Icon.ico
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D023F0EB-A380-4882-92CE-D775371513DF}]
2004-08-04 10:00 104960 —-a-w c:\windows\system32\xoeocyd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-13 68856]
"MsnMsgr"="c:\programas\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"MSMSGS"="c:\programas\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\programas\Skype\Phone\Skype.exe" [2009-03-27 24103720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="-" [X]
"Apoint"="c:\programas\Apoint\Apoint.exe" [2007-01-25 159744]
"AClntUsr"="c:\program files\Altiris\AClient\AClntUsr.EXE" [2009-05-14 184320]
"AeXAgentLogon"="c:\programas\Altiris\Altiris Agent\AeXAgentActivate.exe" [2007-03-28 143360]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-08-01 125072]
"ToolBoxFX"="c:\programas\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-10-06 53248]
"SigmatelSysTrayApp"="c:\programas\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"Dell QuickSet"="c:\programas\Dell\QuickSet\quickset.exe" [2008-02-22 1245184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-21 13594624]
"Acrobat Assistant 8.0"="c:\programas\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\programas\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"MobileConnect"="c:\programas\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"BlackBerryAutoUpdate"="c:\programas\Ficheiros comuns\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-11-04 615696]
"RoxWatchTray"="c:\programas\Ficheiros comuns\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016]
"SunJavaUpdateSched"="c:\programas\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2008-11-21 90112]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-21 1657376]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2008-11-21 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Arranque\
Bluetooth Manager.lnk - c:\programas\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-1-11 2150400]
Cisco Systems VPN Client.lnk - c:\programas\Cisco Systems\VPN Client\vpngui.exe [2008-5-27 1528880]
Inicio r pido de Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1040-7D00-7760-000000000003}\_SC_Acrobat.exe [2008-6-23 295606]
Post-it© Software Notes Lite.lnk - c:\programas\3M\PSNLite\PsnLite.exe [2004-10-15 2080768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hvcoyroj]
2004-08-04 10:00 104960 —-a-w c:\windows\system32\xoeocyd.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Arranque^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Arranque\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Arranque^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Arranque\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Altiris\\AClient\\AClntUsr.EXE"=
"c:\\Programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\hp_CLJ2600n_Full_Solution\\SETUP.EXE"=
"c:\\Programas\\BT Next Evolution\\btnext.exe"=
"c:\\Programas\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=
"c:\\Documents and Settings\\CCARDOSO\\Application Data\\Thinstall\\LimeWire PRO 4.16.6\\4000002500002i\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\CCARDOSO\\Application Data\\Thinstall\\eMule Plus 1.2d\\40000079100002i\\eMule.exe"=
"c:\\Programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programas\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programas\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"32512:TCP"= 32512:TCP:@xpsp2res.dll,-22009
"28994:TCP"= 28994:TCP:@xpsp2res.dll,-22009
"34781:TCP"= 34781:TCP:@xpsp2res.dll,-22009
"19005:TCP"= 19005:TCP:@xpsp2res.dll,-22009
"58352:TCP"= 58352:TCP:@xpsp2res.dll,-22009

R0 bwrhmaek;bwrhmaek;c:\windows\system32\drivers\bwrhmaek.sys [04-08-2004 11:00 23424]
R1 CCDevice;CCDevice;c:\windows\system32\drivers\CCDevice.sys [29-05-2007 18:55 9216]
R2 VMCService;Vodafone Mobile Connect Service;c:\programas\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [04-07-2008 13:52 14336]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programas\Ficheiros comuns\Symantec Shared\eengine\EraserUtilRebootDrv.sys [27-02-2009 10:37 101936]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys –> c:\windows\system32\drivers\massfilter.sys [?]
S3 SavRoam;SAVRoam;c:\programas\Symantec AntiVirus\SavRoam.exe [01-08-2006 10:31 120464]
S3 sdAuxService;Spyware Doctor Auxiliary Service;c:\programas\Spyware Doctor\svcntaux.exe –> c:\programas\Spyware Doctor\svcntaux.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
owebenrl

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{986e5567-1de5-11de-89fa-001b7764a030}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf25fbc3-2912-11de-89ff-001b7764a030}]
\Shell\AutoRun\command - D:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5f34dfb-0285-11de-89e7-001b7764a030}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5f34dfc-0285-11de-89e7-001b7764a030}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5f34dfd-0285-11de-89e7-001b7764a030}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cdfd5e7b-08e8-11de-89ee-001b7764a030}]
\Shell\AutoRun\command - D:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de95d682-f567-11dd-89db-001b7764a030}]
\Shell\AutoRun\command - E:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de95d685-f567-11dd-89db-001b7764a030}]
\Shell\AutoRun\command - E:\AutoRun.exe
.
- - - - ORFÃOS REMOVIDOS - - - -

Notify-dca2eb10579 - c:\windows\System32\dhcpsapi32.dll

.
——- Scan Suplementar ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = proxy-uk.vgeu.vhgroup.lan:8080
uInternet Settings,ProxyOverride = *.vhgroup.lan;*epow*;192.168.*;*.hp-net.de;10.107.*;172.18.*;
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Anexar a PDF existente - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir a Adobe PDF - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir destino de vínculo a PDF existente - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir destino de vínculo en archivo Adobe PDF - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir selección a Adobe PDF - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir selección a archivo PDF existente - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir vínculos seleccionados a Adobe PDF - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir vínculos seleccionados a PDF existente - c:\programas\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: hp-net.de\mspappl.bbn.vaillant
Trusted Zone: mspappl
Trusted Zone: trade2b.com\vaillant-group
FF - ProfilePath - c:\documents and settings\CCARDOSO\Application Data\Mozilla\Firefox\Profiles\v7utrv2h.default\
FF - component: c:\programas\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\programas\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programas\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\programas\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
FF - plugin: c:\programas\Windows Live\Photo Gallery\NPWLPG.dll
.
.
——- Associação de arquivos/ficheiros ——-
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-14 17:25
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

Procurando ficheiros/arquivos ocultos …

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ccEvtMgr]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SYMTDI]
"ImagePath"="-"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3400502441-3975972576-2293839756-10015\Software\SecuROM\License information*]
"datasecu"=hex:04,fc,20,dc,3c,c0,08,80,9d,30,2e,1f,b9,5d,e0,27,21,df,45,71,b4,
01,54,b9,e4,2e,ce,76,16,82,68,84,08,17,ee,17,83,30,d5,f7,8d,a4,b6,f1,49,41,\
"rkeysecu"=hex:bc,ee,74,40,b8,e6,06,5a,37,43,a4,a6,20,5e,0f,70
.
Tempo para conclusão: 2009-05-14 17:27
ComboFix-quarantined-files.txt 2009-05-14 16:27

Pré-execução: 9.108.099.072 bytes livres
Pós execução: 23.977.263.104 bytes livres

WindowsXP-KB310994-SP2-Pro-BootDisk-PTB.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

254 — E O F — 2009-05-13 16:42

Tomk

Post #2May 19, 2009, 4:53 AM UTC

Hi ari5av,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

I followed several tips that appear in this forum

Don't use Combofix unless specifically directed to appears all over the place. But you ran it anyway. Please don't use advanced tools without supervision.

You have two anti-virus programs. Kaspersky and Symantec. You only want one. Two can conflict with each other. Please uninstall one of them.

Then

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\windows\system32\drivers\bwrhmaek.sys
c:\windows\system32\Tm5sFH0.vbs
c:\windows\system32\1BD.tmp
c:\windows\system32\BC.tmp
c:\windows\system32\109.tmp
c:\windows\system32\C58.tmp
c:\windows\system32\C57.tmp
c:\windows\system32\146.tmp
c:\windows\system32\258D.tmp
c:\windows\system32\23AA.tmp
c:\windows\system32\xoeocyd.dll

NetSvc::
owebenrl

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{986e5567-1de5-11de-89fa-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bf25fbc3-2912-11de-89ff-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5f34dfb-0285-11de-89e7-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5f34dfc-0285-11de-89e7-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5f34dfd-0285-11de-89e7-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cdfd5e7b-08e8-11de-89ee-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de95d682-f567-11dd-89db-001b7764a030}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de95d685-f567-11dd-89db-001b7764a030}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D023F0EB-A380-4882-92CE-D775371513DF}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hvcoyroj]

Driver::
bwrhmaek

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Tomk

Post #3May 25, 2009, 1:32 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

✨ Ask AI

Ask AI