What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan Downloader:Win32/Renos.IO

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I own a windows vista pc plus own panda internet security anti virus. Yesterday, my windows defender popped up an alert message for the well known trojan downloader win32. I know u guys are probably fed up of guiding everyone through the process of clensing computers from this bugger, but i havent found any good solutions for windows vista. So if anyone could just help me through this, i would really appreciate it! Plz hurry, because from what i ve read it gets worse as time goes by… Thx for the attention, Sylar
Post #2
Hi and Welcome,

NOTE:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted.
  • Please DO NOT run any scans or fix items without my direction.



Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
OK, all the steps have been completed successfully plus you should know that my trojan has now a new "friend". original Trojan was Trojan Downloader:Win32/Renos.IO and i now have Trojan Downloader:Win32/Renos.JI as well…both being noticed by windows defender, as before.

log1:

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 12:39:47,88 on 28-07-2009
Internet Explorer: 8.0.6001.18783
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.351.2070.18.2039.962 [GMT 1:00]

AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
SP: Panda Internet Security 2008 *enabled* (Updated) {FE6602D3-1E71-4EBB-B4E3-D1C9CBDAF0A1}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FW: Panda Internet Security 2008 *enabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}

============== Running Processes ===============

C:\Windows\SYSTEM32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Panda Security\Panda Internet Security 2008\PskSvc.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrvx86.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\AEADISRV.EXE
C:\Windows\SYSTEM32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\SYSTEM32\taskeng.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Windows\system32\IoctlSvc.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Panda Security\Panda Internet Security 2008\psimsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Windows\system32\UAService7.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\SMINST\scheduler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\apvxdwin.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\tmn\tmn\tmn.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\SYSTEM32\taskeng.exe
C:\Windows\msa.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\UTILIZ~1\AppData\Local\Temp\b.exe
C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\utilizador\Desktop\dds.pif
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR
uStart Page = hxxp://www.google.com/
uSearch Bar = hxxp://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR
uInternet Settings,ProxyServer = proxy.uminho.pt:3128
uSearchURL,(Default) = hxxp://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Programa Auxiliar de Início de Sessão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Microsoft Location Finder] "c:\program files\microsoft location finder\LocationFinder.exe"
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [Monopod] c:\users\utiliz~1\appdata\local\temp\b.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0\bin\jusched.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [APVXDWIN] "c:\program files\panda security\panda internet security 2008\APVXDWIN.EXE" /s
mRun: [SCANINICIO] "c:\program files\panda security\panda internet security 2008\Inicio.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [PCSuiteTrayApplication] c:\program files\nokia\nokia pc suite 6\LaunchApplication.exe -startup
mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
mRunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe
dRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\dvdche~1.lnk - c:\program files\intervideo\dvd check\DVDCheck.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\tmn.lnk - c:\program files\tmn\tmn\tmn.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xportar para o Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
LSP: c:\program files\panda security\panda internet security 2008\pavlsp.dll
DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} - hxxps://fixit.support.microsoft.com/ActiveX/FixItClient.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
Notify: avldr - avldr.dll
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\utiliz~1\appdata\roaming\mozilla\firefox\profiles\pbcagi8r.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.ftp - proxy.uminho.pt
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - proxy.uminho.pt
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.ssl - proxy.uminho.pt
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-6-20 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2008-10-1 71736]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2008-10-1 51256]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2008-10-1 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2008-10-1 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2008-10-1 132920]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2008-10-1 38968]
R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [2008-10-1 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2008-10-1 30648]
R2 AmFSM;AmFSM;c:\windows\system32\drivers\amm8660.sys [2008-10-1 46904]
R2 ComFiltr;Panda Anti-Dialer;c:\windows\system32\drivers\COMFiltr.sys [2008-10-1 13880]
R2 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [2008-10-1 24760]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2008-10-1 178872]
R2 PskSvcRetail;Panda PSK service;c:\program files\panda security\panda internet security 2008\psksvc.exe [2008-10-1 27696]
R2 TeamViewer4;TeamViewer 4;c:\program files\teamviewer\version4\TeamViewer_Service.exe [2008-12-15 185640]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [2008-10-1 142128]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2007-11-13 106112]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2007-10-9 59264]
S3 GTPTSER;GT PT SER;c:\windows\system32\drivers\gtptser.sys [2007-3-30 8064]
S3 GTSCSER;GT SC SER;c:\windows\system32\drivers\gtscser.sys [2007-11-30 21504]
S3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2009-6-19 18912]

============== File Associations ===============

JSEFile=c:\progra~1\pandas~1\pandai~1\PavScrip.exe "%1" %*
VBEFile=c:\progra~1\pandas~1\pandai~1\PavScrip.exe "%1" %*
VBSFile=c:\progra~1\pandas~1\pandai~1\PavScrip.exe "%1" %*

=============== Created Last 30 ================

2009-07-27 13:43 140,288 a——- c:\windows\msa.exe
2009-07-22 19:18 34,064 a——- c:\windows\system32\lhacm.acm
2009-07-22 19:18 –d—– c:\program files\Teamspeak2_RC2
2009-07-22 15:17 –d—– c:\program files\MovieXplayer
2009-07-22 01:45 77,464 a——- c:\windows\War3Unin.dat
2009-07-22 01:45 2,829 a——- c:\windows\War3Unin.pif
2009-07-22 01:45 139,264 a——- c:\windows\War3Unin.exe
2009-07-21 22:16 25,280 a——- c:\windows\system32\drivers\hamachi.sys
2009-07-21 22:16 –d—– c:\program files\Hamachi
2009-07-21 21:21 –d—– C:\NeverwinterNights
2009-07-21 18:03 261 a——- c:\windows\system32\PavCPL.dat
2009-07-21 18:02 0 a——- c:\windows\system32\drivers\wnmsav.dat
2009-07-20 22:44 –d—– c:\program files\Atari
2009-07-18 21:48 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-18 21:48 97,800 a——- c:\windows\system32\infocardapi.dll
2009-07-18 21:48 622,080 a——- c:\windows\system32\icardagt.exe
2009-07-18 21:48 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-07-18 21:48 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-07-18 21:48 11,264 a——- c:\windows\system32\icardres.dll
2009-07-18 21:48 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-07-18 21:48 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-07-18 21:39 96,760 a——- c:\windows\system32\dfshim.dll
2009-07-18 21:39 282,112 a——- c:\windows\system32\mscoree.dll
2009-07-18 21:39 41,984 a——- c:\windows\system32\netfxperf.dll
2009-07-18 21:39 158,720 a——- c:\windows\system32\mscorier.dll
2009-07-18 21:39 83,968 a——- c:\windows\system32\mscories.dll
2009-07-14 23:53 267,272 a——- c:\windows\system32\xactengine2_10.dll
2009-07-14 23:53 1,374,232 a——- c:\windows\system32\D3DCompiler_36.dll
2009-07-14 23:53 444,776 a——- c:\windows\system32\d3dx10_36.dll
2009-07-14 23:53 3,734,536 a——- c:\windows\system32\d3dx9_36.dll
2009-07-14 23:53 267,112 a——- c:\windows\system32\xactengine2_9.dll
2009-07-14 23:53 3,727,720 a——- c:\windows\system32\d3dx9_35.dll
2009-07-14 23:53 1,358,192 a——- c:\windows\system32\D3DCompiler_35.dll
2009-07-14 23:53 444,776 a——- c:\windows\system32\d3dx10_35.dll
2009-07-14 23:53 266,088 a——- c:\windows\system32\xactengine2_8.dll
2009-07-14 23:53 17,928 a——- c:\windows\system32\X3DAudio1_2.dll
2009-07-14 23:53 3,497,832 a——- c:\windows\system32\d3dx9_34.dll
2009-07-14 23:53 1,124,720 a——- c:\windows\system32\D3DCompiler_34.dll
2009-07-14 23:53 443,752 a——- c:\windows\system32\d3dx10_34.dll
2009-07-14 22:06 289,792 a——- c:\windows\system32\atmfd.dll
2009-07-14 22:06 156,672 a——- c:\windows\system32\t2embed.dll
2009-07-14 22:06 72,704 a——- c:\windows\system32\fontsub.dll
2009-07-14 22:06 10,240 a——- c:\windows\system32\dciman32.dll
2009-07-03 13:26 –d—– C:\ConverterOutput
2009-07-03 13:25 –d—– c:\program files\Cucusoft

==================== Find3M ====================

2009-07-28 00:36 292,760 a——- c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-07-28 00:36 292,760 a——- c:\windows\system32\drivers\APPFCONT.DAT
2009-07-28 00:36 1,304 a——- c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-07-28 00:36 1,304 a——- c:\windows\system32\drivers\APPFLTR.CFG
2009-07-25 17:04 662,398 a——- c:\windows\system32\prfh0816.dat
2009-07-25 17:04 133,314 a——- c:\windows\system32\prfc0816.dat
2009-07-21 18:04 13,880 a——- c:\windows\system32\drivers\COMFiltr.sys
2009-07-21 18:03 143,360 a——- c:\windows\inf\infstrng.dat
2009-07-21 18:03 51,200 a——- c:\windows\inf\infpub.dat
2009-06-19 13:03 86,016 a——- c:\windows\inf\infstor.dat
2009-05-28 21:20 107,888 a——- c:\windows\system32\CmdLineExt.dll
2009-05-21 21:25 126,976 a——- c:\windows\system32\UAService7.exe
2009-05-21 01:45 93,403 a——- c:\windows\system32\~uTorrentPartFile_2AC2C1CF.dat
2009-05-09 06:50 915,456 a——- c:\windows\system32\wininet.dll
2009-05-09 06:34 71,680 a——- c:\windows\system32\iesetup.dll
2009-04-30 13:37 293,376 a——- c:\windows\system32\psisdecd.dll
2009-04-30 13:37 428,544 a——- c:\windows\system32\EncDec.dll
2008-06-13 17:12 665,600 a——- c:\windows\inf\drvindex.dat
2008-04-23 11:34 174 a–sh— c:\program files\desktop.ini
2007-01-18 05:46 332,682 a——- c:\windows\inf\perflib\0816\perfi.dat
2007-01-18 05:46 332,682 a——- c:\windows\inf\perflib\0816\perfh.dat
2007-01-18 05:46 39,514 a——- c:\windows\inf\perflib\0816\perfd.dat
2007-01-18 05:46 39,514 a——- c:\windows\inf\perflib\0816\perfc.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2009-04-04 13:00 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-04-04 13:00 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-04-04 13:00 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2008-10-02 00:39 22 a–sh— c:\windows\sminst\HPCD.sys

============= FINISH: 12:42:33,70 ===============

log2:


DDS (Ver_09-06-26.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 23-04-2008 08:55:05
System Uptime: 28-07-2009 01:52:14 (11 hours ago)

Motherboard: Hewlett-Packard | | 30D8
Processor: Intel® Pentium® Dual CPU T2390 @ 1.86GHz | U10 | 1867/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 221 GiB total, 79,537 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 12 GiB total, 2,319 GiB free.
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: Nokia 5310 XpressMusic
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 5310 XpressMusic
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd

==== System Restore Points ===================

RP399: 22-07-2009 19:44:44 - Windows Update
RP400: 22-07-2009 21:33:01 - Windows Update
RP401: 23-07-2009 19:02:59 - Windows Update
RP402: 26-07-2009 03:35:56 - Ponto de Verificação Agendado
RP403: 27-07-2009 03:56:28 - Ponto de Verificação Agendado
RP405: 27-07-2009 13:44:09 - Windows Defender Checkpoint
RP407: 27-07-2009 13:52:54 - Installed Dance eJay 7 Demo
RP409: 27-07-2009 15:16:47 - Removed Dance eJay 7 Demo
RP411: 28-07-2009 00:42:07 - Windows Defender Checkpoint

==== Installed Programs ======================


7-Zip 4.65
ACE Mega CoDecS Pack
Actualização do Microsoft Office Excel 2007 Help (KB963678)
Actualização do Microsoft Office Powerpoint 2007 Help (KB963669)
Actualização do Microsoft Office Word 2007 Help (KB963665)
Adobe Acrobat 5.0
Adobe Acrobat 6.0.1 Professional
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 9.1.1 - Português
Adobe Shockwave Player 11.5
Agere Systems HDA Modem
Apple Software Update
Arquivo do WinRAR
Assistente de Início de Sessão do Windows Live
µTorrent
AviSynth 2.5
Barra de Ferramentas do Outlook do Windows Live (Windows Live Toolbar)
Broadcom 802.11 Wireless LAN Adapter
Conexant HD Audio
Creative MediaSource
Cucusoft Ultimate DVD + Video Converter Suite [removed]
DAEMON Tools Toolbar
Detector de Feed do Windows Live Toolbar (Windows Live Toolbar)
DVD Decrypter (Remove Only)
e-escola_tmn
ESU for Microsoft Vista
Extensão do Windows Live Toolbar (Windows Live Toolbar)
FileASSASSIN
Finale 2008
FLV Player 1.3.3
Free M4a to MP3 Converter 6.0
Free YouTube to Mp3 Converter version 3.1
GameShadow
Garritan Instruments for Finale
Haali Media Splitter
Hamachi 1.0.3.0
Harry Potter e a Ordem da Fénix™
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Doc Viewer
HP Help and Support
HP MULTIPLE WLAN INSTALLER for VISTA
HP Notebook Accessories Product Tour
HP Quick Launch Buttons 6.30 A3
HP Update
HP User Guides 0077
HP Wireless Assistant
Instalador do Gerenciador de backup e recuperação HP
Intel® Graphics Media Accelerator Driver
Intel® Network Connections Drivers
InterVideo DVD Check
InterVideo Register Manager
InterVideo WinDVD
Java™ SE Runtime Environment 6
KRyLack Password Recovery
Macromedia Flash Player 8
Mario Forever 4.0
Menus Inteligentes (Windows Live Toolbar)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB929729)
Microsoft .NET Framework 3.5 SP1
Microsoft Calculator Plus
Microsoft Location Finder
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (Portuguese (Portugal)) 2007
Microsoft Office Outlook MUI (Portuguese (Portugal)) 2007
Microsoft Office PowerPoint MUI (Portuguese (Portugal)) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Portuguese (Portugal)) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (Portuguese (Portugal)) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (Portuguese (Portugal)) 2007
Microsoft Office Standard 2007
Microsoft Office Word MUI (Portuguese (Portugal)) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.0.12)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
Nero 8 Ultra Edition HD
neroxml
NetWaiting
Neverwinter Nights
Neverwinter Nights 2
Nokia Connectivity Cable Driver
Nokia PC Suite
NOMAD MuVo TX
Pacote de controladores do Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)
Pacote de controladores do Windows - Nokia Modem (02/15/2007 3.1)
Pacote de controladores do Windows - Nokia Modem (05/24/2007 6.84.0.1)
Panda ActiveScan 2.0
Panda Internet Security 2008
PC Connectivity Solution
Photo Story 3 para Windows
Pro Evolution Soccer 2009
QuickTime
Real Alternative 1.9.0
Real Race
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
SecureW2 TTLS Client 3.3.3 for Windows
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Sibelius Scorch Plugin [removed]
Sonic Activation Module
Star Wars®: Knights of the Old Republic ™
Synaptics Pointing Device Driver
TeamSpeak 2 RC2
TeamViewer 4
The Sims™ Castaway Stories
tmn
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Outlook 2007 Junk Email Filter (kb971933)
Vista Default Settings
VLC media player 0.9.9
Warcraft III
Warcraft III: All Products
Windows Live Favorites para Windows Live Toolbar
Windows Live installer
Windows Live Messenger
Windows Live Toolbar
Windows Movie Maker 2.6
Xvid 1.2.1 final uninstall

==== End Of File ===========================

Gmer:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-29 00:42:15
Windows 6.0.6001 Service Pack 1


—- System - GMER 1.0.15 —-

SSDT \??\C:\Windows\system32\PavSRK.sys ZwWriteVirtualMemory [0xA7B124E8]

INT 0x51 ? 86766BF8
INT 0x51 ? 86766BF8
INT 0x72 ? 86766BF8
INT 0x82 ? 86766BF8
INT 0x92 ? 86766BF8
INT 0xA2 ? 84A7DBF8
INT 0xB2 ? 84A7DBF8

—- Devices - GMER 1.0.15 —-

Device ShlDrv51.sys (PandaShield driver/Panda Software)
Device 854111F8
Device Ntfs.sys (Controlador de Sistema de Ficheiros NT/Microsoft Corporation)
Device B26FD500
Device fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device \Driver\volmgr \Device\VolMgrControl 84A7F1F8
Device \Driver\netbt \Device\NetBT_Tcpip_{FD2CD838-AB60-440B-A7B9-2614701A95A2} 86E90500
Device \Driver\usbuhci \Device\USBPDO-0 864EA1F8
Device \Driver\usbehci \Device\USBPDO-1 864D61F8
Device \Driver\usbuhci \Device\USBPDO-2 864EA1F8
Device \Driver\usbuhci \Device\USBPDO-3 864EA1F8
Device \Driver\usbuhci \Device\USBPDO-4 864EA1F8

AttachedDevice \Driver\tdx \Device\Tcp NETFLTDI.SYS

Device \Driver\usbehci \Device\USBPDO-5 864D61F8
Device \Driver\PCI_PNP1877 \Device\00000070 splx.sys
Device \Driver\volmgr \Device\HarddiskVolume1 84A7F1F8
Device \Driver\sptd \Device\4182845891 splx.sys
Device \Driver\volmgr \Device\HarddiskVolume2 84A7F1F8
Device \Driver\cdrom \Device\CdRom0 865931F8
Device \Driver\cdrom \Device\CdRom1 865931F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 8540F1F8
Device \Driver\atapi \Device\Ide\IdePort0 8540F1F8
Device \Driver\atapi \Device\Ide\IdePort1 8540F1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel0 854101F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2 8540F1F8
Device \Driver\netbt \Device\NetBt_Wins_Export 86E90500
Device \Driver\Smb \Device\NetbiosSmb 86E9D500
Device \Driver\netbt \Device\NetBT_Tcpip_{DF4375F8-419D-433B-8A8A-B5B8E4037073} 86E90500
Device \Driver\iScsiPrt \Device\RaidPort0 865C31F8

AttachedDevice \Driver\tdx \Device\Udp NETFLTDI.SYS

Device \Driver\usbuhci \Device\USBFDO-0 864EA1F8
Device \Driver\usbehci \Device\USBFDO-1 864D61F8
Device \Driver\usbuhci \Device\USBFDO-2 864EA1F8
Device \Driver\usbuhci \Device\USBFDO-3 864EA1F8
Device \Driver\usbuhci \Device\USBFDO-4 864EA1F8
Device \Driver\usbehci \Device\USBFDO-5 864D61F8
Device \Driver\netbt \Device\NetBT_Tcpip_{A1637B19-49F6-4E95-B710-47A4CE1BC4AE} 86E90500
Device \Driver\Modem \Device\0000008c COMFiltr.sys
Device \Driver\arj8yuun \Device\Scsi\arj8yuun1Port3Path0Target0Lun0 865C91F8
Device \Driver\arj8yuun \Device\Scsi\arj8yuun1 865C91F8

AttachedDevice fltmgr.sys (Gestor de Filtros de Sistema de Ficheiros da Microsoft/Microsoft Corporation)

Device \FileSystem\cdfs \Cdfs AE1A7500

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x10 0x3F 0x77 0x93 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x26 0x4A 0x26 0xC8 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x43 0xD7 0xD1 0x9B …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x10 0x3F 0x77 0x93 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x26 0x4A 0x26 0xC8 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x43 0xD7 0xD1 0x9B …

—- EOF - GMER 1.0.15 —-

hope to read from u soon!
Post #4
Hi,

Please do the following:

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #5
Ok, done, what next?

ComboFix:

ComboFix 09-07-28.01 - utilizador 29-07-2009 1:23.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.351.2070.18.2039.904 [GMT 1:00]
Executando de: c:\users\utilizador\Desktop\ComboFix.exe
AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *disabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
SP: Panda Internet Security 2008 *disabled* (Outdated) {FE6602D3-1E71-4EBB-B4E3-D1C9CBDAF0A1}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3114531527-816912605-1772771290-1004
E:\Autorun.inf

.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-06-28 to 2009-07-29 ))))))))))))))))))))))))))))
.

2009-07-29 00:30 . 2009-07-29 00:31 ——– d—–w- c:\users\utilizador\AppData\Local\temp
2009-07-22 18:18 . 2009-07-22 18:19 ——– d—–w- c:\users\utilizador\AppData\Roaming\teamspeak2
2009-07-22 18:18 . 2009-07-22 18:18 ——– d—–w- c:\program files\Teamspeak2_RC2
2009-07-22 14:17 . 2009-07-22 14:17 ——– d—–w- c:\program files\MovieXplayer
2009-07-22 00:45 . 2009-07-22 01:03 77464 —-a-w- c:\windows\War3Unin.dat
2009-07-22 00:45 . 2009-07-22 00:55 2829 —-a-w- c:\windows\War3Unin.pif
2009-07-22 00:45 . 2009-07-22 00:55 139264 —-a-w- c:\windows\War3Unin.exe
2009-07-22 00:41 . 2009-07-22 15:13 ——– d—–w- c:\program files\Warcraft III
2009-07-21 21:17 . 2009-07-22 18:44 ——– d—–w- c:\users\utilizador\AppData\Roaming\Hamachi
2009-07-21 21:16 . 2009-07-21 21:17 ——– d—–w- c:\program files\Hamachi
2009-07-21 21:16 . 2009-07-21 21:16 25280 —-a-w- c:\windows\system32\drivers\hamachi.sys
2009-07-21 20:21 . 2009-07-21 20:21 ——– d—–w- C:\NeverwinterNights
2009-07-21 17:03 . 2009-07-21 17:03 261 —-a-w- c:\windows\system32\PavCPL.dat
2009-07-21 17:02 . 2009-07-21 17:02 0 —-a-w- c:\windows\system32\drivers\wnmsav.dat
2009-07-20 21:44 . 2009-07-20 21:44 ——– d—–w- c:\program files\Atari
2009-07-18 20:48 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-18 20:48 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-07-18 20:48 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-07-18 20:48 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-07-18 20:48 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-07-18 20:48 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-07-18 20:48 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-07-18 20:39 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-07-18 20:39 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-07-18 20:39 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-07-18 20:39 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-07-18 20:39 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-07-18 20:38 . 2009-05-09 05:34 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-07-18 20:38 . 2009-05-09 05:50 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-14 22:53 . 2007-10-22 02:39 267272 —-a-w- c:\windows\system32\xactengine2_10.dll
2009-07-14 22:53 . 2007-10-12 14:14 1374232 —-a-w- c:\windows\system32\D3DCompiler_36.dll
2009-07-14 22:53 . 2007-10-02 08:56 444776 —-a-w- c:\windows\system32\d3dx10_36.dll
2009-07-14 22:53 . 2007-10-12 14:14 3734536 —-a-w- c:\windows\system32\d3dx9_36.dll
2009-07-14 22:53 . 2007-07-19 23:57 267112 —-a-w- c:\windows\system32\xactengine2_9.dll
2009-07-14 22:53 . 2007-10-22 02:37 17928 —-a-w- c:\windows\system32\X3DAudio1_2.dll
2009-07-14 22:53 . 2007-07-19 17:14 444776 —-a-w- c:\windows\system32\d3dx10_35.dll
2009-07-14 22:53 . 2007-07-19 17:14 3727720 —-a-w- c:\windows\system32\d3dx9_35.dll
2009-07-14 22:53 . 2007-07-19 17:14 1358192 —-a-w- c:\windows\system32\D3DCompiler_35.dll
2009-07-14 22:53 . 2007-06-20 19:46 266088 —-a-w- c:\windows\system32\xactengine2_8.dll
2009-07-14 22:53 . 2007-05-16 15:45 443752 —-a-w- c:\windows\system32\d3dx10_34.dll
2009-07-14 22:53 . 2007-05-16 15:45 3497832 —-a-w- c:\windows\system32\d3dx9_34.dll
2009-07-14 22:53 . 2007-05-16 15:45 1124720 —-a-w- c:\windows\system32\D3DCompiler_34.dll
2009-07-14 21:06 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-14 21:06 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-14 21:06 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-14 21:06 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll
2009-07-06 22:26 . 2009-07-10 12:53 ——– d—–w- c:\users\utilizador\AppData\Local\Oblivion
2009-07-03 12:26 . 2009-07-03 12:26 ——– d—–w- C:\ConverterOutput
2009-07-03 12:25 . 2009-02-26 15:34 94650 —-a-w- c:\windows\system32\HKCU_GNU.reg
2009-07-03 12:25 . 2009-02-26 15:34 2004 —-a-w- c:\windows\system32\HKLM_GNU.reg
2009-07-03 12:25 . 2008-12-18 00:22 57344 —-a-w- c:\windows\system32\ff_vfw.dll
2009-07-03 12:25 . 2008-06-15 09:01 60273 —-a-w- c:\windows\system32\pthreadGC2.dll
2009-07-03 12:25 . 2008-06-15 09:01 258352 —-a-w- c:\windows\system32\unicows.dll
2009-07-03 12:25 . 2008-02-03 20:26 364544 —-a-w- c:\windows\system32\cdg.dll
2009-07-03 12:25 . 2006-09-27 16:46 348160 —-a-w- c:\windows\system32\cdga.dll
2009-07-03 12:25 . 2006-07-17 20:42 14909 —-a-w- c:\windows\system32\A_reg.reg
2009-07-03 12:25 . 2009-07-03 12:25 ——– d—–w- c:\program files\Cucusoft
2009-07-02 13:16 . 2009-07-02 13:16 ——– d—–w- c:\users\utilizador\AppData\Local\Electronic Arts
2009-07-02 11:50 . 2009-07-14 22:53 ——– d—–w- c:\program files\Electronic Arts

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 00:31 . 2009-01-22 16:53 ——– d—–w- c:\users\utilizador\AppData\Roaming\uTorrent
2009-07-29 00:20 . 2008-10-02 00:05 303240 —-a-w- c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-07-29 00:20 . 2008-10-02 00:04 1304 —-a-w- c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-07-29 00:20 . 2008-10-01 21:53 303240 —-a-w- c:\windows\system32\drivers\APPFCONT.DAT
2009-07-29 00:20 . 2008-10-01 21:53 1304 —-a-w- c:\windows\system32\drivers\APPFLTR.CFG
2009-07-28 17:27 . 2007-01-18 04:49 662398 —-a-w- c:\windows\system32\prfh0816.dat
2009-07-28 17:27 . 2007-01-18 04:49 133314 —-a-w- c:\windows\system32\prfc0816.dat
2009-07-27 14:17 . 2008-04-23 08:16 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-22 19:39 . 2008-06-15 16:43 ——– d—–w- c:\program files\Microsoft Silverlight
2009-07-21 17:04 . 2008-10-01 21:53 13880 —-a-w- c:\windows\system32\drivers\COMFiltr.sys
2009-07-18 21:28 . 2008-04-23 08:04 94224 —-a-w- c:\users\utilizador\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-18 21:01 . 2008-06-15 16:16 ——– d—–w- c:\programdata\Microsoft Help
2009-07-18 21:00 . 2008-06-15 16:18 ——– d—–w- c:\program files\Microsoft Works
2009-07-15 04:08 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-07-14 20:40 . 2008-12-19 17:20 ——– d—–w- c:\users\utilizador\AppData\Roaming\U3
2009-07-08 23:12 . 2009-03-28 12:10 ——– d—–w- c:\program files\GameTop.com
2009-06-25 07:37 . 2009-06-24 20:18 ——– d—–w- c:\program files\PES 2009
2009-06-24 09:24 . 2009-06-15 10:10 ——– d—–w- c:\program files\DOSBox-0.73
2009-06-20 11:33 . 2008-10-01 21:51 ——– d—–w- c:\program files\Panda Security
2009-06-20 11:28 . 2009-06-20 10:55 ——– d—–w- c:\program files\ElcomSoft
2009-06-20 11:27 . 2006-11-02 12:37 ——– d—–w- c:\program files\Microsoft Games
2009-06-20 11:09 . 2009-06-20 11:09 ——– d—–w- c:\program files\KRyLack Password Recovery
2009-06-20 11:08 . 2009-06-20 11:08 ——– d—–w- c:\users\utilizador\AppData\Roaming\KRyLack Password Recovery
2009-06-19 12:17 . 2009-06-19 12:13 ——– d—–w- c:\users\utilizador\AppData\Roaming\GetRightToGo
2009-06-19 12:02 . 2009-06-19 12:02 ——– d—–w- c:\program files\WMA-MP3.com
2009-06-19 11:16 . 2009-06-19 11:16 ——– d—–w- c:\program files\Free M4a to MP3 Converter
2009-06-14 14:43 . 2009-06-14 14:43 ——– d—–w- c:\program files\LucasArts
2009-06-12 22:35 . 2008-04-23 08:03 1356 —-a-w- c:\users\utilizador\AppData\Local\d3d9caps.dat
2009-05-31 13:04 . 2009-05-31 13:04 ——– d—–w- c:\program files\FileASSASSIN
2009-05-28 20:20 . 2009-05-21 20:25 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-05-28 20:08 . 2009-05-28 20:08 8854 —-a-r- c:\users\utilizador\AppData\Roaming\Microsoft\Installer\{6AEAD38B-383B-46FF-8A5D-00A822ADA77A}\Uninstall_GameShadow_B860267642A24815A556C23750EF5A47.exe
2009-05-28 20:08 . 2009-05-28 20:08 45056 —-a-r- c:\users\utilizador\AppData\Roaming\Microsoft\Installer\{6AEAD38B-383B-46FF-8A5D-00A822ADA77A}\GameShadow.exe_0A3DE514292C4EBA987823B82B0B2BA2.exe
2009-05-28 20:08 . 2009-05-28 20:08 45056 —-a-r- c:\users\utilizador\AppData\Roaming\Microsoft\Installer\{6AEAD38B-383B-46FF-8A5D-00A822ADA77A}\ARPPRODUCTICON.exe
2009-05-28 20:08 . 2009-05-28 20:08 3262 —-a-r- c:\users\utilizador\AppData\Roaming\Microsoft\Installer\{6AEAD38B-383B-46FF-8A5D-00A822ADA77A}\NewShortcut1_D50BB830396148EB83D903A04C63534F_1.exe
2009-05-21 20:25 . 2009-05-21 20:25 126976 —-a-w- c:\windows\system32\UAService7.exe
2009-05-21 00:45 . 2009-05-21 00:45 93403 —-a-w- c:\windows\system32\~uTorrentPartFile_2AC2C1CF.dat
2009-04-30 12:37 . 2009-06-15 16:19 293376 —-a-w- c:\windows\system32\psisdecd.dll
2009-04-30 12:37 . 2009-06-15 16:19 428544 —-a-w- c:\windows\system32\EncDec.dll
2009-07-27 09:43 . 2008-12-04 15:29 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-10-01 23:39 . 2008-10-01 23:39 22 –sha-w- c:\windows\SMINST\HPCD.sys
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2006-11-14 121640]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-12-12 1840424]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-07-14 288048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 71176]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2008-04-23 77824]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-07 159744]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 129560]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
"APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-07-23 406832]
"SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-05 184320]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-12-02 2221352]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-11-29 44168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 217194]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-4-23 184320]
tmn.lnk - c:\program files\tmn\tmn\tmn.exe [2008-1-25 868352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-15 19:02 50736 —-a-w- c:\windows\System32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{A5056A70-5553-4097-876D-93AAD4369A9F}c:\\program files\\sapo\\sapo messenger\\sapoim.exe"= UDP:c:\program files\sapo\sapo messenger\sapoim.exe:Sapo Messenger
"UDP Query User{FF7E6EC7-1806-40D6-86E8-D006618F3BE0}c:\\program files\\sapo\\sapo messenger\\sapoim.exe"= TCP:c:\program files\sapo\sapo messenger\sapoim.exe:Sapo Messenger
"{A58B7A48-11A7-4567-9C61-A37CB6190652}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{3E4382A7-B10B-4910-AC8D-0B26572D28E9}"= UDP:c:\warcraft iii\Warcraft III.exe:Warcraft III
"{185D31CF-554C-408B-A548-975F779A1BAE}"= TCP:c:\warcraft iii\Warcraft III.exe:Warcraft III
"{F64106BE-630A-4981-A69F-1EC2E10CFFE5}"= UDP:c:\warcraft iii\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{443A9394-A85F-43BE-B441-A818AF1A2AED}"= TCP:c:\warcraft iii\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{DCFC4575-B090-4FCE-A10A-A36BCAFC7B42}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E83D7B67-C7EC-48C5-A63D-C8C8D959910E}"= UDP:c:\users\utilizador\Desktop\PES 09\preta\PES 2009\pes2009.exe:Pro Evolution Soccer 2009
"{B36DEE7D-3481-4AA4-89FF-7165881F9F2B}"= TCP:c:\users\utilizador\Desktop\PES 09\preta\PES 2009\pes2009.exe:Pro Evolution Soccer 2009
"{5A0F1675-4058-46A9-BE80-3AF84B4D93E6}"= UDP:c:\users\utilizador\Desktop\PES 09\preta\PES 2009\pes2009.exe:Pro Evolution Soccer 2009
"{40E57145-8B1E-43A5-87AE-9904863ADA85}"= TCP:c:\users\utilizador\Desktop\PES 09\preta\PES 2009\pes2009.exe:Pro Evolution Soccer 2009
"{E69F1871-891E-4A7D-8A59-B0DDF10C555C}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{38345336-823D-4E36-9A88-D89646313EA0}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{660B01A8-5578-4055-99B0-A11194F3F7C5}"= Disabled:UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{71FAE24C-6179-4902-9A07-C8BA4F9B20A4}"= Disabled:TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{787FD134-0799-45D6-B763-48B0F849E1A1}"= Disabled:UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{22C5648B-E6FF-41E0-9F7C-4DC967650DFB}"= Disabled:TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{4A6B3F6E-EA07-4701-9925-8CFCDE8820E7}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{C9ED03B6-C3D1-458F-8381-77ACB05C1AEB}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{EEE73F01-4FD8-4B7F-A2C2-8E941DC06DA2}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{48525DB1-0290-4E16-AFD5-3EFAAE66F1CA}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [20-06-2009 12:38 28544]
R1 APPFLT;App Filter Plugin;c:\windows\System32\drivers\APPFLT.SYS [01-10-2008 22:52 71736]
R1 DSAFLT;DSA Filter Plugin;c:\windows\System32\drivers\dsaflt.sys [01-10-2008 22:53 51256]
R1 FNETMON;NetMon Filter Plugin;c:\windows\System32\drivers\fnetmon.sys [01-10-2008 22:52 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\System32\drivers\idsflt.sys [01-10-2008 22:53 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\System32\drivers\NETFLTDI.SYS [01-10-2008 22:52 132920]
R1 ShldDrv;Panda File Shield Driver;c:\windows\System32\drivers\ShlDrv51.sys [01-10-2008 22:15 38968]
R1 SMSFLT;SMS Filter Plugin;c:\windows\System32\drivers\smsflt.sys [01-10-2008 22:53 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\System32\drivers\wnmflt.sys [01-10-2008 22:53 30648]
R2 AmFSM;AmFSM;c:\windows\System32\drivers\amm8660.sys [01-10-2008 22:53 46904]
R2 ComFiltr;Panda Anti-Dialer;c:\windows\System32\drivers\COMFiltr.sys [01-10-2008 22:53 13880]
R2 cpoint;Panda CPoint Driver;c:\windows\System32\drivers\cpoint.sys [01-10-2008 22:51 24760]
R2 PavProc;Panda Process Protection Driver;c:\windows\System32\drivers\PavProc.sys [01-10-2008 22:15 178872]
R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Internet Security 2008\psksvc.exe [01-10-2008 22:52 27696]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [15-12-2008 18:11 185640]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\System32\drivers\netimflt.sys [01-10-2008 22:51 142128]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\System32\drivers\Gt51Ip.sys [13-11-2007 15:50 106112]
S3 GT72UBUS;GT 72 U BUS;c:\windows\System32\drivers\gt72ubus.sys [09-10-2007 12:53 59264]
S3 GTPTSER;GT PT SER;c:\windows\System32\drivers\gtptser.sys [30-03-2007 12:38 8064]
S3 GTSCSER;GT SC SER;c:\windows\System32\drivers\gtscser.sys [30-11-2007 11:16 21504]
S3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\System32\drivers\lmvac.sys [19-06-2009 13:02 18912]

— =Outros Serviços/Drivers Na Memória —

*NewlyCreated* - AUJASNKJ
*Deregistered* - aujasnkj

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Conteúdo da pasta 'Tarefas Agendadas'

2009-07-27 c:\windows\Tasks\Limpeza básica.job
- c:\program files\Panda Security\Panda Internet Security 2008\PlaTasks.exe [2008-10-01 14:13]

2009-07-21 c:\windows\Tasks\Limpeza básica1.job
- c:\program files\Panda Security\Panda Internet Security 2008\PlaTasks.exe [2008-10-01 14:13]

2009-07-28 c:\windows\Tasks\User_Feed_Synchronization-{AFBE8F5E-14FF-47A2-A12D-08B8541F2C92}.job
- c:\windows\system32\msfeedssync.exe [2009-07-18 11:31]

2009-07-29 c:\windows\Tasks\Verificar Atualizações para a Barra de Ferramentas do Windows Live.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 14:54]
.
.
——- Scan Suplementar ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = proxy.uminho.pt:3128
uSearchURL,(Default) = hxxp://g.msn.com.br/0SEPTBR/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll
FF - ProfilePath - c:\users\utilizador\AppData\Roaming\Mozilla\Firefox\Profiles\pbcagi8r.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.ftp - proxy.uminho.pt
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - proxy.uminho.pt
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.ssl - proxy.uminho.pt
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 01:31
Windows 6.0.6001 Service Pack 1 NTFS

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

Procurando ficheiros/arquivos ocultos …


c:\users\UTILIZ~1\AppData\Local\Temp\catchme.dll 53248 bytes executable

Varredura completada com sucesso
arquivos/ficheiros ocultos: 1

**************************************************************************
.
——————— CHAVES DO REGISTRO BLOQUEADAS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Tempo para conclusão: 2009-07-29 1:34
ComboFix-quarantined-files.txt 2009-07-29 00:34

Pré-execução: 92.257.693.696 bytes livres
Pós execução: 96.217.616.384 bytes livres

297 — E O F — 2009-07-28 13:54

Hope you give me good news lol
Post #6
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • MBAM Log
  • Kaspersky report
Post #7
Ok, here goes. Strangely enough, the malware scan didnt detect any threats at all! should i be relieved or even more worried? =S Anyway, the log and reports now: (i forgot that report is in portuguese…if necessary ill send it again in eng) MBAM log - Malwarebytes' Anti-Malware 1.39 Versão do banco de dados: 2524 Windows 6.0.6001 Service Pack 1 29-07-2009 02:28:00 mbam-log-2009-07-29 (02-28-00).txt Tipo de Verificação: Rápida Objetos verificados: 85320 Tempo decorrido: 5 minute(s), 26 second(s) Processos da Memória infectados: 0 Módulos de Memória Infectados: 0 Chaves do Registo infectadas: 0 Valores do Registo infectados: 0 Ítens do Registo infectados: 0 Pastas infectadas: 0 Ficheiros infectados: 0 Processos da Memória infectados: (Nenhum item malicioso foi detectado) Módulos de Memória Infectados: (Nenhum item malicioso foi detectado) Chaves do Registo infectadas: (Nenhum item malicioso foi detectado) Valores do Registo infectados: (Nenhum item malicioso foi detectado) Ítens do Registo infectados: (Nenhum item malicioso foi detectado) Pastas infectadas: (Nenhum item malicioso foi detectado) Ficheiros infectados: (Nenhum item malicioso foi detectado) Kaspersky report - ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, July 29, 2009 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, July 29, 2009 11:31:48 Records in database: 2560769 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Files scanned: 223479 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 02:39:54 No malware has been detected. The scan area is clean. The selected area was scanned. What next?
Post #8
Hi,

You are clean, to stay that way

Please do the following:

P2P - I see you have P2P software µTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall this now. You can do so via Control Panel >> Add or Remove Programs.


NEXT

Please download JavaRa to your desktop and unzip it to its own folder.
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
  • Scroll down to the Java SE Runtime Environment (JRE) option.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 14)


Now we just have some housekeeping to do:


Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.


  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #9
Thank you very much for all the help, my pc seems fine now, plus thank you for the extra advice. Its nice to know that there are easy ways to get help in a good and professional manner. I will recommend this forum to everyone i know !
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI