What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Internet trouble caused by virus

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

zbshareware <–I am getting mixed reviews on this


Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Rootkit::


File::
c:\winnt\sed.exe
c:\winnt\system32\xcjsiij.dll

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #17
ComboFix log

ComboFix 09-08-10.06 - pesquisa 19/08/2009 8:11.3.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.55.1046.18.503.339 [GMT -3:00]
Executando de: c:\documents and settings\pesquisa\Desktop\Combo-Fix.exe
Comandos utilizados :: c:\documents and settings\pesquisa\Desktop\CFScript.txt

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!
.
- MODO DE FUNCIONALIDADE REDUZIDA -
.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-07-19 to 2009-08-19 ))))))))))))))))))))))))))))
.

2009-08-19 11:11 . 2009-08-19 11:11 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_298.dat
2009-08-10 16:53 . 2009-08-10 16:53 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\IObit
2009-08-10 16:53 . 2009-08-10 16:53 ——– d—–w- c:\arquivos de programas\IObit
2009-08-10 16:43 . 2009-08-10 16:41 158208 —-a-w- c:\winnt\msconfig.exe
2009-08-10 15:02 . 2009-08-10 15:33 117760 —-a-w- c:\documents and settings\pesquisa\Dados de aplicativos\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\arquivos de programas\SUPERAntiSpyware
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\documents and settings\pesquisa\Dados de aplicativos\SUPERAntiSpyware.com
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-08-10 14:47 . 2009-08-10 14:47 ——– d—–w- c:\documents and settings\pesquisa\Dados de aplicativos\Malwarebytes
2009-08-10 14:47 . 2009-08-03 16:36 38160 —-a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-08-10 14:47 . 2009-08-10 14:47 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2009-08-10 14:47 . 2009-08-10 14:47 ——– d—–w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2009-08-10 14:47 . 2009-08-03 16:36 18456 —-a-w- c:\winnt\system32\drivers\mbam.sys
2009-08-10 13:50 . 2009-08-10 14:30 ——– d—–w- c:\winnt\winsxs
2009-08-10 11:53 . 2003-09-26 06:42 30749 —-a-w- c:\winnt\system32\vbajet32.dll
2009-08-10 11:53 . 2003-10-03 04:24 614429 —-a-w- c:\winnt\system32\mswstr10.dll
2009-08-10 11:53 . 2003-10-03 04:24 176157 —-a-w- c:\winnt\system32\msjint40.dll
2009-08-10 11:53 . 2003-09-26 06:43 831760 —-a-w- c:\winnt\system32\mswdat10.dll
2009-08-10 11:53 . 2003-09-26 06:42 422160 —-a-w- c:\winnt\system32\msrd2x40.dll
2009-08-10 11:53 . 2003-09-26 06:42 315664 —-a-w- c:\winnt\system32\msrd3x40.dll
2009-08-10 11:53 . 2003-09-26 06:42 213264 —-a-w- c:\winnt\system32\msltus40.dll
2009-08-10 11:53 . 2003-09-26 06:42 53520 —-a-w- c:\winnt\system32\msjter40.dll
2009-08-10 11:53 . 2003-09-26 06:42 512272 —-a-w- c:\winnt\system32\msexch40.dll
2009-08-10 11:53 . 2005-06-03 10:30 90896 —-a-w- c:\winnt\system32\CRYPTDLG.DLL
2009-08-10 11:53 . 2003-09-26 06:42 380957 —-a-w- c:\winnt\system32\expsrv.dll
2009-08-07 16:03 . 2009-08-17 12:23 ——– d—–w- c:\arquivos de programas\USB Disk Security
2009-08-06 14:00 . 2009-08-06 14:02 ——– d–h–w- c:\documents and settings\David\Dados de aplicativos
2009-08-06 14:00 . 2009-08-06 14:00 ——– d—–r- c:\documents and settings\David\Favoritos
2009-08-06 14:00 . 2009-08-06 14:00 ——– d—–w- c:\documents and settings\David
2009-08-06 14:00 . 2005-12-19 21:12 ——– d–h–w- c:\documents and settings\David\Modelos
2009-08-06 14:00 . 2005-12-19 21:01 ——– d–h–w- c:\documents and settings\David\Ambiente de impressão
2009-08-06 14:00 . 2005-12-19 21:01 ——– d—–w- c:\documents and settings\David\Menu Iniciar
2009-07-24 17:39 . 2009-07-24 17:39 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_204.dat

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-18 23:07 . 2009-08-18 23:07 173119 —-a-w- C:\Rooter.exe
2009-08-18 13:02 . 2007-09-06 20:23 ——– d—–w- c:\arquivos de programas\Free Download Manager
2009-08-18 12:39 . 2009-08-18 12:39 ——– d—–w- c:\arquivos de programas\CCleaner
2009-08-12 16:22 . 2009-08-12 16:22 1924440 —-a-w- c:\documents and settings\David\Dados de aplicativos\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-08-10 17:57 . 2009-08-10 17:57 ——– d—–w- c:\arquivos de programas\Trend Micro
2009-08-10 16:23 . 2005-12-19 20:43 ——– d—a-w- c:\arquivos de programas\NavNT
2009-08-10 16:23 . 2005-12-19 20:43 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\Symantec
2009-08-10 16:22 . 2005-12-19 20:43 ——– d—–w- c:\arquivos de programas\Symantec
2009-08-10 16:22 . 2005-12-19 20:43 ——– d—–w- c:\arquivos de programas\Arquivos comuns\Symantec Shared
2009-08-06 20:05 . 2007-10-30 13:06 ——– d—–w- c:\arquivos de programas\Minilyrics
2009-08-05 13:24 . 2006-02-02 12:50 ——– d—–w- c:\documents and settings\pesquisa\Dados de aplicativos\AdobeUM
2009-07-03 18:33 . 2009-07-03 18:33 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_214.dat
2009-06-25 20:56 . 2009-06-25 20:56 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_1f8.dat
2005-12-19 20:14 . 2005-12-19 20:14 22040 —h–w- c:\arquivos de programas\folder.htt
2009-03-17 14:01 . 2009-03-17 14:01 111616 –sha-r- c:\winnt\system32\xcjsiij.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-10_17.38.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2003-05-07 19:57 . 2003-05-07 19:57 73728 c:\winnt\system32\spool\drivers\w32x86\3\hpztbi09.dll
+ 2002-10-30 18:10 . 2002-10-30 18:10 49152 c:\winnt\system32\spool\drivers\w32x86\3\hpzrer09.dll
+ 2003-05-07 19:58 . 2003-05-07 19:58 81920 c:\winnt\system32\spool\drivers\w32x86\3\hpzflt09.dll
+ 2008-10-30 16:39 . 2003-05-23 02:52 83014 c:\winnt\system32\spool\drivers\w32x86\3\hph240.dat
+ 2008-10-30 16:39 . 2003-05-23 02:52 83014 c:\winnt\system32\spool\drivers\w32x86\3\hph140.dat
+ 2009-08-12 16:22 . 2009-08-12 16:22 84661 c:\winnt\system32\Macromed\Flash\uninstall_plugin.exe
+ 2003-05-07 19:57 . 2003-05-07 19:57 167987 c:\winnt\system32\spool\drivers\w32x86\3\hpzvip09.dll
+ 2003-05-07 20:24 . 2003-05-07 20:24 442368 c:\winnt\system32\spool\drivers\w32x86\3\hpztbx09.exe
+ 2003-05-07 19:56 . 2003-05-07 19:56 188416 c:\winnt\system32\spool\drivers\w32x86\3\hpztbu09.exe
+ 2003-05-07 20:14 . 2003-05-07 20:14 176128 c:\winnt\system32\spool\drivers\w32x86\3\hpzstw09.exe
+ 2003-05-07 20:22 . 2003-05-07 20:22 380928 c:\winnt\system32\spool\drivers\w32x86\3\hpzstc09.exe
+ 2003-05-07 18:19 . 2003-05-07 18:19 327680 c:\winnt\system32\spool\drivers\w32x86\3\hpzrm309.dll
+ 2003-04-30 18:26 . 2003-04-30 18:26 376832 c:\winnt\system32\spool\drivers\w32x86\3\hpzres09.dll
+ 2003-05-07 19:23 . 2003-05-07 19:23 335872 c:\winnt\system32\spool\drivers\w32x86\3\hpzpre09.exe
+ 2003-05-07 20:08 . 2003-05-07 20:08 475136 c:\winnt\system32\spool\drivers\w32x86\3\hpzpm309.dll
+ 2003-05-07 20:16 . 2003-05-07 20:16 155704 c:\winnt\system32\spool\drivers\w32x86\3\hpzlnt09.dll
+ 2003-05-07 20:15 . 2003-05-07 20:15 204800 c:\winnt\system32\spool\drivers\w32x86\3\hpzjui09.dll
+ 2003-04-30 18:24 . 2003-04-30 18:24 212992 c:\winnt\system32\spool\drivers\w32x86\3\hpzime09.dll
+ 2003-05-07 18:44 . 2003-05-07 18:44 638976 c:\winnt\system32\spool\drivers\w32x86\3\hpzeng09.exe
+ 2003-05-07 18:59 . 2003-05-07 18:59 270336 c:\winnt\system32\spool\drivers\w32x86\3\hpzcon09.dll
+ 2003-05-07 18:58 . 2003-05-07 18:58 208896 c:\winnt\system32\spool\drivers\w32x86\3\hpzcoi09.dll
+ 2003-05-07 19:04 . 2003-05-07 19:04 245760 c:\winnt\system32\spool\drivers\w32x86\3\hpzcfg09.exe
+ 2003-05-07 18:13 . 2003-05-07 18:13 204800 c:\winnt\system32\spool\drivers\w32x86\3\hpz2ku09.dll
+ 2008-10-30 16:39 . 2003-05-23 02:53 124011 c:\winnt\system32\spool\drivers\w32x86\3\hph7900.dat
+ 2008-10-30 16:39 . 2003-05-23 02:53 121751 c:\winnt\system32\spool\drivers\w32x86\3\hph7700.dat
+ 2008-10-30 16:39 . 2003-05-23 02:53 121751 c:\winnt\system32\spool\drivers\w32x86\3\hph7600.dat
+ 2008-10-30 16:39 . 2003-05-23 02:53 121051 c:\winnt\system32\spool\drivers\w32x86\3\hph7200.dat
+ 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\winnt\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2003-05-07 18:33 . 2003-05-07 18:33 9420800 c:\winnt\system32\spool\drivers\w32x86\3\hpzr3209.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\winnt\system32\Macromed\Flash\NPSWF32.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USB Antivirus"="c:\arquivos de programas\USB Disk Security\USBGuard.exe" [2008-06-14 798720]
"IObit Security 360"="c:\arquivos de programas\IObit\IObit Security 360\IS360tray.exe" [2009-08-10 952080]
"Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-19 111888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-06-19 189712]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\arquivos de programas\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 15:05 356352 —-a-w- c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinVNC4"=2 (0x2)

R?2 helpaccess;Time Server;c:\winnt\system32\svchost.exe -k netsvcs [23/1/2000 21:00 7952]
R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\SUPERAntiSpyware\sasdifsv.sys [23/6/2009 11:01 9968]
R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\SUPERAntiSpyware\SASKUTIL.SYS [23/6/2009 11:01 72944]
R2 IS360service;IS360service;c:\arquivos de programas\IObit\IObit Security 360\is360srv.exe [10/8/2009 13:53 307472]
R3 usbhub20;Suporte a hub raiz USB 2.0;c:\winnt\system32\drivers\usbhub20.sys [19/12/2005 17:34 49776]
S3 HPx9G+;HPx9G+ Device USB Driver;c:\winnt\system32\drivers\HPx9G2k.sys [12/9/2007 13:21 12658]
S3 SASENUM;SASENUM;c:\arquivos de programas\SUPERAntiSpyware\SASENUM.SYS [23/6/2009 11:01 7408]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
helpaccess
.
.
——- Scan Suplementar ——-
.
uStart Page = hxxp://www.joinville.udesc.br/
LSP: %SystemRoot%\system32\msafd.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\pesquisa\Dados de aplicativos\Mozilla\Firefox\Profiles\fhcoqw1q.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: network.proxy.http - 189.127.143.70
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 1

—- FIREFOX POLICIES —-
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 08:13
Windows 5.0.2195 Service Pack 4 NTFS

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

Procurando ficheiros/arquivos ocultos …

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\helpaccess]
"ServiceDll"="c:\winnt\system32\xcjsiij.dll"
.
——————— CHAVES DO REGISTRO BLOQUEADAS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Carregadas Sob os Processos em Execução ———————

- - - - - - - > 'winlogon.exe'(192)
c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL
c:\winnt\system32\NavLogon.dll

- - - - - - - > 'explorer.exe'(1844)
c:\winnt\AppPatch\AcLayers.DLL
c:\winnt\system32\SHDOCVW.DLL
.
Tempo para conclusão: 2009-08-19 8:15
ComboFix-quarantined-files.txt 2009-08-19 11:15
ComboFix2.txt 2009-08-17 18:32
ComboFix3.txt 2009-08-10 17:40

Pré-execução: 8.206.266.368 bytes disponíveis
Pós execução: 8.201.314.304 bytes disponíveis

238

HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:18:34, on 19/8/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\notepad.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.joinville.udesc.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [USB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [IObit Security 360] C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Serviço administrativo do gerenciador de disco lógico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IS360service - IObit - C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe

–
End of file - 2740 bytes
Post #18
Hi,

Looking good :thumbup:

You need to update your Java, the older versions of Java leave holes in your system for this garbage to sneak in. Go to your Control Panel and click on the Java Icon ( looks like a little coffee cup ) click on About and you should have Version 6 Update 15, if not click on the update tab and update it.

Lets make sure we have not missed anything.

Please run this free online virus scanner from ESET
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic
Post #19
Okay, I've updated Java.
But I still can't access those websites, not even the ESET one.
Well, so I used a proxy to access ESET, and had the following error:

[external image: Posted Image]

Wich means:
It was not possible to find 'getnameinfo' entrance proceedure in the dynamic library WS2_32.dll
Post #20 last edited
Try this one

Please do a scan with Kaspersky Online Scannerr from Here.
  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report To obtain the report:
  • Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
  • Then, click: Save
  • Please post the Kaspersky Online Scanner Report in your reply.

[external image: Posted Image]



How are things running now???
Post #21
Hey Ken, I finally made it!
Thanks to your help concerning me about the xcjsiij.dll file, I was able to find out what virus was.
So I burned a Avira Rescue Disk, and it was able to remove it :)

Anyway, here it goes the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:35:32, on 20/8/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
C:\WINNT\System32\svchost.exe
C:\Arquivos de programas\Java\jre6\bin\jqs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Arquivos de programas\USB Disk Security\USBGuard.exe
C:\Arquivos de programas\Java\jre6\bin\jusched.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.joinville.udesc.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 189.127.143.70:3128
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [USB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Serviço administrativo do gerenciador de disco lógico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

–
End of file - 3409 bytes

Seems all clear now, right?
Post #23
Here is it: DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 14:40:21,06 on qui 20/08/2009 Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_15 Microsoft Windows 2000 Professional 5.0.2195.4.1252.55.1046.18.503.207 [GMT -3:00] ============== Running Processes =============== C:\WINNT\system32\spoolsv.exe C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe C:\Arquivos de programas\Java\jre6\bin\jqs.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\Arquivos de programas\USB Disk Security\USBGuard.exe C:\Arquivos de programas\Java\jre6\bin\jusched.exe C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe C:\Arquivos de programas\Mozilla Firefox\firefox.exe C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\AcroRd32.exe C:\Documents and Settings\pesquisa\Meus documentos\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.joinville.udesc.br/ uInternet Settings,ProxyServer = 189.127.143.70:3128 BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\arquivos de programas\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\arquivos de programas\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\arquivos de programas\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll mRun: [USB Antivirus] c:\arquivos de programas\usb disk security\USBGuard.exe mRun: [Synchronization Manager] mobsync.exe /logon mRun: [SunJavaUpdateSched] "c:\arquivos de programas\java\jre6\bin\jusched.exe" mRun: [avgnt] "c:\arquivos de programas\avira\antivir desktop\avgnt.exe" /min dRunOnce: [^SetupICWDesktop] c:\arquivos de programas\internet explorer\connection wizard\icwconn1.exe /desktop DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1250786439656 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab Notify: !SASWinLogon - c:\arquivos de programas\superantispyware\SASWINLO.dll Notify: igfxcui - igfxsrvc.dll Notify: NavLogon - c:\winnt\system32\NavLogon.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\arquivos de programas\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\pesquisa\dadosd~1\mozilla\firefox\profiles\fhcoqw1q.default\ FF - prefs.js: browser.startup.homepage - about:blank FF - HiddenExtension: Java Console: No Registry Reference - c:\arquivos de programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\arquivos de programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R?2 helpaccess;Time Server;c:\winnt\system32\svchost.exe -k netsvcs [2000-1-23 7952] R1 avgio;avgio;c:\arquivos de programas\avira\antivir desktop\avgio.sys [2009-8-19 11608] R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\superantispyware\sasdifsv.sys [2009-6-23 9968] R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\superantispyware\SASKUTIL.SYS [2009-6-23 72944] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\arquivos de programas\avira\antivir desktop\sched.exe [2009-8-19 108289] R2 AntiVirService;Avira AntiVir Guard;c:\arquivos de programas\avira\antivir desktop\avguard.exe [2009-8-19 185089] R2 avgntflt;avgntflt;c:\winnt\system32\drivers\avgntflt.sys [2009-8-19 65240] R3 usbhub20;Suporte a hub raiz USB 2.0;c:\winnt\system32\drivers\usbhub20.sys [2005-12-19 49776] S3 HPx9G+;HPx9G+ Device USB Driver;c:\winnt\system32\drivers\HPx9G2k.sys [2007-9-12 12658] S3 SASENUM;SASENUM;c:\arquivos de programas\superantispyware\SASENUM.SYS [2009-6-23 7408] =============== Created Last 30 ================ 2009-08-20 14:40 16,384 a——t c:\winnt\system32\Perflib_Perfdata_2c4.dat 2009-08-20 13:39 –ds—- c:\documents and settings\pesquisa\UserData 2009-08-19 17:46 –d-h— c:\winnt\PIF 2009-08-19 17:32 16,384 a——t c:\winnt\system32\Perflib_Perfdata_21c.dat 2009-08-19 17:30 16,384 a——t c:\winnt\system32\Perflib_Perfdata_218.dat 2009-08-19 13:39 65,240 a——- c:\winnt\system32\drivers\avgntflt.sys 2009-08-19 13:39 –d—– c:\docume~1\alluse~1\dadosd~1\Avira 2009-08-19 13:39 –d—– c:\arquivos de programas\Avira 2009-08-19 13:21 411,368 a——- c:\winnt\system32\deploytk.dll 2009-08-19 08:11 216,064 a——- c:\winnt\PEV.exe 2009-08-19 08:11 161,792 a——- c:\winnt\SWREG.exe 2009-08-19 08:11 98,816 a——- c:\winnt\sed.exe 2009-08-18 20:09 –d—– C:\Rooter$ 2009-08-18 20:07 173,119 a——- C:\Rooter.exe 2009-08-18 10:14 –d—– C:\Salvo Gleison 2009-08-18 09:39 –d—– c:\arquivos de programas\CCleaner 2009-08-10 14:57 –d—– c:\arquivos de programas\Trend Micro 2009-08-10 14:39 -cd—– c:\winnt\system32\dllcache\cache 2009-08-10 14:33 –ds—- C:\ComboFix 2009-08-10 13:53 –d—– c:\docume~1\alluse~1\dadosd~1\IObit 2009-08-10 13:53 –d—– c:\arquivos de programas\IObit 2009-08-10 13:43 158,208 a——- c:\winnt\msconfig.exe 2009-08-10 13:41 –d—– c:\winnt\pss 2009-08-10 12:01 –d—– c:\docume~1\alluse~1\dadosd~1\SUPERAntiSpyware.com 2009-08-10 12:01 –d—– c:\docume~1\pesquisa\dadosd~1\SUPERAntiSpyware.com 2009-08-10 12:01 –d—– c:\arquivos de programas\SUPERAntiSpyware 2009-08-10 12:01 –d—– c:\arquivos de programas\arquivos comuns\Wise Installation Wizard 2009-08-10 11:47 –d—– c:\docume~1\pesquisa\dadosd~1\Malwarebytes 2009-08-10 11:47 38,160 a——- c:\winnt\system32\drivers\mbamswissarmy.sys 2009-08-10 11:47 –d—– c:\docume~1\alluse~1\dadosd~1\Malwarebytes 2009-08-10 11:47 18,456 a——- c:\winnt\system32\drivers\mbam.sys 2009-08-10 11:47 –d—– c:\arquivos de programas\Malwarebytes' Anti-Malware 2009-08-10 10:50 –d—– c:\winnt\winsxs 2009-08-10 08:53 30,749 a——- c:\winnt\system32\vbajet32.dll 2009-08-10 08:53 831,760 a——- c:\winnt\system32\mswdat10.dll 2009-08-10 08:53 614,429 a——- c:\winnt\system32\mswstr10.dll 2009-08-10 08:53 512,272 a——- c:\winnt\system32\msexch40.dll 2009-08-10 08:53 422,160 a——- c:\winnt\system32\msrd2x40.dll 2009-08-10 08:53 315,664 a——- c:\winnt\system32\msrd3x40.dll 2009-08-10 08:53 213,264 a——- c:\winnt\system32\msltus40.dll 2009-08-10 08:53 176,157 a——- c:\winnt\system32\msjint40.dll 2009-08-10 08:53 53,520 a——- c:\winnt\system32\msjter40.dll 2009-08-10 08:53 380,957 a——- c:\winnt\system32\expsrv.dll 2009-08-10 08:53 90,896 a——- c:\winnt\system32\CRYPTDLG.DLL 2009-08-07 13:03 –d—– c:\arquivos de programas\USB Disk Security 2009-08-06 11:00 208,896 a——- c:\winnt\system32\wmpns.dll 2009-07-24 14:39 16,384 a——t c:\winnt\system32\Perflib_Perfdata_204.dat ==================== Find3M ==================== 2009-07-03 15:33 16,384 a——t c:\winnt\system32\Perflib_Perfdata_214.dat 2009-06-25 17:56 16,384 a——t c:\winnt\system32\Perflib_Perfdata_1f8.dat 2005-12-19 17:14 22,040 —-h— c:\arquivos de programas\folder.htt 2005-12-19 17:14 271 —-h— c:\arquivos de programas\desktop.ini 2000-01-23 21:00 32,528 a——- c:\winnt\inf\wbfirdma.sys ============= FINISH: 14:40:37,90 ===============
Post #25
Just fine! I can access the websites now! Again, thank you very much, Sir! Just let me ask you about the Classroom: does the study requires a lot of time?
Post #26
Cyberz,

The classroom is set up to train Malware fighters to help on this forum, its not set up just to teach you how to clean your own computer. The class is strenuous, going to take a fair amount of your time to study different malicious programs and the tools to remove them. I have been at it for over 5 years and there is nothing else I rather do. The comradeship you will build up is the best in the world, I have never met finer people in 70 years. So take your time , think about it and if you want to join the school you can apply here.

http://forums.whatthetech.com/What_Tech_Cl…oom_t80368.html


RootRepeal <–Drag it to the trash

ATF Cleaner <– Yours to keep, run it now and then to clean out the clutter.

Malwarebytes <– Yours to keep also, check for updates and run a scan now and then.

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


    • [external image: Posted Image]

  • When shown the disclaimer, Select "2"

The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.


  • How did I get infected in the first place ?
    Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports



Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster and Spyware Guard, they will conflict with the TeaTimer in Spybot , you can still install Spybot Search and Destroy but do not enable the TeaTimer .



Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
  • Spybot Search and Destroy 1.6
    Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  • Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  • Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  • IE-Spyad
    IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.


Safe Surfn
Ken
Post #27
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI