What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HijackThis Log

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I just came back from holidays and my internet was really slow, today is the 5th day. I have followed this guide http://www.wilderssecurity.com/showthread.php?t=50662 and my internet got a bit better, but today it looks like it is as slow as before.

I have got hacked on WoW, no clue how, but a german gold seller created several level 1's on german realms and deleted all of my characters. My internet wasn't slow by then.

My dad has some downloads but he has always had some running. I can't see how's that the issue as sometimes my internet just goes down and I have to restart my internet connection to get it back automatically.

I am from Portugal so I use GMT. I will surely check this later and be patient…

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:27:21, on 20-08-2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Programas\Ficheiros comuns\Java\Java Update\jusched.exe
C:\Programas\Scanner\HP Share-to-Web\hpgs2wnd.exe
C:\Programas\Avira\AntiVir Desktop\avgnt.exe
C:\Programas\TrojanHunter 5.3\THGuard.exe
C:\Programas\Scanner\HP Share-to-Web\hpgs2wnf.exe
C:\Programas\Avira\AntiVir Desktop\avguard.exe
C:\Programas\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Programas\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programas\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=15161&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programas\Ficheiros comuns\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programas\Scanner\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [THGuard] "C:\Programas\TrojanHunter 5.3\THGuard.exe"
O4 - HKCU\..\Run: [Steam] "C:\Programas\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "C:\Programas\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Incluir no Blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Incluir no Blog no Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O18 - Protocol: schmap-help - (no CLSID) - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon da cache de categorias dos componentes - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programas\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Programas\Lavasoft\Ad-Aware\AAWService.exe (file missing)
O23 - Service: npkcmsvc - Unknown owner - C:\Nexon\Mabinogi\npkcmsvc.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Programas\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 7427 bytes
Post #2
Hi

Please do the following:



Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #4
In case you didn't want me to upload the files, I'll just post the content here:

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 147):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E3000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9EB4000 spox.sys
0xBA5AA000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xB9E9C000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xB9E6D000 ACPI.sys
0xB9E5C000 pci.sys
0xBA0A8000 isapnp.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0B8000 MountMgr.sys
0xB9E3D000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9E17000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9DFF000 atapi.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9DE0000 fltMgr.sys
0xBA0F8000 Lbd.sys
0xB9DC9000 KSecDD.sys
0xB9D3C000 Ntfs.sys
0xB9D0F000 NDIS.sys
0xBA108000 ohci1394.sys
0xBA118000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xB9CF4000 Mup.sys
0xBA248000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBA188000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB8ECF000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xB8EBB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB8E96000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xBA198000 \SystemRoot\system32\DRIVERS\l251x86.sys
0xBA430000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB8E73000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA438000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB8DF2000 \SystemRoot\system32\drivers\ctaud2k.sys
0xB8DD0000 \SystemRoot\system32\drivers\portcls.sys
0xBA1A8000 \SystemRoot\system32\drivers\drmk.sys
0xB8DAD000 \SystemRoot\system32\drivers\ks.sys
0xB8D79000 \SystemRoot\system32\drivers\ctoss2k.sys
0xBA440000 \SystemRoot\system32\drivers\ctprxy2k.sys
0xBA588000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xBA448000 \SystemRoot\system32\DRIVERS\fdc.sys
0xB8D65000 \SystemRoot\system32\DRIVERS\parport.sys
0xBA5C0000 \SystemRoot\system32\DRIVERS\ASACPI.sys
0xBA450000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB8D54000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA58C000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA590000 \SystemRoot\system32\drivers\pfc.sys
0xB94F5000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB94E5000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA704000 \SystemRoot\system32\DRIVERS\audstub.sys
0xB94D5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA598000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB8D3D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xB94C5000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB94B5000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA458000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB8D2C000 \SystemRoot\system32\DRIVERS\psched.sys
0xB94A5000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA460000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA468000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB8CFB000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xB9495000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA470000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5C2000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB8CC7000 \SystemRoot\system32\DRIVERS\update.sys
0xB9CC8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB8C99000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0xB9465000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA1E8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5C6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA8B1E000 \SystemRoot\system32\drivers\hap16v2k.sys
0xA8A14000 \SystemRoot\system32\drivers\ha10kx2k.sys
0xA89E5000 \SystemRoot\system32\drivers\emupia2k.sys
0xA89BC000 \SystemRoot\system32\drivers\ctsfm2k.sys
0xA8920000 \SystemRoot\system32\drivers\ctac32k.sys
0xA8905000 \SystemRoot\System32\drivers\COMMONFX.SYS
0xA887A000 \SystemRoot\System32\drivers\CTAUDFX.SYS
0xA87EC000 \SystemRoot\System32\drivers\CTSBLFX.SYS
0xBA478000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xBA5CE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA7BC000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5D0000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA258000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA55C000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA268000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA498000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA4A0000 \SystemRoot\system32\DRIVERS\Amfilter.sys
0xBA4A8000 \SystemRoot\System32\drivers\vga.sys
0xBA5D6000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5D8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA4B0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA340000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA564000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA863E000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA85E6000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA85BE000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA859D000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA278000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA857B000 \SystemRoot\System32\drivers\afd.sys
0xBA288000 \SystemRoot\system32\DRIVERS\netbios.sys
0xBA348000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xA854F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xBA298000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xBA57C000 \??\C:\WINDOWS\system32\drivers\pclepci.sys
0xA84E0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA2A8000 \SystemRoot\System32\Drivers\Fips.SYS
0xA84BE000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xBA380000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xBA5E4000 \??\C:\Programas\Avira\AntiVir Desktop\avgio.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xA8B6D000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xA8B5D000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xA8B55000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA1B8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA81CC000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA602000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xBA3C8000 \SystemRoot\System32\watchdog.sys
0xA8711000 \SystemRoot\System32\drivers\Dxapi.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA7D2000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xA809F000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xBA554000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA7E1A000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA5D2000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xA7D13000 \??\C:\WINDOWS\system32\drivers\PfModNT.sys
0xA7CC0000 \SystemRoot\system32\DRIVERS\srv.sys
0xA7913000 \SystemRoot\system32\drivers\wdmaud.sys
0xA7B90000 \SystemRoot\system32\drivers\sysaudio.sys
0xBA5AE000 \SystemRoot\system32\drivers\splitter.sys
0xA78F0000 \SystemRoot\system32\drivers\aec.sys
0xBA2B8000 \SystemRoot\system32\drivers\swmidi.sys
0xA7BA0000 \SystemRoot\system32\drivers\DMusic.sys
0xA78C6000 \SystemRoot\system32\drivers\kmixer.sys
0xBA775000 \SystemRoot\system32\drivers\drmkaud.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 36):
0 System Idle Process
4 System
448 C:\WINDOWS\system32\smss.exe
508 csrss.exe
532 C:\WINDOWS\system32\winlogon.exe
576 C:\WINDOWS\system32\services.exe
588 C:\WINDOWS\system32\lsass.exe
772 C:\WINDOWS\system32\svchost.exe
820 svchost.exe
888 C:\WINDOWS\system32\svchost.exe
980 svchost.exe
1020 svchost.exe
1192 C:\WINDOWS\system32\spoolsv.exe
1244 C:\Programas\Avira\AntiVir Desktop\sched.exe
1368 C:\Programas\Avira\AntiVir Desktop\avguard.exe
1416 C:\Programas\Java\jre6\bin\jqs.exe
1528 C:\WINDOWS\system32\svchost.exe
1576 wdfmgr.exe
1716 C:\Programas\Avira\AntiVir Desktop\avshadow.exe
2036 C:\WINDOWS\system32\wbem\wmiapsrv.exe
240 alg.exe
184 C:\WINDOWS\explorer.exe
512 C:\WINDOWS\system32\CtHelper.exe
724 C:\WINDOWS\system32\hkcmd.exe
1768 C:\Programas\Ficheiros comuns\Java\Java Update\jusched.exe
1708 C:\Programas\Scanner\HP Share-to-Web\hpgs2wnd.exe
780 C:\Programas\Avira\AntiVir Desktop\avgnt.exe
640 C:\Programas\TrojanHunter 5.3\THGuard.exe
1600 C:\Programas\Skype\Phone\Skype.exe
1264 C:\Programas\Scanner\HP Share-to-Web\hpgs2wnf.exe
2360 C:\Programas\Skype\Plugin Manager\skypePM.exe
2612 C:\Programas\Mozilla Firefox\firefox.exe
2732 C:\Programas\Skype\Toolbars\Shared\SkypeNames2.exe
2996 C:\Programas\Mozilla Firefox\plugin-container.exe
2492 C:\WINDOWS\system32\wscntfy.exe
1944 C:\Documents and Settings\elmano\Ambiente de trabalho\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: –> \\.\PhysicalDrive0 at offset 0x0000000c`34f2cc00 (NTFS)
\\.\F: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: HitachiHDT725032VLA360, Rev: V54OA7EA
PhysicalDrive1 Model Number: WDCWD5000AAJS-22YFA0, Rev: 12.01C02

Size Device Name MBR Status
——————————————–
298 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: 47D938448666D8A4FBC92B6DECD7263068BC0861
465 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!



DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 13:50:20,60 on 23-08-2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.351.2070.18.2039.1437 [GMT 1:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Avira\AntiVir Desktop\sched.exe
C:\Programas\Avira\AntiVir Desktop\avguard.exe
C:\Programas\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Programas\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programas\Ficheiros comuns\Java\Java Update\jusched.exe
C:\Programas\Scanner\HP Share-to-Web\hpgs2wnd.exe
C:\Programas\Avira\AntiVir Desktop\avgnt.exe
C:\Programas\TrojanHunter 5.3\THGuard.exe
C:\Programas\Scanner\HP Share-to-Web\hpgs2wnf.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Programas\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\elmano\Ambiente de trabalho\dds.com
C:\Programas\Skype\Toolbars\Shared\SkypeNames2.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://eu.ask.com?o=15161&l=dis
uSearch Page =
uSearch Bar =
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
mSearchAssistant =
BHO: Facilitador de Leitor de Link Adobe PDF: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\programas\ficheiros comuns\adobe\acrobat\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\programas\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programas\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programas\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [Steam] "c:\programas\steam\Steam.exe" -silent
uRun: [Skype] "c:\programas\skype\phone\Skype.exe" /nosplash /minimized
mRun: [CTHelper] CTHELPER.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SunJavaUpdateSched] "c:\programas\ficheiros comuns\java\java update\jusched.exe"
mRun: [Share-to-Web Namespace Daemon] c:\programas\scanner\hp share-to-web\hpgs2wnd.exe
mRun: [avgnt] "c:\programas\avira\antivir desktop\avgnt.exe" /min
mRun: [THGuard] "c:\programas\trojanhunter 5.3\THGuard.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menuin~1\progra~1\arranque\micros~1.lnk - c:\programas\microsoft office\office10\OSA.EXE
IE: E&xportar para o Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programas\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\programas\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\programas\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {3253344D-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/mpg4sax.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\programas\ficheiros comuns\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\programas\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\fichei~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\elmano\applic~1\mozilla\firefox\profiles\uguuuywf.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - www.google.pt
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\elmano\application data\mozilla\firefox\profiles\uguuuywf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\elmano\application data\mozilla\firefox\profiles\uguuuywf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\programas\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\programas\adobereader 8.0\reader\browser\nppdf32.dll
FF - plugin: c:\programas\microsoft\office live\npOLW.dll
FF - plugin: c:\programas\mozilla firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\programas\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programas\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\programas\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programas\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programas\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\programas\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\programas\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programas\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programas\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-5-31 64288]
R1 avgio;avgio;c:\programas\avira\antivir desktop\avgio.sys [2010-7-25 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programas\avira\antivir desktop\sched.exe [2010-7-25 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\programas\avira\antivir desktop\avguard.exe [2010-7-25 267432]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-8-31 60936]
R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\pfmodnt.sys [2008-7-7 15896]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2008-6-27 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2008-6-27 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2008-6-27 566296]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\programas\lavasoft\ad-aware\aawservice.exe" –> c:\programas\lavasoft\ad-aware\AAWService.exe [?]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2008-6-27 99352]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2008-6-27 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2008-6-27 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2008-6-27 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2008-6-27 566296]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\elmano\defini~1\temp\tpl67.tmp –> c:\docume~1\elmano\defini~1\temp\TPL67.tmp [?]
S3 NUVision;Studio OnLine;c:\windows\system32\drivers\Nuvision.sys [2009-2-9 136352]
S3 PbsAuDrv;PolderbitS Audio Driver;c:\windows\system32\drivers\pbsaudrv.sys –> c:\windows\system32\drivers\pbsaudrv.sys [?]
S3 XDva098;XDva098;\??\c:\windows\system32\xdva098.sys –> c:\windows\system32\XDva098.sys [?]
S3 XDva143;XDva143;\??\c:\windows\system32\xdva143.sys –> c:\windows\system32\XDva143.sys [?]
S3 XDva189;XDva189;\??\c:\windows\system32\xdva189.sys –> c:\windows\system32\XDva189.sys [?]
S3 XDva195;XDva195;\??\c:\windows\system32\xdva195.sys –> c:\windows\system32\XDva195.sys [?]
S3 XDva208;XDva208;\??\c:\windows\system32\xdva208.sys –> c:\windows\system32\XDva208.sys [?]
S3 XDva219;XDva219;\??\c:\windows\system32\xdva219.sys –> c:\windows\system32\XDva219.sys [?]
S3 XDva224;XDva224;\??\c:\windows\system32\xdva224.sys –> c:\windows\system32\XDva224.sys [?]
S3 XDva238;XDva238;\??\c:\windows\system32\xdva238.sys –> c:\windows\system32\XDva238.sys [?]
S3 XDva248;XDva248;\??\c:\windows\system32\xdva248.sys –> c:\windows\system32\XDva248.sys [?]
S3 XDva273;XDva273;\??\c:\windows\system32\xdva273.sys –> c:\windows\system32\XDva273.sys [?]
S3 XDva280;XDva280;\??\c:\windows\system32\xdva280.sys –> c:\windows\system32\XDva280.sys [?]
S3 XDva281;XDva281;\??\c:\windows\system32\xdva281.sys –> c:\windows\system32\XDva281.sys [?]

=============== Created Last 30 ================

2010-08-19 17:32:20 0 d—–w- c:\programas\Spybot - Search & Destroy
2010-08-19 17:32:20 0 d—–w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-08-19 17:04:18 0 d—–w- c:\docume~1\elmano\applic~1\TrojanHunter
2010-08-19 15:55:55 0 d—–w- c:\docume~1\alluse~1\applic~1\TrojanHunter
2010-08-19 15:55:49 0 d—–w- c:\programas\TrojanHunter 5.3
2010-08-18 13:34:44 0 d—–w- c:\programas\World of Warcraft
2010-08-18 13:11:01 0 d—–w- c:\docume~1\elmano\applic~1\Avira
2010-08-02 19:10:00 0 d—–w- c:\programas\Zultrax P2P
2010-08-02 18:05:13 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-08-02 18:02:40 0 d—–r- c:\programas\Skype
2010-08-01 15:55:46 0 d—–w- c:\programas\Garena
2010-07-29 01:07:35 4958588 —-a-w- c:\windows\{00000001-00000000-00000000-00001102-00000004-20011102}.BAK
2010-07-28 11:23:52 93167 —-a-w- c:\windows\War3Unin.dat
2010-07-28 11:23:51 2829 —-a-w- c:\windows\War3Unin.pif
2010-07-28 11:23:51 139264 —-a-w- c:\windows\War3Unin.exe
2010-07-25 10:01:02 0 d—–w- c:\programas\Avira
2010-07-25 10:01:02 0 d—–w- c:\docume~1\alluse~1\applic~1\Avira

==================== Find3M ====================

2010-08-19 19:03:59 74648 —-a-w- c:\windows\system32\perfc016.dat
2010-08-19 19:03:59 453628 —-a-w- c:\windows\system32\perfh016.dat
2010-06-17 11:48:36 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-05-31 11:24:03 87608 —-a-w- c:\docume~1\elmano\applic~1\inst.exe
2010-05-31 11:24:03 47360 —-a-w- c:\docume~1\elmano\applic~1\pcouffin.sys
2008-03-09 06:25:10 236 —ha-w- c:\programas\ficheiros comuns\dx.reg

============= FINISH: 13:50:30,06 ===============


ATTACH.TXT FILE

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 29-03-2008 9:10:27
System Uptime: 23-08-2010 13:09:27 (0 hours ago)

Motherboard: ASUSTeK Computer INC. | | P5GC-MX/1333
Processor: Processador Intel Pentium III Xeon | LGA 775 | 2599/200mhz
Processor: Processador Intel Pentium III Xeon | LGA 775 | 2600/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 49 GiB total, 14,974 GiB free.
D: is FIXED (NTFS) - 249 GiB total, 211,267 GiB free.
E: is CDROM ()
F: is FIXED (NTFS) - 466 GiB total, 461,02 GiB free.

==== Disabled Device Manager Items =============

Class GUID:
Description: Audio Device on High Definition Audio Bus
Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0883&SUBSYS_10438249&REV_1000\4&1F02D6B7&0&0001
Manufacturer:
Name: Audio Device on High Definition Audio Bus
PNP Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0883&SUBSYS_10438249&REV_1000\4&1F02D6B7&0&0001
Service:

Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Teclado padrão de 101 ou 102 teclas ou Microsoft Natural PS/2
Device ID: ACPI\PNP0303\4&2C575ACB&0
Manufacturer: (Teclados padrão)
Name: Teclado padrão de 101 ou 102 teclas ou Microsoft Natural PS/2
PNP Device ID: ACPI\PNP0303\4&2C575ACB&0
Service: i8042prt

Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318}
Description: AYXRW92W IDE Controller
Device ID: ACPI\PNPA000\4&5D18F2DF&0
Manufacturer: Fabricante desconhecido
Name: AYXRW92W IDE Controller
PNP Device ID: ACPI\PNPA000\4&5D18F2DF&0
Service: aefuyfk9

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Ad-Aware
Ad-Aware Email Scanner for Outlook
µTorrent
Avira AntiVir Personal - Free Antivirus
BearShare
Cheat Engine 5.6.1
Garena 2010
HiJackThis
Lavasoft VX2 Cleaner
Messenger Plus! Live
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.8)
Skype Toolbars
Skype™ 4.2
Spybot - Search & Destroy
Steam
TeamSpeak 3 Client
TrojanHunter 5.3
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Warcraft III: All Products
Windows Live OneCare safety scanner
World of Warcraft
Zultrax P2P

==== End Of File ===========================

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-23 14:47:54
Windows 5.1.2600 Service Pack 2
Running: iulr8omb.exe; Driver: C:\DOCUME~1\elmano\DEFINI~1\Temp\axrcafoc.sys


—- System - GMER 1.0.15 —-

SSDT BA6A3156 ZwCreateKey
SSDT BA6A314C ZwCreateThread
SSDT BA6A315B ZwDeleteKey
SSDT BA6A3165 ZwDeleteValueKey
SSDT spox.sys ZwEnumerateKey [0xB9ECDDA4]
SSDT spox.sys ZwEnumerateValueKey [0xB9ECE132]
SSDT BA6A316A ZwLoadKey
SSDT spox.sys ZwOpenKey [0xB9EB50C0]
SSDT BA6A3138 ZwOpenProcess
SSDT BA6A313D ZwOpenThread
SSDT spox.sys ZwQueryKey [0xB9ECE20A]
SSDT spox.sys ZwQueryValueKey [0xB9ECE08A]
SSDT BA6A3174 ZwReplaceKey
SSDT BA6A316F ZwRestoreKey
SSDT BA6A3160 ZwSetValueKey

INT 0x62 ? 8A814BF8
INT 0x63 ? 8A814BF8
INT 0x73 ? 8A618BF8
INT 0x73 ? 8A618BF8
INT 0x82 ? 8A814BF8
INT 0x94 ? 8A618BF8

—- Kernel code sections - GMER 1.0.15 —-

? spox.sys O sistema não conseguiu localizar o ficheiro especificado. !
.text USBPORT.SYS!DllUnload B8E8B62C 5 Bytes JMP 8A6181D8

—- User code sections - GMER 1.0.15 —-

.text C:\Programas\Mozilla Firefox\firefox.exe[2612] ntdll.dll!LdrLoadDll 7C9261CA 5 Bytes JMP 004013F0 C:\Programas\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Programas\Mozilla Firefox\plugin-container.exe[2996] USER32.dll!TrackPopupMenu 77D64F16 5 Bytes JMP 1044721D C:\Programas\Mozilla Firefox\xul.dll (Mozilla Foundation)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A8131F8
Device \FileSystem\Fastfat \FatCdrom 8A3F4378
Device \Driver\NetBT \Device\NetBT_Tcpip_{72FAEDD0-6CCC-4295-8221-887977840B99} 89819500
Device \Driver\usbuhci \Device\USBPDO-0 8A6161F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A8841F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A8841F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A8841F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A8841F8
Device \Driver\usbuhci \Device\USBPDO-1 8A6161F8
Device \Driver\usbuhci \Device\USBPDO-2 8A6161F8
Device \Driver\usbuhci \Device\USBPDO-3 8A6161F8
Device \Driver\usbehci \Device\USBPDO-4 8A5DF1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A8151F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A8151F8
Device \Driver\Cdrom \Device\CdRom0 8A57A1F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A8151F8
Device \Driver\atapi \Device\Ide\IdePort0 8A8141F8
Device \Driver\atapi \Device\Ide\IdePort1 8A8141F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-e 8A8141F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-6 8A8141F8
Device \Driver\atapi \Device\Ide\IdePort2 8A8141F8
Device \Driver\atapi \Device\Ide\IdePort3 8A8141F8
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-19 8A8141F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 89819500
Device \Driver\NetBT \Device\NetbiosSmb 89819500
Device \Driver\usbuhci \Device\USBFDO-0 8A6161F8
Device \Driver\usbuhci \Device\USBFDO-1 8A6161F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 894DE1F8
Device \Driver\usbuhci \Device\USBFDO-2 8A6161F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 894DE1F8
Device \Driver\usbuhci \Device\USBFDO-3 8A6161F8
Device \Driver\usbehci \Device\USBFDO-4 8A5DF1F8
Device \Driver\Ftdisk \Device\FtControl 8A8151F8
Device \FileSystem\Fastfat \Fat 8A3F4378

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 895F31F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programas\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x68 0xC6 0x0D 0xA8 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x77 0xB8 0x14 0xD8 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEB 0x15 0xD9 0x6B …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programas\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x68 0xC6 0x0D 0xA8 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x77 0xB8 0x14 0xD8 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEB 0x15 0xD9 0x6B …
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 …
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 …
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 …
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 …
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 …
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 …
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 …
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B …
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xB2 0x46 0x9A 0xE2 …
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 …
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 …
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E …

—- EOF - GMER 1.0.15 —-
Post #5
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #6
ComboFix 10-08-23.02 - elmano 24-08-2010 12:11:46.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.351.2070.18.2039.1298 [GMT 1:00]
Executando de: c:\documents and settings\elmano\Ambiente de trabalho\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((( Arquivos/Ficheiros criados de 2010-07-24 to 2010-08-24 ))))))))))))))))))))))))))))
.

2010-08-20 12:10 . 2010-08-20 12:10 388096 —-a-r- c:\documents and settings\elmano\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-19 17:32 . 2010-08-19 17:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-19 17:32 . 2010-08-19 17:32 ——– d—–w- c:\programas\Spybot - Search & Destroy
2010-08-19 17:04 . 2010-08-19 17:04 ——– d—–w- c:\documents and settings\elmano\Application Data\TrojanHunter
2010-08-19 15:55 . 2010-08-19 15:56 ——– d—–w- c:\documents and settings\All Users\Application Data\TrojanHunter
2010-08-19 15:55 . 2010-08-19 17:38 ——– d—–w- c:\programas\TrojanHunter 5.3
2010-08-18 13:34 . 2010-08-19 19:01 ——– d—–w- c:\programas\World of Warcraft
2010-08-18 13:11 . 2010-08-18 13:11 ——– d—–w- c:\documents and settings\elmano\Application Data\Avira
2010-08-15 10:35 . 2010-08-15 10:35 503808 —-a-w- c:\documents and settings\elmano\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-26fdfc4a-n\msvcp71.dll
2010-08-15 10:35 . 2010-08-15 10:35 499712 —-a-w- c:\documents and settings\elmano\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-26fdfc4a-n\jmc.dll
2010-08-15 10:35 . 2010-08-15 10:35 348160 —-a-w- c:\documents and settings\elmano\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-26fdfc4a-n\msvcr71.dll
2010-08-15 10:35 . 2010-08-15 10:35 61440 —-a-w- c:\documents and settings\elmano\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5ec71046-n\decora-sse.dll
2010-08-15 10:35 . 2010-08-15 10:35 12800 —-a-w- c:\documents and settings\elmano\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5ec71046-n\decora-d3d.dll
2010-08-02 19:10 . 2010-08-02 19:10 ——– d—–w- c:\programas\Zultrax P2P
2010-08-02 18:05 . 2010-08-24 08:29 ——– d—–w- c:\documents and settings\elmano\Application Data\skypePM
2010-08-02 18:05 . 2010-08-02 18:05 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-08-02 18:03 . 2010-08-24 08:30 ——– d—–w- c:\documents and settings\elmano\Application Data\Skype
2010-08-02 18:02 . 2010-08-02 18:02 ——– d—–w- c:\programas\Ficheiros comuns\Skype
2010-08-02 18:02 . 2010-08-02 18:03 ——– d—–r- c:\programas\Skype
2010-08-02 18:02 . 2010-08-02 18:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-08-01 15:55 . 2010-08-03 11:40 ——– d—–w- c:\programas\Garena
2010-07-28 11:23 . 2010-08-01 19:43 93167 —-a-w- c:\windows\War3Unin.dat
2010-07-28 11:23 . 2010-07-28 11:38 2829 —-a-w- c:\windows\War3Unin.pif
2010-07-28 11:23 . 2010-07-28 11:38 139264 —-a-w- c:\windows\War3Unin.exe
2010-07-28 11:22 . 2010-08-21 11:47 ——– d—–w- c:\programas\Warcraft III

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-24 08:29 . 2010-07-15 12:12 ——– d—–w- c:\programas\Steam
2010-08-19 19:03 . 2001-11-20 12:00 74648 —-a-w- c:\windows\system32\perfc016.dat
2010-08-19 19:03 . 2001-11-20 12:00 453628 —-a-w- c:\windows\system32\perfh016.dat
2010-08-19 15:38 . 2010-05-28 18:41 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-08-18 17:46 . 2009-05-20 19:19 ——– d—–w- c:\documents and settings\elmano\Application Data\MessengerDiscovery 2
2010-08-18 13:56 . 2010-02-25 16:53 ——– d—–w- c:\programas\Ficheiros comuns\Blizzard Entertainment
2010-08-01 01:48 . 2008-03-30 18:45 ——– d—–w- c:\documents and settings\elmano\Application Data\uTorrent
2010-07-27 16:09 . 2009-11-08 10:43 ——– d—–w- c:\programas\uTorrent
2010-07-25 10:01 . 2010-07-25 10:01 ——– d—–w- c:\programas\Avira
2010-07-25 10:01 . 2010-07-25 10:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-07-22 20:44 . 2009-03-17 22:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-07-22 20:43 . 2009-03-17 21:58 ——– d—–w- c:\programas\Messenger Plus! Live
2010-07-19 18:00 . 2010-07-20 15:43 52224 —-a-w- c:\documents and settings\elmano\Application Data\Mozilla\Firefox\Profiles\uguuuywf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-07-19 18:00 . 2010-07-20 15:43 101376 —-a-w- c:\documents and settings\elmano\Application Data\Mozilla\Firefox\Profiles\uguuuywf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-07-15 14:48 . 2010-07-15 13:09 ——– d—–w- c:\documents and settings\elmano\Application Data\The Creative Assembly
2010-07-13 22:03 . 2010-07-13 20:38 ——– d—–w- c:\programas\Cheat Engine
2010-07-11 21:50 . 2010-07-11 21:50 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{5DC61E80-2EE3-42C7-B265-E6961CD9C66E}
2010-07-11 21:50 . 2010-07-11 21:50 ——– d—–w- c:\documents and settings\All Users\Application Data\BearShare
2010-07-11 21:50 . 2010-07-11 21:50 ——– d—–w- c:\programas\BearShare Applications
2010-07-07 16:58 . 2010-02-26 00:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-07-06 14:24 . 2009-01-20 18:43 ——– d—–w- c:\documents and settings\elmano\Application Data\mIRC
2010-06-22 10:53 . 2010-07-11 21:50 3437908 -c–a-w- c:\documents and settings\All Users\Application Data\{5DC61E80-2EE3-42C7-B265-E6961CD9C66E}\BearShare_V9_pt_Setup.exe
2010-06-17 11:48 . 2010-07-05 12:09 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-06-07 11:47 . 2010-05-31 11:45 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-31 11:45 . 2010-05-31 11:45 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-31 11:24 . 2008-03-30 18:18 47360 —-a-w- c:\documents and settings\elmano\Application Data\pcouffin.sys
2010-05-31 11:24 . 2008-03-30 18:18 47360 —-a-w- c:\documents and settings\elmano\Application Data\pcouffin.sys
2008-03-09 06:25 . 2009-04-18 22:34 236 —ha-w- c:\programas\Ficheiros comuns\dx.reg
.

——- Sigcheck ——-

[7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-03 . 6A603809F598332DBEDD535BDBCE313E . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\programas\Steam\Steam.exe" [2010-08-24 1242448]
"Skype"="c:\programas\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2008-06-27 19456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"SunJavaUpdateSched"="c:\programas\Ficheiros comuns\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Share-to-Web Namespace Daemon"="c:\programas\Scanner\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"avgnt"="c:\programas\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"THGuard"="c:\programas\TrojanHunter 5.3\THGuard.exe" [2010-06-16 1070296]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Arranque\
Microsoft Office.lnk - c:\programas\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\elmano\\Definições locais\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Programas\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Programas\\Softnyx\\RakionIS\\Bin\\rakion.bin"=
"c:\\Programas\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Programas\\MessengerDiscovery 2\\MessengerDiscovery 2.exe"=
"c:\\Programas\\World of Warcraft\\Launcher.exe"=
"c:\\Programas\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Programas\\Avira\\AntiVir Desktop\\update.exe"=
"c:\\Programas\\Ventrilo\\Ventrilo.exe"=
"c:\\Programas\\uTorrent\\uTorrent.exe"=
"c:\\Programas\\Java\\jre6\\bin\\java.exe"=
"c:\\Programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\elmano\\Os meus documentos\\mIRC\\mirc.exe"=
"c:\\Programas\\World of Warcraft\\WoW-3.2.0-enGB-downloader.exe"=
"c:\\Programas\\BearShare Applications\\BearShare\\BearShare.exe"=
"c:\\Programas\\Steam\\Steam.exe"=
"c:\\Programas\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programas\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"45654:TCP"= 45654:TCP:lala
"45654:UDP"= 45654:UDP:ok
"3724:TCP"= 3724:TCP:wow 1
"8086:TCP"= 8086:TCP:wow 2
"8087:TCP"= 8087:TCP:wow 3
"9081:TCP"= 9081:TCP:wow 4
"9090:TCP"= 9090:TCP:wow 5
"9097:TCP"= 9097:TCP:wow 6
"9100:TCP"= 9100:TCP:wow 7
"3724:UDP"= 3724:UDP:bliz1
"6112:TCP"= 6112:TCP:bliz3
"86:TCP"= 86:TCP:BroadCam Web Server
"6667:UDP"= 6667:UDP:455454
"7777:TCP"= 7777:TCP:7777
"7777:UDP"= 7777:UDP:5
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"8118:TCP"= 8118:TCP:5
"9050:TCP"= 9050:TCP:9050
"6999:TCP"= 6999:TCP:6881
"6881:TCP"= 6881:TCP:h
"57957:TCP"= 57957:TCP:Pando Media Booster
"57957:UDP"= 57957:UDP:Pando Media Booster
"57893:TCP"= 57893:TCP:Pando Media Booster
"57893:UDP"= 57893:UDP:Pando Media Booster

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [31-05-2010 12:45 64288]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programas\Avira\AntiVir Desktop\sched.exe [25-07-2010 11:01 135336]
R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\pfmodnt.sys [07-07-2008 11:37 15896]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [27-06-2008 20:21 99352]
R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [27-06-2008 20:21 555032]
R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [27-06-2008 20:21 566296]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\programas\Lavasoft\Ad-Aware\AAWService.exe" –> c:\programas\Lavasoft\Ad-Aware\AAWService.exe [?]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [27-06-2008 20:21 99352]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [27-06-2008 20:21 555032]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [27-06-2008 20:21 100888]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [27-06-2008 20:21 100888]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [27-06-2008 20:21 566296]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\elmano\DEFINI~1\Temp\TPL67.tmp –> c:\docume~1\elmano\DEFINI~1\Temp\TPL67.tmp [?]
S3 NUVision;Studio OnLine;c:\windows\system32\drivers\Nuvision.sys [09-02-2009 22:51 136352]
S3 PbsAuDrv;PolderbitS Audio Driver;c:\windows\system32\drivers\pbsaudrv.sys –> c:\windows\system32\drivers\pbsaudrv.sys [?]
S3 XDva098;XDva098;\??\c:\windows\system32\XDva098.sys –> c:\windows\system32\XDva098.sys [?]
S3 XDva143;XDva143;\??\c:\windows\system32\XDva143.sys –> c:\windows\system32\XDva143.sys [?]
S3 XDva189;XDva189;\??\c:\windows\system32\XDva189.sys –> c:\windows\system32\XDva189.sys [?]
S3 XDva195;XDva195;\??\c:\windows\system32\XDva195.sys –> c:\windows\system32\XDva195.sys [?]
S3 XDva208;XDva208;\??\c:\windows\system32\XDva208.sys –> c:\windows\system32\XDva208.sys [?]
S3 XDva219;XDva219;\??\c:\windows\system32\XDva219.sys –> c:\windows\system32\XDva219.sys [?]
S3 XDva224;XDva224;\??\c:\windows\system32\XDva224.sys –> c:\windows\system32\XDva224.sys [?]
S3 XDva238;XDva238;\??\c:\windows\system32\XDva238.sys –> c:\windows\system32\XDva238.sys [?]
S3 XDva248;XDva248;\??\c:\windows\system32\XDva248.sys –> c:\windows\system32\XDva248.sys [?]
S3 XDva273;XDva273;\??\c:\windows\system32\XDva273.sys –> c:\windows\system32\XDva273.sys [?]
S3 XDva280;XDva280;\??\c:\windows\system32\XDva280.sys –> c:\windows\system32\XDva280.sys [?]
S3 XDva281;XDva281;\??\c:\windows\system32\XDva281.sys –> c:\windows\system32\XDva281.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03-12-2009 20:21 691696]
.
.
——- Scan Suplementar ——-
.
uStart Page = hxxp://eu.ask.com?o=15161&l=dis
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}
FF - ProfilePath - c:\documents and settings\elmano\Application Data\Mozilla\Firefox\Profiles\uguuuywf.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - www.google.pt
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\elmano\Application Data\Mozilla\Firefox\Profiles\uguuuywf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\elmano\Application Data\Mozilla\Firefox\Profiles\uguuuywf.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\programas\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\programas\AdobeReader 8.0\Reader\browser\nppdf32.dll
FF - plugin: c:\programas\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programas\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programas\Mozilla Firefox\plugins\npdeployJava1.dll

—- FIREFOX POLICIES —-
c:\programas\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programas\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programas\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-24 12:15
Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?

Procurando ficheiros/arquivos ocultos …

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\elmano\DEFINI~1\Temp\TPL67.tmp"
.
——————— CHAVES DO REGISTRO BLOQUEADAS ———————

[HKEY_USERS\S-1-5-21-329068152-412668190-1417001333-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:b4,c4,fe,55,63,c4,3b,dc,e9,68,90,90,43,56,74,5a,17,99,b1,ee,5b,8b,30,
0d,14,c6,f3,46,9b,67,98,0c,4f,42,73,7e,7a,36,7d,ef,a4,c9,c6,ae,33,1a,41,ed,\
"??"=hex:89,67,6e,22,9b,a6,95,48,9c,83,98,ac,66,83,bc,13
.
——————— DLLs Carregadas Sob os Processos em Execução ———————

- - - - - - - > 'explorer.exe'(332)
c:\windows\system32\msi.dll
.
Tempo para conclusão: 2010-08-24 12:16:27
ComboFix-quarantined-files.txt 2010-08-24 11:16
ComboFix2.txt 2010-08-24 08:36
ComboFix3.txt 2010-05-28 18:40

Pré-execução: 16.130.650.112 bytes livres
Pós execução: 16.118.571.008 bytes livres

- - End Of File - - 0588245BA2F607C637F728395419614C
Post #7
Hi,

Please do the following

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so.

NEXT

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner:
1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #8
I just got two blue screens so I couldn't finish Kaspersky Online Scanner 7 yet. Perhaps I need to re-install Windows? What should I do? Log here: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Versão da base de dados: 4475 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 25-08-2010 16:02:40 mbam-log-2010-08-25 (16-02-40).txt Tipo de pesquisa: Completa (C:\|D:\|F:\|) Objectos verificados: 175345 Tempo decorrido: 14 minuto(s), 43 segundo(s) Processos de memória infectados: 0 módulos de Memória infectados: 0 Chaves do Registo Infectadas: 4 Valores do Registo infectados: 0 Itens de dados do Registo Infectados: 0 Pastas Infectadas: 0 Ficheiros Infectados: 7 Processos de memória infectados: (Nenhum item malicioso detectado) módulos de Memória infectados: (Nenhum item malicioso detectado) Chaves do Registo Infectadas: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. Valores do Registo infectados: (Nenhum item malicioso detectado) Itens de dados do Registo Infectados: (Nenhum item malicioso detectado) Pastas Infectadas: (Nenhum item malicioso detectado) Ficheiros Infectados: C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjBlackOut3.exe (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjBlackOut4.exe (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjBluescreen.exe (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjDAC2_1280.exe (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjDenon4500.exe (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjDenonDNS1200.exe (Rootkit.Agent) -> Quarantined and deleted successfully. C:\Programas\Digital1Audio PCDJ\PCDJ VJ\PCDJ_DEX_Skin_pcdjRmix.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
Post #9
It's entirely your choice if you decide to reformat, your machine did have some nasty infections as you can see,

You should change all your online passwords as a precaution.

Try this scanner instead:

**Vista users - right click on the IE icon and run as administrator

Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.
Post #10
——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, August 25, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, August 25, 2010 16:59:29 Records in database: 4142741 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ Scan statistics: Objects scanned: 45829 Threats found: 1 Infected objects found: 2 Suspicious objects found: 0 Scan duration: 01:06:06 File name / Threat / Threats count C:\Documents and Settings\elmano\Os meus documentos\mIRC\backups\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1 C:\Documents and Settings\elmano\Os meus documentos\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1 Selected area has been scanned. Finished it. Should I re-install IE to do that scan now? Dad wants me to re-install Windows on the next blue screen.
Post #11
Hi,

make sure your java is up to date and all older versions are removed,

update adbobe reader

There doesn't appear to be any remaining malware on your system. How is it running?

Are there any outstanding issues?

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
  • Scroll down to where it says Java Runtime Environment (JRE) 6 Update 21 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
  • Click the Download button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
  • Click Continue The page will refresh.
  • Click on the link to download Windows Offline Installation and Save the file to your Desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java.
  • Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java™ SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586-p.exe to install the newest version.
  • After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button.
    • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window. Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
  • Click OK to leave the Temporary Files Window.
  • Click OK to leave the Java Control Panel.
  • Delete jre-6u21-windows-i586-p.exe from your desktop.



Try doing a defrag on your system and clean out all the temporary files;


Download and run this program Auslogics Disk Defragmenter

Be certain to watch for, and say NO to the installation of the ASK toolbar as Auslogics is installing.

NEXT

Please download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should reboot your machine, if not, manually reboot to ensure a complete clean

Please let me know how things are running now.
Post #13
Try this program:

Please download JavaRa to your desktop and unzip it to its own folder.
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
  • Scroll down to the Java SE Runtime Environment (JRE) option.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 21)
Post #14
My problems are mostly slow downloads, slow video loading and random lag spike and disconnects on World of Warcraft. My MSN disconnects too sometimes, twice yesterday night. Right now videos seem to load faster, I will also be away until Sunday/Monday, not sure.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI