API tools faq
paste
Advertisement
Atenevir

COMBOFIX - 28/05/12

Atenevir
May 28th, 2012
48
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.15 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 12-05-26.02 - Jonathas 28/05/2012 11:23:49.2.2 - x64
  2. Microsoft Windows 7 Ultimate 6.1.7601.1.1252.55.1046.18.4093.2849 [GMT -3:00]
  3. Executando de: c:\users\Jonathas\Desktop\ComboFix.exe
  4. Comandos utilizados :: c:\users\Jonathas\Desktop\CFScript.txt
  5. AV: Kaspersky Internet Security *Disabled/Outdated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
  6. AV: Kaspersky Internet Security *Disabled/Updated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
  7. FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
  8. SP: Kaspersky Internet Security *Disabled/Outdated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
  9. SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
  10. SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  11. * Criado um novo ponto de restauração
  12. .
  13. FILE ::
  14. "C:\cc_20120523_115905.reg"
  15. "c:\windows\SysWow64\cmd.execf"
  16. "c:\windows\SysWow64\VundoFixSVC.exe"
  17. .
  18. [i] ADS - drivers: deleted 410 bytes in 1 streams. [/i]
  19. .
  20. (((((((((((((((( Arquivos/Ficheiros criados de 2012-04-28 to 2012-05-28 ))))))))))))))))))))))))))))
  21. .
  22. .
  23. 2012-05-28 14:32 . 2012-05-28 14:32 -------- d-----w- c:\users\Default\AppData\Local\temp
  24. 2012-05-26 22:18 . 2012-05-26 22:18 0 ----a-w- c:\windows\SysWow64\drivers\ati2xhxx.sys
  25. 2012-05-26 00:09 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{34FF574A-8BA6-4C7A-9742-A33F3A9E4BFF}\mpengine.dll
  26. 2012-05-23 23:43 . 2012-05-23 23:47 -------- d-----w- C:\LinhaDefensiva
  27. 2012-05-23 23:43 . 2012-05-23 23:22 178597 ----a-w- C:\bankerfix.exe
  28. 2012-05-23 22:24 . 2012-05-23 22:24 302592 ----a-w- c:\windows\SysWow64\cmd.execf
  29. 2012-05-23 22:09 . 2012-05-23 22:09 24576 ----a-w- c:\windows\SysWow64\VundoFixSVC.exe
  30. 2012-05-23 14:59 . 2012-05-23 14:59 18904 ----a-w- C:\cc_20120523_115905.reg
  31. 2012-05-20 21:14 . 2012-03-02 19:02 34304 ----a-w- c:\windows\system32\drivers\lgandmodem64.sys
  32. 2012-05-20 21:14 . 2012-03-02 19:02 27648 ----a-w- c:\windows\system32\drivers\lganddiag64.sys
  33. 2012-05-20 21:14 . 2012-03-02 19:02 27136 ----a-w- c:\windows\system32\drivers\lgandgps64.sys
  34. 2012-05-20 21:14 . 2012-03-02 19:02 19456 ----a-w- c:\windows\system32\drivers\lgandbus64.sys
  35. 2012-05-20 21:14 . 2012-05-20 21:14 -------- d-----w- c:\program files (x86)\LG Electronics
  36. 2012-05-19 03:26 . 2012-05-20 17:36 -------- d-----w- C:\LGP698F
  37. 2012-05-19 03:24 . 2011-05-10 16:37 655872 ----a-w- c:\windows\SysWow64\msvcr90.dll
  38. 2012-05-19 03:24 . 2011-05-10 16:37 568832 ----a-w- c:\windows\SysWow64\msvcp90.dll
  39. 2012-05-19 03:24 . 2011-05-10 16:37 224768 ----a-w- c:\windows\SysWow64\msvcm90.dll
  40. 2012-05-19 03:24 . 2006-05-04 11:33 53248 ----a-w- c:\windows\SysWow64\CommonDL.dll
  41. 2012-05-19 03:24 . 2005-10-04 04:39 44544 ----a-w- c:\windows\SysWow64\msxml4a.dll
  42. 2012-05-19 03:24 . 2012-05-20 21:06 -------- d-----w- c:\programdata\LGMOBILEAX
  43. 2012-05-17 11:30 . 2012-05-17 11:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
  44. 2012-05-17 11:30 . 2012-04-04 18:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
  45. 2012-05-16 00:53 . 2012-05-16 00:53 -------- d-----w- c:\program files\Microsoft Silverlight
  46. 2012-05-16 00:53 . 2012-05-16 00:53 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
  47. 2012-05-14 01:10 . 2012-05-14 01:10 -------- d-----w- c:\program files (x86)\NetSurveillance
  48. 2012-05-09 11:49 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
  49. 2012-05-09 11:49 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
  50. 2012-05-09 11:49 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
  51. 2012-05-09 11:48 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
  52. 2012-05-09 11:48 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
  53. 2012-05-09 11:48 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
  54. 2012-05-09 11:46 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
  55. 2012-05-09 11:46 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
  56. 2012-05-09 11:46 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
  57. 2012-05-09 11:46 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
  58. 2012-05-09 11:46 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
  59. 2012-05-09 11:46 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
  60. 2012-05-09 11:46 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
  61. .
  62. .
  63. .
  64. ((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
  65. .
  66. 2012-05-08 02:45 . 2012-03-29 23:03 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
  67. 2012-05-08 02:45 . 2011-10-03 01:51 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
  68. 2012-04-14 15:08 . 2012-03-29 23:09 8741536 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
  69. 2012-04-05 12:34 . 2011-10-03 01:54 46408 ----a-w- c:\windows\SysWow64\drivers\GbpKm.sys
  70. 2012-04-01 15:42 . 2012-04-01 15:42 4156 ----a-w- C:\cc_20120401_124241.reg
  71. 2012-03-01 06:46 . 2012-04-13 15:11 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
  72. 2012-03-01 06:38 . 2012-04-13 15:11 220672 ----a-w- c:\windows\system32\wintrust.dll
  73. 2012-03-01 06:33 . 2012-04-13 15:11 81408 ----a-w- c:\windows\system32\imagehlp.dll
  74. 2012-03-01 06:28 . 2012-04-13 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
  75. 2012-03-01 05:37 . 2012-04-13 15:11 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
  76. 2012-03-01 05:33 . 2012-04-13 15:11 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
  77. 2012-03-01 05:29 . 2012-04-13 15:11 5120 ----a-w- c:\windows\SysWow64\wmi.dll
  78. .
  79. .
  80. ((((((((((((((((((((((((((((( SnapShot@2012-05-26_23.58.40 )))))))))))))))))))))))))))))))))))))))))
  81. .
  82. + 2011-10-03 01:28 . 2012-05-28 14:40 48518 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
  83. + 2009-07-14 05:10 . 2012-05-28 14:40 45024 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
  84. + 2011-10-03 00:08 . 2012-05-28 14:40 12956 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3386592043-1472786982-427589051-1001_UserData.bin
  85. - 2012-05-26 22:25 . 2012-05-26 22:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
  86. + 2012-05-28 14:33 . 2012-05-28 14:33 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
  87. - 2012-05-26 22:25 . 2012-05-26 22:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
  88. + 2012-05-28 14:33 . 2012-05-28 14:33 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
  89. - 2009-07-14 05:01 . 2012-05-26 22:24 532580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
  90. + 2009-07-14 05:01 . 2012-05-28 14:32 532580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
  91. + 2011-10-03 02:20 . 2012-05-28 14:32 13751031 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3386592043-1472786982-427589051-1001-12288.dat
  92. - 2011-10-03 02:20 . 2012-05-26 22:24 13751031 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3386592043-1472786982-427589051-1001-12288.dat
  93. .
  94. (((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
  95. .
  96. .
  97. *Nota* entradas vazias e legítimas por padrão não são apresentadas.
  98. REGEDIT4
  99. .
  100. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  101. "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
  102. "AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2011-10-03 340520]
  103. "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
  104. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
  105. "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
  106. "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
  107. .
  108. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  109. "ConsentPromptBehaviorAdmin"= 0 (0x0)
  110. "ConsentPromptBehaviorUser"= 3 (0x3)
  111. "EnableLUA"= 0 (0x0)
  112. "EnableUIADesktopToggle"= 0 (0x0)
  113. "PromptOnSecureDesktop"= 0 (0x0)
  114. .
  115. [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  116. "{E37CB5F0-51F5-4395-A808-5FA49E399008}"= "c:\progra~2\GbPlugin\gbiehUni.dll" [2011-12-20 732072]
  117. "{E37CB5F0-51F5-4395-A808-5FA49E399015}"= "c:\program files (x86)\GbPlugin\gbiehIsg.dll" [2011-10-21 694960]
  118. .
  119. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]
  120. 2012-05-09 12:01 1313864 ----a-w- c:\program files (x86)\GbPlugin\gbieh.dll
  121. .
  122. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginCef]
  123. c:\program files (x86)\GbPlugin\gbiehCef.dll [BU]
  124. .
  125. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginIsg]
  126. 2011-10-21 18:34 694960 ------w- c:\program files (x86)\GbPlugin\gbiehisg.dll
  127. .
  128. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginUni]
  129. 2011-12-20 17:32 732072 ----a-w- c:\progra~2\GbPlugin\gbiehuni.dll
  130. .
  131. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
  132. "mixer2"=wdmaud.drv
  133. .
  134. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  135. @="Driver"
  136. .
  137. [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
  138. "DisableMonitoring"=dword:00000001
  139. .
  140. R1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [x]
  141. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  142. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  143. R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
  144. R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
  145. R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
  146. R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
  147. R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys [x]
  148. R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
  149. R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [x]
  150. R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [x]
  151. R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
  152. R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
  153. R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
  154. R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
  155. R3 sembbus;SEMC WMC Composite Device driver (WDM);c:\windows\system32\DRIVERS\sembbus.sys [x]
  156. R3 sembcard;Sony Ericsson PC300 Mobile Broadband Command Interface Drivers (WDM);c:\windows\system32\DRIVERS\sembcard.sys [x]
  157. R3 sembmdfl2;Sony Ericsson PC300 Wireless Modem Filter;c:\windows\system32\DRIVERS\sembmdfl2.sys [x]
  158. R3 sembmdm2;Sony Ericsson PC300 Wireless Modem Driver;c:\windows\system32\DRIVERS\sembmdm2.sys [x]
  159. R3 sembmgmt;Sony Ericsson PC300 Mobile Broadband Device Management Drivers (WDM);c:\windows\system32\DRIVERS\sembmgmt.sys [x]
  160. R3 sembnd5;Sony Ericsson PC300 Mobile Broadband Network Adapter SENECA (NDIS);c:\windows\system32\DRIVERS\sembnd5.sys [x]
  161. R3 sembunic;Sony Ericsson PC300 Mobile Broadband Network Adapter SENECA (WDM);c:\windows\system32\DRIVERS\sembunic.sys [x]
  162. R3 sembwwan;Sony Ericsson PC300 Mobile Broadband Ethernet Control Drivers (WDM);c:\windows\system32\DRIVERS\sembwwan.sys [x]
  163. R3 SEMCReserved;SEMC Reserved Interface;c:\windows\system32\DRIVERS\semcreserved64.sys [x]
  164. R3 Sony_EricssonWWSC;Sony Ericsson PC SC Port;c:\windows\system32\DRIVERS\seu4scard64.sys [x]
  165. R3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [x]
  166. R3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [x]
  167. R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  168. R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
  169. R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
  170. R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
  171. R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
  172. R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [x]
  173. R3 VundoFixSvc;VundoFix Service;VundoFixSVC.exe [x]
  174. R3 WatAdminSvc;Serviço de Tecnologias de Ativação do Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
  175. R3 WSDPrintDevice;Suporte de Impressão WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
  176. S0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\DRIVERS\klbg.sys [x]
  177. S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
  178. S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
  179. S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
  180. S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
  181. S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [2009-03-02 89600]
  182. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
  183. S2 GbpSv;Gbp Service;c:\progra~2\GbPlugin\GbpSv.exe [2012-05-09 214088]
  184. S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
  185. S2 iprip;RIP de Escuta;c:\windows\System32\svchost.exe [2009-07-14 27136]
  186. S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
  187. S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
  188. S2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2009-06-03 721712]
  189. S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
  190. S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
  191. S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
  192. S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x]
  193. S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
  194. S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
  195. S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
  196. S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
  197. .
  198. .
  199. Conteúdo da pasta 'Tarefas Agendadas'
  200. .
  201. 2012-05-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3386592043-1472786982-427589051-1001Core.job
  202. - c:\users\Jonathas\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 01:52]
  203. .
  204. 2012-05-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3386592043-1472786982-427589051-1001UA.job
  205. - c:\users\Jonathas\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 01:52]
  206. .
  207. .
  208. --------- x86-64 -----------
  209. .
  210. .
  211. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  212. "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-07-21 610872]
  213. "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
  214. "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]
  215. "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
  216. "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
  217. "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]
  218. "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
  219. "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
  220. .
  221. ------- Scan Suplementar -------
  222. .
  223. uLocal Page = c:\windows\system32\blank.htm
  224. uStart Page = hxxp://www.google.com.br/
  225. mLocal Page = c:\windows\SysWOW64\blank.htm
  226. IE: E&xportar para o Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
  227. Trusted Zone: bancobrasil.com.br\www
  228. Trusted Zone: bancobrasil.com.br\www14
  229. Trusted Zone: bancobrasil.com.br\www2
  230. Trusted Zone: bb.com.br\www
  231. Trusted Zone: caixa.gov.br
  232. Trusted Zone: caixa.gov.br\internetbanking
  233. TCP: DhcpNameServer = 10.1.1.1
  234. DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} - hxxp://10.1.100.7/EDVR.CAB
  235. DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} - hxxps://clickbanking.itau.com.br/itau/gbplugin/gbplugin2/cab/GbPluginUni.cab
  236. FF - ProfilePath - c:\users\Jonathas\AppData\Roaming\Mozilla\Firefox\Profiles\cetve9sy.default\
  237. FF - prefs.js: browser.search.selectedEngine - Google
  238. FF - prefs.js: browser.startup.homepage - www.google.com.br
  239. FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
  240. .
  241. .
  242. --------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
  243. .
  244. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  245. @Denied: (A 2) (Everyone)
  246. @="FlashBroker"
  247. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101"
  248. .
  249. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  250. "Enabled"=dword:00000001
  251. .
  252. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  253. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe"
  254. .
  255. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  256. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  257. .
  258. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  259. @Denied: (A 2) (Everyone)
  260. @="Shockwave Flash Object"
  261. .
  262. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  263. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"
  264. "ThreadingModel"="Apartment"
  265. .
  266. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  267. @="0"
  268. .
  269. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  270. @="ShockwaveFlash.ShockwaveFlash.11"
  271. .
  272. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  273. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"
  274. .
  275. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  276. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  277. .
  278. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  279. @="1.0"
  280. .
  281. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  282. @="ShockwaveFlash.ShockwaveFlash"
  283. .
  284. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  285. @Denied: (A 2) (Everyone)
  286. @="Macromedia Flash Factory Object"
  287. .
  288. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  289. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"
  290. "ThreadingModel"="Apartment"
  291. .
  292. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  293. @="FlashFactory.FlashFactory.1"
  294. .
  295. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  296. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"
  297. .
  298. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  299. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  300. .
  301. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  302. @="1.0"
  303. .
  304. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  305. @="FlashFactory.FlashFactory"
  306. .
  307. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  308. @Denied: (A 2) (Everyone)
  309. @="IFlashBroker4"
  310. .
  311. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  312. @="{00020424-0000-0000-C000-000000000046}"
  313. .
  314. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  315. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  316. "Version"="1.0"
  317. .
  318. [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
  319. "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  320. 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
  321. .
  322. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  323. @Denied: (A) (Users)
  324. @Denied: (A) (Everyone)
  325. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  326. "BlindDial"=dword:00000000
  327. .
  328. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
  329. @Denied: (A) (Users)
  330. @Denied: (A) (Everyone)
  331. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  332. "BlindDial"=dword:00000000
  333. .
  334. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
  335. @Denied: (A) (Users)
  336. @Denied: (A) (Everyone)
  337. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  338. "BlindDial"=dword:00000000
  339. .
  340. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
  341. @Denied: (A) (Users)
  342. @Denied: (A) (Everyone)
  343. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  344. "BlindDial"=dword:00000000
  345. .
  346. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
  347. @Denied: (A) (Users)
  348. @Denied: (A) (Everyone)
  349. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  350. "BlindDial"=dword:00000000
  351. .
  352. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
  353. @Denied: (Full) (Everyone)
  354. .
  355. ------------------------ Outros Processos em Execução ------------------------
  356. .
  357. c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
  358. c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
  359. c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
  360. c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
  361. c:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
  362. .
  363. **************************************************************************
  364. .
  365. Tempo para conclusão: 2012-05-28 11:45:29 - Máquina reiniciou
  366. ComboFix-quarantined-files.txt 2012-05-28 14:45
  367. ComboFix2.txt 2012-05-27 00:03
  368. .
  369. Pré-execução: 47.982.735.360 bytes disponíveis
  370. Pós execução: 47.769.751.552 bytes disponíveis
  371. .
  372. - - End Of File - - 78A92809CBDD040CFDCC03F8009A3ECA
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!