API tools faq
paste
Advertisement
Atenevir

Relatório ComboFix

Atenevir
May 26th, 2012
74
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 22.30 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 12-05-26.02 - Jonathas 26/05/2012 18:55:29.1.2 - x64
  2. Microsoft Windows 7 Ultimate 6.1.7601.1.1252.55.1046.18.4093.2729 [GMT -3:00]
  3. Executando de: c:\users\Jonathas\Desktop\ComboFix.exe
  4. AV: Kaspersky Internet Security *Disabled/Outdated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
  5. AV: Kaspersky Internet Security *Enabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
  6. FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
  7. SP: Kaspersky Internet Security *Disabled/Outdated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
  8. SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
  9. SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  10. .
  11. [i] ADS - drivers: deleted 514 bytes in 1 streams. [/i]
  12. .
  13. (((((((((((((((( Arquivos/Ficheiros criados de 2012-04-26 to 2012-05-26 ))))))))))))))))))))))))))))
  14. .
  15. .
  16. 2012-05-26 22:24 . 2012-05-26 22:24 -------- d-----w- c:\users\Default\AppData\Local\temp
  17. 2012-05-26 22:18 . 2012-05-26 22:18 0 ----a-w- c:\windows\SysWow64\drivers\ati2xhxx.sys
  18. 2012-05-26 00:09 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{34FF574A-8BA6-4C7A-9742-A33F3A9E4BFF}\mpengine.dll
  19. 2012-05-23 23:43 . 2012-05-23 23:47 -------- d-----w- C:\LinhaDefensiva
  20. 2012-05-23 23:43 . 2012-05-23 23:22 178597 ----a-w- C:\bankerfix.exe
  21. 2012-05-23 22:24 . 2012-05-23 22:24 302592 ----a-w- c:\windows\SysWow64\cmd.execf
  22. 2012-05-23 22:09 . 2012-05-23 22:09 24576 ----a-w- c:\windows\SysWow64\VundoFixSVC.exe
  23. 2012-05-23 14:59 . 2012-05-23 14:59 18904 ----a-w- C:\cc_20120523_115905.reg
  24. 2012-05-20 21:14 . 2012-03-02 19:02 34304 ----a-w- c:\windows\system32\drivers\lgandmodem64.sys
  25. 2012-05-20 21:14 . 2012-03-02 19:02 27648 ----a-w- c:\windows\system32\drivers\lganddiag64.sys
  26. 2012-05-20 21:14 . 2012-03-02 19:02 27136 ----a-w- c:\windows\system32\drivers\lgandgps64.sys
  27. 2012-05-20 21:14 . 2012-03-02 19:02 19456 ----a-w- c:\windows\system32\drivers\lgandbus64.sys
  28. 2012-05-20 21:14 . 2012-05-20 21:14 -------- d-----w- c:\program files (x86)\LG Electronics
  29. 2012-05-19 03:26 . 2012-05-20 17:36 -------- d-----w- C:\LGP698F
  30. 2012-05-19 03:24 . 2011-05-10 16:37 655872 ----a-w- c:\windows\SysWow64\msvcr90.dll
  31. 2012-05-19 03:24 . 2011-05-10 16:37 568832 ----a-w- c:\windows\SysWow64\msvcp90.dll
  32. 2012-05-19 03:24 . 2011-05-10 16:37 224768 ----a-w- c:\windows\SysWow64\msvcm90.dll
  33. 2012-05-19 03:24 . 2006-05-04 11:33 53248 ----a-w- c:\windows\SysWow64\CommonDL.dll
  34. 2012-05-19 03:24 . 2005-10-04 04:39 44544 ----a-w- c:\windows\SysWow64\msxml4a.dll
  35. 2012-05-19 03:24 . 2012-05-20 21:06 -------- d-----w- c:\programdata\LGMOBILEAX
  36. 2012-05-17 11:30 . 2012-05-17 11:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
  37. 2012-05-17 11:30 . 2012-04-04 18:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
  38. 2012-05-16 00:53 . 2012-05-16 00:53 -------- d-----w- c:\program files\Microsoft Silverlight
  39. 2012-05-16 00:53 . 2012-05-16 00:53 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
  40. 2012-05-14 01:10 . 2012-05-14 01:10 -------- d-----w- c:\program files (x86)\NetSurveillance
  41. 2012-05-09 11:49 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
  42. 2012-05-09 11:49 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
  43. 2012-05-09 11:49 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
  44. 2012-05-09 11:48 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
  45. 2012-05-09 11:48 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
  46. 2012-05-09 11:48 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
  47. 2012-05-09 11:46 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
  48. 2012-05-09 11:46 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
  49. 2012-05-09 11:46 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
  50. 2012-05-09 11:46 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
  51. 2012-05-09 11:46 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
  52. 2012-05-09 11:46 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
  53. 2012-05-09 11:46 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
  54. .
  55. .
  56. .
  57. ((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
  58. .
  59. 2012-05-08 02:45 . 2012-03-29 23:03 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
  60. 2012-05-08 02:45 . 2011-10-03 01:51 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
  61. 2012-04-14 15:08 . 2012-03-29 23:09 8741536 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
  62. 2012-04-05 12:34 . 2011-10-03 01:54 46408 ----a-w- c:\windows\SysWow64\drivers\GbpKm.sys
  63. 2012-04-01 15:42 . 2012-04-01 15:42 4156 ----a-w- C:\cc_20120401_124241.reg
  64. 2012-03-01 06:46 . 2012-04-13 15:11 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
  65. 2012-03-01 06:38 . 2012-04-13 15:11 220672 ----a-w- c:\windows\system32\wintrust.dll
  66. 2012-03-01 06:33 . 2012-04-13 15:11 81408 ----a-w- c:\windows\system32\imagehlp.dll
  67. 2012-03-01 06:28 . 2012-04-13 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
  68. 2012-03-01 05:37 . 2012-04-13 15:11 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
  69. 2012-03-01 05:33 . 2012-04-13 15:11 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
  70. 2012-03-01 05:29 . 2012-04-13 15:11 5120 ----a-w- c:\windows\SysWow64\wmi.dll
  71. 2012-02-28 06:56 . 2012-04-13 15:14 2311168 ----a-w- c:\windows\system32\jscript9.dll
  72. 2012-02-28 06:49 . 2012-04-13 15:14 1390080 ----a-w- c:\windows\system32\wininet.dll
  73. 2012-02-28 06:48 . 2012-04-13 15:14 1493504 ----a-w- c:\windows\system32\inetcpl.cpl
  74. 2012-02-28 06:42 . 2012-04-13 15:15 2382848 ----a-w- c:\windows\system32\mshtml.tlb
  75. 2012-02-28 01:18 . 2012-04-13 15:14 1799168 ----a-w- c:\windows\SysWow64\jscript9.dll
  76. 2012-02-28 01:11 . 2012-04-13 15:14 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
  77. 2012-02-28 01:11 . 2012-04-13 15:14 1127424 ----a-w- c:\windows\SysWow64\wininet.dll
  78. 2012-02-28 01:03 . 2012-04-13 15:15 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
  79. .
  80. .
  81. (((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
  82. .
  83. .
  84. *Nota* entradas vazias e legítimas por padrão não são apresentadas.
  85. REGEDIT4
  86. .
  87. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  88. "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
  89. "AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2011-10-03 340520]
  90. "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
  91. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
  92. "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
  93. "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
  94. .
  95. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  96. "ConsentPromptBehaviorAdmin"= 0 (0x0)
  97. "ConsentPromptBehaviorUser"= 3 (0x3)
  98. "EnableLUA"= 0 (0x0)
  99. "EnableUIADesktopToggle"= 0 (0x0)
  100. "PromptOnSecureDesktop"= 0 (0x0)
  101. .
  102. [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
  103. "{E37CB5F0-51F5-4395-A808-5FA49E399008}"= "c:\progra~2\GbPlugin\gbiehUni.dll" [2011-12-20 732072]
  104. "{E37CB5F0-51F5-4395-A808-5FA49E399015}"= "c:\program files (x86)\GbPlugin\gbiehIsg.dll" [2011-10-21 694960]
  105. .
  106. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]
  107. 2012-05-09 12:01 1313864 ----a-w- c:\program files (x86)\GbPlugin\gbieh.dll
  108. .
  109. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginIsg]
  110. 2011-10-21 18:34 694960 ------w- c:\program files (x86)\GbPlugin\gbiehisg.dll
  111. .
  112. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginUni]
  113. 2011-12-20 17:32 732072 ----a-w- c:\progra~2\GbPlugin\gbiehuni.dll
  114. .
  115. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
  116. "mixer2"=wdmaud.drv
  117. .
  118. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  119. @="Driver"
  120. .
  121. [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
  122. "DisableMonitoring"=dword:00000001
  123. .
  124. R1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [x]
  125. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  126. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  127. R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
  128. R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
  129. R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
  130. R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
  131. R3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys [x]
  132. R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
  133. R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [x]
  134. R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [x]
  135. R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
  136. R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
  137. R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
  138. R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
  139. R3 sembbus;SEMC WMC Composite Device driver (WDM);c:\windows\system32\DRIVERS\sembbus.sys [x]
  140. R3 sembcard;Sony Ericsson PC300 Mobile Broadband Command Interface Drivers (WDM);c:\windows\system32\DRIVERS\sembcard.sys [x]
  141. R3 sembmdfl2;Sony Ericsson PC300 Wireless Modem Filter;c:\windows\system32\DRIVERS\sembmdfl2.sys [x]
  142. R3 sembmdm2;Sony Ericsson PC300 Wireless Modem Driver;c:\windows\system32\DRIVERS\sembmdm2.sys [x]
  143. R3 sembmgmt;Sony Ericsson PC300 Mobile Broadband Device Management Drivers (WDM);c:\windows\system32\DRIVERS\sembmgmt.sys [x]
  144. R3 sembnd5;Sony Ericsson PC300 Mobile Broadband Network Adapter SENECA (NDIS);c:\windows\system32\DRIVERS\sembnd5.sys [x]
  145. R3 sembunic;Sony Ericsson PC300 Mobile Broadband Network Adapter SENECA (WDM);c:\windows\system32\DRIVERS\sembunic.sys [x]
  146. R3 sembwwan;Sony Ericsson PC300 Mobile Broadband Ethernet Control Drivers (WDM);c:\windows\system32\DRIVERS\sembwwan.sys [x]
  147. R3 SEMCReserved;SEMC Reserved Interface;c:\windows\system32\DRIVERS\semcreserved64.sys [x]
  148. R3 Sony_EricssonWWSC;Sony Ericsson PC SC Port;c:\windows\system32\DRIVERS\seu4scard64.sys [x]
  149. R3 SPC530;Philips SPC530NC PC Camera;c:\windows\system32\drivers\SPC530.sys [x]
  150. R3 SPC530m;Philips SPC530NC PC Cameram;c:\windows\system32\drivers\SPC530m.sys [x]
  151. R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  152. R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
  153. R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
  154. R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
  155. R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
  156. R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [x]
  157. R3 VundoFixSvc;VundoFix Service;VundoFixSVC.exe [x]
  158. R3 WatAdminSvc;Serviço de Tecnologias de Ativação do Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
  159. R3 WSDPrintDevice;Suporte de Impressão WSD via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
  160. S0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\DRIVERS\klbg.sys [x]
  161. S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
  162. S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
  163. S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
  164. S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
  165. S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [2009-03-02 89600]
  166. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
  167. S2 GbpSv;Gbp Service;c:\progra~2\GbPlugin\GbpSv.exe [2012-05-09 214088]
  168. S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
  169. S2 iprip;RIP de Escuta;c:\windows\System32\svchost.exe [2009-07-14 27136]
  170. S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
  171. S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
  172. S2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2009-06-03 721712]
  173. S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
  174. S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
  175. S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
  176. S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x]
  177. S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
  178. S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
  179. S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
  180. S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
  181. .
  182. .
  183. --- =Outros Serviços/Drivers Na Memória ---
  184. .
  185. *NewlyCreated* - WS2IFSL
  186. .
  187. Conteúdo da pasta 'Tarefas Agendadas'
  188. .
  189. 2012-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3386592043-1472786982-427589051-1001Core.job
  190. - c:\users\Jonathas\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 01:52]
  191. .
  192. 2012-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3386592043-1472786982-427589051-1001UA.job
  193. - c:\users\Jonathas\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 01:52]
  194. .
  195. .
  196. --------- x86-64 -----------
  197. .
  198. .
  199. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  200. "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-07-21 610872]
  201. "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
  202. "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]
  203. "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
  204. "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]
  205. "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 660360]
  206. "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
  207. .
  208. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  209. "LoadAppInit_DLLs"=0x0
  210. .
  211. ------- Scan Suplementar -------
  212. .
  213. uLocal Page = c:\windows\system32\blank.htm
  214. uStart Page = hxxp://www.google.com.br/
  215. mLocal Page = c:\windows\SysWOW64\blank.htm
  216. IE: E&xportar para o Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
  217. Trusted Zone: bancobrasil.com.br\www
  218. Trusted Zone: bancobrasil.com.br\www14
  219. Trusted Zone: bancobrasil.com.br\www2
  220. Trusted Zone: bb.com.br\www
  221. Trusted Zone: caixa.gov.br
  222. Trusted Zone: caixa.gov.br\internetbanking
  223. TCP: DhcpNameServer = 10.1.1.1
  224. DPF: {7E866715-C9B6-4C64-AAB8-342E0D137213} - hxxp://10.1.100.7/EDVR.CAB
  225. DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} - hxxps://clickbanking.itau.com.br/itau/gbplugin/gbplugin2/cab/GbPluginUni.cab
  226. FF - ProfilePath - c:\users\Jonathas\AppData\Roaming\Mozilla\Firefox\Profiles\cetve9sy.default\
  227. FF - prefs.js: browser.search.selectedEngine - Google
  228. FF - prefs.js: browser.startup.homepage - www.google.com.br
  229. FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
  230. .
  231. - - - - ORFÃOS REMOVIDOS - - - -
  232. .
  233. Wow6432Node-HKCU-Run-AdobeBridge - (no file)
  234. Wow6432Node-HKCU-Run-PCSpeedUp - c:\program files (x86)\Velocidade Do PC\PCSpeedUp.lnk
  235. Notify- GbPluginCef - c:\program files (x86)\GbPlugin\gbiehCef.dll
  236. HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
  237. AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
  238. .
  239. .
  240. .
  241. --------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------
  242. .
  243. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  244. @Denied: (A 2) (Everyone)
  245. @="FlashBroker"
  246. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101"
  247. .
  248. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  249. "Enabled"=dword:00000001
  250. .
  251. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  252. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe"
  253. .
  254. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  255. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  256. .
  257. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  258. @Denied: (A 2) (Everyone)
  259. @="Shockwave Flash Object"
  260. .
  261. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  262. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"
  263. "ThreadingModel"="Apartment"
  264. .
  265. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  266. @="0"
  267. .
  268. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  269. @="ShockwaveFlash.ShockwaveFlash.11"
  270. .
  271. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  272. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"
  273. .
  274. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  275. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  276. .
  277. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  278. @="1.0"
  279. .
  280. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  281. @="ShockwaveFlash.ShockwaveFlash"
  282. .
  283. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  284. @Denied: (A 2) (Everyone)
  285. @="Macromedia Flash Factory Object"
  286. .
  287. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  288. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx"
  289. "ThreadingModel"="Apartment"
  290. .
  291. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  292. @="FlashFactory.FlashFactory.1"
  293. .
  294. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  295. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1"
  296. .
  297. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  298. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  299. .
  300. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  301. @="1.0"
  302. .
  303. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  304. @="FlashFactory.FlashFactory"
  305. .
  306. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  307. @Denied: (A 2) (Everyone)
  308. @="IFlashBroker4"
  309. .
  310. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  311. @="{00020424-0000-0000-C000-000000000046}"
  312. .
  313. [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  314. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  315. "Version"="1.0"
  316. .
  317. [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
  318. "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  319. 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
  320. .
  321. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  322. @Denied: (A) (Users)
  323. @Denied: (A) (Everyone)
  324. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  325. "BlindDial"=dword:00000000
  326. .
  327. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
  328. @Denied: (A) (Users)
  329. @Denied: (A) (Everyone)
  330. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  331. "BlindDial"=dword:00000000
  332. .
  333. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
  334. @Denied: (A) (Users)
  335. @Denied: (A) (Everyone)
  336. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  337. "BlindDial"=dword:00000000
  338. .
  339. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
  340. @Denied: (A) (Users)
  341. @Denied: (A) (Everyone)
  342. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  343. "BlindDial"=dword:00000000
  344. .
  345. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
  346. @Denied: (A) (Users)
  347. @Denied: (A) (Everyone)
  348. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  349. "BlindDial"=dword:00000000
  350. .
  351. [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
  352. @Denied: (Full) (Everyone)
  353. .
  354. ------------------------ Outros Processos em Execução ------------------------
  355. .
  356. c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
  357. c:\program files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
  358. c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
  359. c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
  360. c:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
  361. .
  362. **************************************************************************
  363. .
  364. Tempo para conclusão: 2012-05-26 21:03:25 - Máquina reiniciou
  365. ComboFix-quarantined-files.txt 2012-05-27 00:03
  366. .
  367. Pré-execução: 44.905.267.200 bytes disponíveis
  368. Pós execução: 44.207.144.960 bytes disponíveis
  369. .
  370. - - End Of File - - 28551F013DE271B7420B85F22CC30174
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!