ComboFix 11-06-05.01 - Cliente 05/06/2011 14:28:19.3.

2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.1015.798 [GMT -3:0
0]
Executando de: c:\documents and settings\Cliente\Desktop\ComboFix.exe
.
ATENAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAO INSTALADO !!
.
.
(((((((((((((((( Arquivos/Ficheiros criados de 2011-05-05 to 2011-06-05 )))))
)))))))))))))))))))))))
.
.
.
.
.
((((((((((((((((((((((((((((((((((((( Relatrio Find3M )))))))))))))))))))))))
)))))))))))))))))))))))))))))
.
.
.
------- Sigcheck ------Note: Unsigned files aren't necessarily malware.
.
[-] 2010-09-23 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512]
. . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-06-05_15.24.42 )))))))))))))))))
))))))))))))))))))))))))
.
- 2008-04-14 11:00 . 2011-06-05 15:22 48846
c:\windows\system32\p
erfc016.dat
+ 2008-04-14 11:00 . 2011-06-05 17:31 48846
c:\windows\system32\p
erfc016.dat
- 2008-04-14 11:00 . 2011-06-05 15:22 40128
c:\windows\system32\p
erfc009.dat
+ 2008-04-14 11:00 . 2011-06-05 17:31 40128
c:\windows\system32\p
erfc009.dat
+ 2008-04-14 11:00 . 2011-06-05 17:31 344734
c:\windows\system32\
perfh016.dat
- 2008-04-14 11:00 . 2011-06-05 15:22 344734
c:\windows\system32\
perfh016.dat
+ 2008-04-14 11:00 . 2011-06-05 17:31 311740
c:\windows\system32\
perfh009.dat
- 2008-04-14 11:00 . 2011-06-05 15:22 311740
c:\windows\system32\
perfh009.dat
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))
)))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legtimas por padro no so apresentadas.
REGEDIT4
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43
69632 ------rc:\windows\Alcmtr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.E

XE]
2008-04-14 11:00
15360 ----a-wc:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysC
mds]
2006-10-05 13:13
114688 ----a-rc:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
]
2006-10-05 13:11
98304 ----a-rc:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-17 01:12
3872080 ----a-wc:\arquivos de programas\Windows
Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persiste
nce]
2006-10-05 13:10
94208 ----a-rc:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-04-10 07:28
16126464
------rc:\windows\RTHDCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2007-04-04 09:22
1822720 ------rc:\windows\SkyTel.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Authoriz
edApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Valve\\hl.exe"=
.
.
.
------- Scan Suplementar ------.
uStart Page = hxxp://www.google.com.br/search?hl=pt-BR&source=hp&biw=1259&bih=59
6&q=&btnI=Estou+com+sorte&oq=&aq=&aqi=&aql=&gs_sm=&gs_upl=
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3
000
TCP: Interfaces\{9521E79E-213D-4BF9-A6D0-A076402210B4}: NameServer = 192.168.254
.254
.
- - - - ORFOS REMOVIDOS - - - .
MSConfigStartUp-avgnt - d:\avira\AntiVir Desktop\avgnt.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http:/
/www.gmer.net
Rootkit scan 2011-06-05 14:32
Windows 5.1.2600 Service Pack 3 NTFS
.

Procurando processos ocultos ...

.
Procurando entradas auto inicializveis ocultas ...
.
Procurando ficheiros/arquivos ocultos ...
.
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
.
**************************************************************************
.
Tempo para concluso: 2011-06-05 14:34:38
ComboFix-quarantined-files.txt 2011-06-05 17:34
ComboFix2.txt 2011-06-05 16:50
ComboFix3.txt 2011-06-05 15:28
.
Pr-execuo: 5 pasta(s) 14.076.637.184 bytes disponveis
Ps execuo: 6 pasta(s) 14.075.269.120 bytes disponveis
.
- - End Of File - - B6A9E23CD884B005C2106B73AC2094FD