ComboFix 12-01-27.04 - Micro 27/08/2012 1:10.1.

2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3327.2851 [GMT -3:
00]
Executando de: c:\documents and settings\Micro\Desktop\ComboFix.exe
.
ATENAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAO INSTALADO !!
.
.
(((((((((((((((( Arquivos/Ficheiros criados de 2012-07-27 to 2012-08-27 )))))
)))))))))))))))))))))))
.
.
2012-08-27 07:17 . 2012-08-27 07:17
-------d-----wc:\arqui
vos de programas\MSBuild
2012-08-27 07:17 . 2012-08-27 07:17
-------d-----wc:\docum
ents and settings\All Users\Microsoft
2012-08-27 07:17 . 2012-08-27 07:17
-------d-----wc:\arqui
vos de programas\Microsoft Sync Framework
2012-08-27 07:15 . 2012-08-27 07:17
-------d-----wc:\windo
ws\SHELLNEW
2012-08-27 07:15 . 2012-08-27 07:15
-------d-----wc:\arqui
vos de programas\Microsoft Analysis Services
2012-08-27 07:15 . 2012-08-27 07:18
-------d-----wc:\docum
ents and settings\All Users\Dados de aplicativos\Microsoft Help
2012-08-27 07:15 . 2012-08-27 07:15
-------d-----rC:\MSOCa
che
2012-08-27 07:08 . 2012-08-27 03:25
-------d-----wc:\arqui
vos de programas\ASRock
2012-08-27 07:07 . 2012-08-27 07:07
-------d-----wc:\docum
ents and settings\All Users\Dados de aplicativos\cFos
2012-08-27 06:53 . 2008-04-13 17:45
26368 -c--a-wc:\windows\syste
m32\dllcache\usbstor.sys
.
.
.
((((((((((((((((((((((((((((((((((((( Relatrio Find3M )))))))))))))))))))))))
)))))))))))))))))))))))))))))
.
.
.
------- Sigcheck ------Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-23 . 1D01C384F3BA123EB6F09769DEA005AC . 1571840 . . [5.1.2600.5512]
. . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))
)))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legtimas por padro no so apresentadas.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-06-0
1 33624064]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-14 13684736]
"nwiz"="nwiz.exe" [2009-04-14 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-14 86016]
.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Authoriz
edApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Arquivos de programas\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Arquivos de programas\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Arquivos de programas\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
.
R2 KMService;KMService;c:\windows\system32\srvany.exe [27/8/2012 04:20 8192]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system
32\drivers\viahduaa.sys [27/8/2012 00:24 1358720]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows
\system32\drivers\EagleXNt.sys [?]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace A
udit Service;c:\arquivos de programas\Microsoft Office\Office14\GROOVE.EXE [25/3
/2010 10:25 30969208]
S3 osppsvc;Office Software Protection Platform;c:\arquivos de programas\Arquivos
comuns\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9/1/2010
21:37 4640000]
.
.
------- Scan Suplementar ------.
uStart Page = hxxp://www.google.com.br/
uInternet Connection Wizard,ShellNext = hxxp://www.cfos.de/pt-br/traffic-shaping
/calibration-message.htm?reg-6.61.1880-asrock&tsa=
TCP: Interfaces\{EA6A0EE1-2ADE-4EFF-AA15-45E291BCA723}: NameServer = 192.168.0.5
0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http:/
/www.gmer.net
Rootkit scan 2012-08-27 01:12
Windows 5.1.2600 Service Pack 3 NTFS
.
Procurando processos ocultos ...
.
Procurando entradas auto inicializveis ocultas ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1?????????
???????????????????????????????????????????????
.
Procurando ficheiros/arquivos ocultos ...
.
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
.
**************************************************************************

.
--------------------- DLLs Carregadas Sob os Processos em Execuo -------------------.
- - - - - - - > 'explorer.exe'(1128)
c:\windows\system32\WININET.dll
c:\arquiv~1\ARQUIV~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\arquiv~1\MICROS~2\Office14\1046\GrooveIntlResource.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Tempo para concluso: 2012-08-27 01:12:46
ComboFix-quarantined-files.txt 2012-08-27 04:12
.
Pr-execuo: 4 pasta(s) 24.953.987.072 bytes disponveis
Ps execuo: 7 pasta(s) 25.010.778.112 bytes disponveis
.
- - End Of File - - 284736DB06C26D4E938DD7CD3277A06D