Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

virus from an wireless network?!


  • This topic is locked This topic is locked

#1
carol.lopes

carol.lopes

    Member

  • Member
  • PipPip
  • 12 posts
Hello,
My problem started when I connected my notebook to my friend's Wi-Fi. The thing is, she had been having a lot problems on both her computers connected to her internet.
So, after I used her Wi-Fi, my computer got extremely slow, the light of disc use always on, even if the computer was only turned on but I was not using it. Mozilla got really slow and sometimes freezed my computer and I had to turn it off.
When I opened facebook page and typed the letter 'c' , so my email would appear on that little box with the emails already used, another email appeared below my own. I don't know this email, and no one, no one, ever uses my computer besides myself.
I don't know if this is a virus, or what, because I ran the antivirus (kaspersky) and that other program, Malwarebytes, and neither found a virus.
The computer runs faster when there is no internet connection. But other than this, nothing else happened. Thank you.


OTL logfile created on: 19/10/2011 16:41:43 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Carol\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy

3,97 Gb Total Physical Memory | 2,28 Gb Available Physical Memory | 57,36% Memory free
8,13 Gb Paging File | 6,21 Gb Available in Paging File | 76,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 222,14 Gb Total Space | 65,27 Gb Free Space | 29,38% Space Free | Partition Type: NTFS
Drive D: | 10,74 Gb Total Space | 1,81 Gb Free Space | 16,81% Space Free | Partition Type: NTFS

Computer Name: CAROL-PC | User Name: Carol | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/10/19 16:40:41 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Carol\Downloads\OTL.exe
PRC - [2011/08/08 12:23:18 | 000,208,672 | ---- | M] ( ) -- C:\Program Files (x86)\GbPlugin\GbpSv.exe
PRC - [2011/06/06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2010/11/02 23:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
PRC - [2009/07/18 01:12:12 | 000,257,440 | R--- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10c.exe
PRC - [2009/03/06 12:59:12 | 000,020,376 | ---- | M] (WebEx Communications, Inc.) -- C:\Windows\SysWOW64\atashost.exe
PRC - [2008/01/21 00:49:12 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\conime.exe


========== Modules (No Company Name) ==========

MOD - [2009/09/05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/06/03 21:43:18 | 000,239,104 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe -- (STacSV)
SRV:64bit: - [2009/03/02 19:42:58 | 000,089,600 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2008/03/18 17:25:40 | 000,023,040 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\Hpservice.exe -- (hpsrv)
SRV:64bit: - [2007/12/11 13:11:30 | 000,015,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\agr64svc.exe -- (AgereModemAudio)
SRV - [2011/08/08 12:23:18 | 000,208,672 | ---- | M] ( ) [Unknown | Running] -- C:\Program Files (x86)\GbPlugin\GbpSv.exe -- (GbpSv)
SRV - [2011/06/06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/11/02 23:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2009/03/06 12:59:12 | 000,020,376 | ---- | M] (WebEx Communications, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\atashost.exe -- (atashost)
SRV - [2008/10/06 10:54:52 | 000,365,952 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\SMINST\BLService.exe -- (Recovery Service for Windows)
SRV - [2008/01/21 00:50:58 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/02/18 17:36:58 | 000,051,712 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/10/01 11:37:40 | 000,556,120 | ---- | M] () [File_System | System | Running] -- C:\Windows\SysNative\DRIVERS\klif.sys -- (KLIF)
DRV:64bit: - [2010/07/25 11:25:47 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010/06/09 17:44:00 | 000,011,864 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\kl2.sys -- (kl2)
DRV:64bit: - [2010/06/09 17:43:56 | 000,460,888 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\kl1.sys -- (kl1)
DRV:64bit: - [2010/04/22 19:07:36 | 000,027,736 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\klim6.sys -- (KLIM6)
DRV:64bit: - [2009/11/02 20:27:10 | 000,022,544 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2009/06/03 21:43:18 | 000,486,400 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/02/12 16:11:26 | 000,026,024 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\rsdrvx64.sys -- (ElRawDisk)
DRV:64bit: - [2008/11/17 16:50:30 | 004,751,360 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw5v64.sys -- (NETw5v64) Intel®
DRV:64bit: - [2008/08/06 01:29:26 | 000,056,352 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2008/07/22 13:42:34 | 000,170,496 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/07/21 08:53:04 | 000,145,496 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\jmcr.sys -- (JMCR)
DRV:64bit: - [2008/06/23 09:54:02 | 000,099,368 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2008/06/23 09:54:02 | 000,091,176 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2008/06/23 09:54:02 | 000,019,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2008/04/28 23:55:32 | 000,064,000 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\enecir.sys -- (enecir)
DRV:64bit: - [2008/03/27 13:10:56 | 000,026,984 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2008/03/27 13:10:14 | 000,040,296 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2008/02/29 16:59:32 | 001,252,352 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2008/01/31 21:23:14 | 000,195,120 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2008/01/21 00:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2008/01/21 00:46:57 | 003,154,432 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\NETw3v64.sys -- (NETw3v64) Intel®
DRV:64bit: - [2008/01/21 00:46:55 | 000,111,104 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2007/06/18 18:13:12 | 000,018,432 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2006/10/03 23:45:36 | 000,273,408 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV - [2011/08/08 12:23:42 | 000,044,064 | ---- | M] (GAS Tecnologia) [Kernel | Boot | Stopped] -- C:\Windows\system32\drivers\gbpkm.sys -- (GbpKm)
DRV - [2006/07/24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\[email protected] [2011/05/31 13:45:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\[email protected] [2011/05/31 13:45:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\[email protected] [2011/05/31 13:45:13 | 000,000,000 | ---D | M]

[2011/10/16 15:54:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carol\AppData\Roaming\mozilla\Extensions
[2010/05/10 15:28:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carol\AppData\Roaming\mozilla\Extensions\[email protected]
[2011/10/16 15:54:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/04/28 23:09:20 | 000,000,000 | ---D | M] (Antibanner) -- C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]_bak
[2011/04/28 23:09:14 | 000,000,000 | ---D | M] (Consultor de URLs Kaspersky) -- C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]_bak

O1 HOSTS File: ([2011/09/27 23:00:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Auxiliar de Conexão do Windows Live ID) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files (x86)\GbPlugin\gbieh.dll (Banco do Brasil)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll ()
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.dll ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Arquivos de Programas\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O8:64bit: - Extra context menu item: Adicionar ao Antibanner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - Reg Error: Value error. File not found
O8:64bit: - Extra context menu item: Enviar imagem para Dispositivo &Bluetooth... - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Enviar página para Dispositivo &Bluetooth ... - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Adicionar ao Antibanner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O8 - Extra context menu item: Append Link Target to Existing PDF - Reg Error: Value error. File not found
O8 - Extra context menu item: Enviar imagem para Dispositivo &Bluetooth... - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Enviar página para Dispositivo &Bluetooth ... - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: &Teclado Virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: Veri&ficação de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: &Teclado Virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Enviar para Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Enviar para Dispositivo &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Arquivos de Programas\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Veri&ficação de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Arquivos de Programas\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: bancobrasil.com.br ([www] * in Trusted sites)
O15 - HKCU\..Trusted Domains: bancobrasil.com.br ([www14] * in Trusted sites)
O15 - HKCU\..Trusted Domains: bancobrasil.com.br ([www2] * in Trusted sites)
O15 - HKCU\..Trusted Domains: bb.com.br ([www] * in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 201.21.192.157 201.21.192.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0231C69B-094E-4D6A-B702-C11030D3CDE5}: DhcpNameServer = 172.16.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08B610F8-AC16-4E23-8FF1-68C4DF809DE9}: DhcpNameServer = 201.21.192.157 201.21.192.152
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Arquivos de Programas\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~2\x64\kloehk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\kloehk.dll (Kaspersky Lab ZAO)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~2\x64\sbhook64.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\sbhook64.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~2\sbhook.dll) -C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\sbhook.dll (Kaspersky Lab ZAO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll ()
O20 - Winlogon\Notify\ GbPluginBb: DllName - (C:\Program Files (x86)\GbPlugin\gbieh.dll) - C:\Program Files (x86)\GbPlugin\gbieh.dll (Banco do Brasil)
O24 - Desktop WallPaper: C:\Users\Carol\AppData\Roaming\Microsoft\Windows Photo Gallery\Papel de Parede da Galeria de Fotos do Windows.jpg
O24 - Desktop BackupWallPaper: C:\Users\Carol\AppData\Roaming\Microsoft\Windows Photo Gallery\Papel de Parede da Galeria de Fotos do Windows.jpg
O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files (x86)\GbPlugin\gbieh.dll (Banco do Brasil)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0ee1ec71-091e-11df-b739-00235aab5561}\Shell - "" = AutoRun
O33 - MountPoints2\{35774234-078c-11df-aab6-00235aab5561}\Shell - "" = AutoRun
O33 - MountPoints2\{35774259-078c-11df-aab6-00235aab5561}\Shell - "" = AutoRun
O33 - MountPoints2\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\Shell - "" = AutoRun
O33 - MountPoints2\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
O33 - MountPoints2\{8e01f43e-1129-11df-8807-00247e7fd0f6}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AlUNO.exe
O33 - MountPoints2\{8e01f441-1129-11df-8807-00247e7fd0f6}\Shell - "" = AutoRun
O33 - MountPoints2\{aa753097-20db-11e0-807f-00235aab5561}\Shell - "" = AutoRun
O33 - MountPoints2\{aa75309a-20db-11e0-807f-00247e7fd0f6}\Shell - "" = AutoRun
O33 - MountPoints2\{baead283-20fe-11e0-8cf7-00235aab5561}\Shell - "" = AutoRun
O33 - MountPoints2\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\Shell - "" = AutoRun
O33 - MountPoints2\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\Shell\AutoRun\command - "" = F:\Atlas_Port.exe
O33 - MountPoints2\{d2eeac4e-cf8a-11e0-9636-bb14f6eafd7f}\Shell\AutoRun\command - "" = G:\RunClubSanDisk.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/15 19:49:19 | 000,000,000 | ---D | C] -- C:\Temp
[2011/10/10 23:27:44 | 000,108,144 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt.dll
[2011/10/10 23:26:32 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Primal Pictures
[2011/10/10 23:26:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Primal Pictures
[2011/10/10 23:26:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Primal Pictures
[2011/10/10 20:21:28 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll
[2011/10/10 20:21:27 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2011/10/04 22:35:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
[2011/10/04 22:35:27 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2011/10/04 22:35:27 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll
[2011/10/04 22:20:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2011/10/04 21:59:27 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2011/10/04 21:59:26 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2011/10/04 21:58:25 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011/10/04 21:58:25 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011/10/04 21:58:16 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe
[2011/10/04 21:58:16 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011/10/04 21:58:15 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011/10/04 21:58:15 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011/10/04 21:58:15 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011/10/04 21:58:15 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2011/10/04 21:58:15 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2011/10/04 21:58:15 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2011/10/04 21:58:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011/10/04 21:58:10 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2011/10/04 21:58:10 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2011/10/04 21:57:51 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011/10/04 21:56:52 | 001,161,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42u.dll
[2011/10/04 21:56:51 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc42.dll
[2011/10/04 21:39:14 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dnscacheugc.exe
[2011/09/27 23:02:07 | 000,044,064 | ---- | C] (GAS Tecnologia) -- C:\Windows\SysWow64\drivers\GbpKm.sys
[2011/09/27 23:01:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GbPlugin
[2011/09/27 22:57:41 | 000,000,000 | ---D | C] -- C:\Users\Carol\Desktop\Nova Pasta
[2011/08/19 22:56:12 | 013,727,040 | ---- | C] (DsNET Corp) -- C:\Users\Carol\AppData\Local\atube-catcher-2-2-562-es-en-win.exe

========== Files - Modified Within 30 Days ==========

[2011/10/19 16:55:48 | 000,046,455 | ---- | M] () -- C:\Users\Carol\Desktop\TRABALHO AIBC.pdf
[2011/10/19 16:55:44 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/10/19 16:55:44 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/10/19 16:07:29 | 001,444,766 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/10/19 16:07:29 | 000,634,222 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat
[2011/10/19 16:07:29 | 000,587,178 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/10/19 16:07:29 | 000,121,888 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat
[2011/10/19 16:07:29 | 000,101,250 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/10/19 15:42:45 | 000,101,651 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/10/19 15:42:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/10/19 15:42:24 | 4260,319,232 | -HS- | M] () -- C:\hiberfil.sys
[2011/10/19 12:00:31 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/10/10 23:27:44 | 000,108,144 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\SysWow64\CmdLineExt.dll
[2011/10/06 12:57:14 | 000,050,214 | ---- | M] () -- C:\Users\Carol\Desktop\História do Conceito de Saúde - Moacyr Scliar.pdf
[2011/10/04 22:40:40 | 000,344,960 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/10/04 22:29:47 | 002,564,851 | ---- | M] () -- C:\Users\Carol\Desktop\Paula Sibilia. O Homem Pós-Orgânico - corpo, subjetividade e tecnologias digitais.PDF
[2011/09/27 23:00:24 | 000,000,761 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

========== Files Created - No Company Name ==========

[2011/10/10 20:21:28 | 000,032,256 | ---- | C] () -- C:\Windows\SysNative\Apphlpdm.dll
[2011/10/10 20:21:27 | 004,240,384 | ---- | C] () -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2011/10/06 11:38:28 | 000,050,214 | ---- | C] () -- C:\Users\Carol\Desktop\História do Conceito de Saúde - Moacyr Scliar.pdf
[2011/10/04 22:05:57 | 000,694,784 | ---- | C] () -- C:\Windows\SysNative\drivers\bthport.sys
[2011/10/04 22:05:57 | 000,204,288 | ---- | C] () -- C:\Windows\SysNative\fsquirt.exe
[2011/10/04 22:05:57 | 000,035,328 | ---- | C] () -- C:\Windows\SysNative\drivers\BTHUSB.SYS
[2011/10/04 22:05:57 | 000,026,624 | ---- | C] () -- C:\Windows\SysNative\drivers\bthenum.sys
[2011/10/04 21:59:27 | 000,367,616 | ---- | C] () -- C:\Windows\SysNative\atmfd.dll
[2011/10/04 21:59:26 | 000,048,128 | ---- | C] () -- C:\Windows\SysNative\atmlib.dll
[2011/10/04 21:59:21 | 001,062,800 | ---- | C] () -- C:\Windows\SysNative\winload.exe
[2011/10/04 21:59:21 | 000,990,096 | ---- | C] () -- C:\Windows\SysNative\winresume.efi
[2011/10/04 21:59:21 | 000,979,344 | ---- | C] () -- C:\Windows\SysNative\winresume.exe
[2011/10/04 21:59:20 | 001,075,600 | ---- | C] () -- C:\Windows\SysNative\winload.efi
[2011/10/04 21:59:20 | 000,020,880 | ---- | C] () -- C:\Windows\SysNative\kdusb.dll
[2011/10/04 21:59:20 | 000,018,832 | ---- | C] () -- C:\Windows\SysNative\kd1394.dll
[2011/10/04 21:59:20 | 000,018,320 | ---- | C] () -- C:\Windows\SysNative\kdcom.dll
[2011/10/04 21:59:14 | 001,208,832 | ---- | C] () -- C:\Windows\SysNative\kernel32.dll
[2011/10/04 21:59:09 | 000,097,792 | ---- | C] () -- C:\Windows\SysNative\drivers\dfsc.sys
[2011/10/04 21:58:48 | 000,301,568 | ---- | C] () -- C:\Windows\SysNative\shsvcs.dll
[2011/10/04 21:58:25 | 000,219,136 | ---- | C] () -- C:\Windows\SysNative\ieui.dll
[2011/10/04 21:58:24 | 001,062,912 | ---- | C] () -- C:\Windows\SysNative\mstime.dll
[2011/10/04 21:58:23 | 000,031,744 | ---- | C] () -- C:\Windows\SysNative\jsproxy.dll
[2011/10/04 21:58:22 | 009,272,320 | ---- | C] () -- C:\Windows\SysNative\mshtml.dll
[2011/10/04 21:58:21 | 001,638,912 | ---- | C] () -- C:\Windows\SysNative\mshtml.tlb
[2011/10/04 21:58:20 | 001,147,904 | ---- | C] () -- C:\Windows\SysNative\wininet.dll
[2011/10/04 21:58:19 | 012,477,440 | ---- | C] () -- C:\Windows\SysNative\ieframe.dll
[2011/10/04 21:58:16 | 001,488,384 | ---- | C] () -- C:\Windows\SysNative\urlmon.dll
[2011/10/04 21:58:15 | 002,339,840 | ---- | C] () -- C:\Windows\SysNative\iertutil.dll
[2011/10/04 21:58:15 | 000,710,656 | ---- | C] () -- C:\Windows\SysNative\msfeeds.dll
[2011/10/04 21:58:14 | 000,459,776 | ---- | C] () -- C:\Windows\SysNative\iedkcs32.dll
[2011/10/04 21:58:14 | 000,243,712 | ---- | C] () -- C:\Windows\SysNative\occache.dll
[2011/10/04 21:58:12 | 000,252,416 | ---- | C] () -- C:\Windows\SysNative\iepeers.dll
[2011/10/04 21:58:12 | 000,071,680 | ---- | C] () -- C:\Windows\SysNative\msfeedsbs.dll
[2011/10/04 21:58:11 | 001,538,560 | ---- | C] () -- C:\Windows\SysNative\inetcpl.cpl
[2011/10/04 21:58:11 | 000,096,768 | ---- | C] () -- C:\Windows\SysNative\mshtmled.dll
[2011/10/04 21:58:11 | 000,077,312 | ---- | C] () -- C:\Windows\SysNative\iesetup.dll
[2011/10/04 21:58:11 | 000,072,192 | ---- | C] () -- C:\Windows\SysNative\iernonce.dll
[2011/10/04 21:58:11 | 000,056,832 | ---- | C] () -- C:\Windows\SysNative\licmgr10.dll
[2011/10/04 21:58:10 | 000,479,232 | ---- | C] () -- C:\Windows\SysNative\html.iec
[2011/10/04 21:58:10 | 000,162,816 | ---- | C] () -- C:\Windows\SysNative\ieUnatt.exe
[2011/10/04 21:58:10 | 000,132,096 | ---- | C] () -- C:\Windows\SysNative\iesysprep.dll
[2011/10/04 21:58:10 | 000,070,656 | ---- | C] () -- C:\Windows\SysNative\ie4uinit.exe
[2011/10/04 21:58:10 | 000,012,288 | ---- | C] () -- C:\Windows\SysNative\msfeedssync.exe
[2011/10/04 21:58:05 | 000,847,872 | ---- | C] () -- C:\Windows\SysNative\oleaut32.dll
[2011/10/04 21:57:58 | 000,461,312 | ---- | C] () -- C:\Windows\SysNative\drivers\srv.sys
[2011/10/04 21:57:51 | 000,817,664 | ---- | C] () -- C:\Windows\SysNative\jscript.dll
[2011/10/04 21:57:51 | 000,613,376 | ---- | C] () -- C:\Windows\SysNative\vbscript.dll
[2011/10/04 21:57:49 | 000,407,552 | ---- | C] () -- C:\Windows\SysNative\drivers\afd.sys
[2011/10/04 21:57:44 | 002,762,240 | ---- | C] () -- C:\Windows\SysNative\win32k.sys
[2011/10/04 21:57:39 | 000,975,360 | ---- | C] () -- C:\Windows\SysNative\inetcomm.dll
[2011/10/04 21:57:30 | 000,274,432 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb10.sys
[2011/10/04 21:57:30 | 000,135,168 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb.sys
[2011/10/04 21:57:30 | 000,105,984 | ---- | C] () -- C:\Windows\SysNative\drivers\mrxsmb20.sys
[2011/10/04 21:57:25 | 000,090,624 | ---- | C] () -- C:\Windows\SysNative\drivers\bowser.sys
[2011/10/04 21:57:19 | 000,344,576 | ---- | C] () -- C:\Windows\SysNative\schannel.dll
[2011/10/04 21:57:12 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\winsrv.dll
[2011/10/04 21:57:12 | 000,085,504 | ---- | C] () -- C:\Windows\SysNative\csrsrv.dll
[2011/10/04 21:57:06 | 000,176,128 | ---- | C] () -- C:\Windows\SysNative\drivers\srv2.sys
[2011/10/04 21:57:06 | 000,144,896 | ---- | C] () -- C:\Windows\SysNative\drivers\srvnet.sys
[2011/10/04 21:56:53 | 001,360,384 | ---- | C] () -- C:\Windows\SysNative\mfc42u.dll
[2011/10/04 21:56:52 | 001,398,784 | ---- | C] () -- C:\Windows\SysNative\mfc42.dll
[2011/10/04 21:39:14 | 000,221,184 | ---- | C] () -- C:\Windows\SysNative\dnsapi.dll
[2011/10/04 21:39:14 | 000,117,760 | ---- | C] () -- C:\Windows\SysNative\dnsrslvr.dll
[2011/10/04 21:39:14 | 000,028,672 | ---- | C] () -- C:\Windows\SysNative\dnscacheugc.exe
[2011/09/28 22:03:37 | 002,564,851 | ---- | C] () -- C:\Users\Carol\Desktop\Paula Sibilia. O Homem Pós-Orgânico - corpo, subjetividade e tecnologias digitais.PDF
[2011/05/24 09:03:24 | 000,276,232 | ---- | C] () -- C:\Users\Carol\AppData\Local\ConduitInstaller.exe
[2011/04/09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/03/27 17:43:08 | 000,096,768 | ---- | C] () -- C:\Users\Carol\AppData\Local\Bloson.exe
[2011/03/21 09:36:30 | 000,026,456 | ---- | C] () -- C:\Users\Carol\AppData\Local\bloson.bmp
[2011/02/10 02:03:48 | 000,000,326 | ---- | C] () -- C:\Windows\primopdf.ini
[2010/11/13 08:14:46 | 000,062,648 | ---- | C] () -- C:\Users\Carol\AppData\Local\toolbar3.bmp
[2010/11/12 08:09:56 | 000,195,108 | ---- | C] () -- C:\Users\Carol\AppData\Local\lateral3.bmp
[2010/11/12 07:44:14 | 000,193,744 | ---- | C] () -- C:\Users\Carol\AppData\Local\lateral1.bmp
[2010/11/12 07:10:58 | 000,193,744 | ---- | C] () -- C:\Users\Carol\AppData\Local\lateral2.bmp
[2010/07/25 12:15:09 | 000,116,080 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010/01/18 15:20:30 | 000,018,888 | ---- | C] () -- C:\Users\Carol\AppData\Roaming\UserTile.png
[2009/11/16 21:41:54 | 000,011,030 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp DSP Effects.dat
[2009/11/16 21:41:42 | 003,494,576 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2009/11/16 21:41:42 | 000,015,613 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp Music Converter.dat
[2009/11/08 23:09:40 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2009/11/08 23:00:20 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2009/10/21 21:38:33 | 008,892,928 | ---- | C] () -- C:\ProgramData\atscie.msi
[2009/09/26 22:52:41 | 000,101,651 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/09/25 22:46:55 | 000,101,651 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/09/22 13:05:57 | 000,000,680 | ---- | C] () -- C:\Users\Carol\AppData\Local\d3d9caps.dat
[2009/09/19 17:38:32 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2009/09/19 17:38:30 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2009/09/19 17:38:30 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2009/09/19 17:38:29 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll
[2009/09/19 17:38:27 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009/09/19 17:15:20 | 000,031,232 | ---- | C] () -- C:\Users\Carol\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/19 17:02:25 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2009/07/22 01:45:58 | 000,106,605 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009/07/22 01:45:58 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2009/07/21 21:39:12 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2009/06/07 09:27:20 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\vbzlib1.dll
[2008/01/21 00:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008/01/21 00:49:49 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2006/11/02 13:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 10:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006/11/02 10:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 10:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006/11/02 07:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

========== Alternate Data Streams ==========

@Alternate Data Stream - 204 bytes -> C:\Windows\SysWow64\drivers:GbpKmAp.lst
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:CC7E452C

< End of report >
  • 0

Advertisements


#2
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
http://www.geekstogo..._1#entry2073609

well, i don't know the name of my virus, or even if it a virus or something else, but i guess i got it from the wi-fi connection of a friend, whose both computers were infected.
my operating system is windows vista

my post is from 19/10/2011

thanks.
  • 0

#3
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hello carol.lopes and welcome to G2G! :)

My nick is maliprog and I'll will be your technical support on this issue. Before we start please read my notes carefully:

NOTE:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
  • Please DO NOT run any scans or fix on your own without my direction.
  • Please read all of my response through at least once before attempting to follow the procedures described.
  • If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
  • Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply.
  • You must reply within 3 days or your topic will be closed

Step 1

Upgrading Java :
  • Download the recommended Version 6 Update 29 of Java SE Runtime Environment .
  • Click on the Offline version, and save it to your desktop. Do NOT use the online download.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the download and select "Run as an Administrator.")
Step 2

NOTE: This fix is custom made for this system only and for current system state! Don't try to run it on another system!

Please close all running programs and Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    O33 - MountPoints2\{0ee1ec71-091e-11df-b739-00235aab5561}\Shell - "" = AutoRun
    O33 - MountPoints2\{35774234-078c-11df-aab6-00235aab5561}\Shell - "" = AutoRun
    O33 - MountPoints2\{35774259-078c-11df-aab6-00235aab5561}\Shell - "" = AutoRun
    O33 - MountPoints2\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\Shell - "" = AutoRun
    O33 - MountPoints2\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe
    O33 - MountPoints2\{8e01f43e-1129-11df-8807-00247e7fd0f6}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AlUNO.exe
    O33 - MountPoints2\{8e01f441-1129-11df-8807-00247e7fd0f6}\Shell - "" = AutoRun
    O33 - MountPoints2\{aa753097-20db-11e0-807f-00235aab5561}\Shell - "" = AutoRun
    O33 - MountPoints2\{aa75309a-20db-11e0-807f-00247e7fd0f6}\Shell - "" = AutoRun
    O33 - MountPoints2\{baead283-20fe-11e0-8cf7-00235aab5561}\Shell - "" = AutoRun
    O33 - MountPoints2\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\Shell - "" = AutoRun
    O33 - MountPoints2\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\Shell\AutoRun\command - "" = F:\Atlas_Port.exe
    O33 - MountPoints2\{d2eeac4e-cf8a-11e0-9636-bb14f6eafd7f}\Shell\AutoRun\command - "" = G:\RunClubSanDisk.exe
    @Alternate Data Stream - 204 bytes -> C:\Windows\SysWow64\drivers:GbpKmAp.lst

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Post the fix log it produces in your next reply or you can find it in C:\_OTL\MovedFiles

Step 3

Download GMER from Here. Note the file's name and save it to your root folder, such as C:.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.

Step 4

Please don't forget to include these items in your reply:

  • OTL fix log
  • GMER log
It would be helpful if you could post each log in separate post
  • 0

#4
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
OTL LOG

All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ee1ec71-091e-11df-b739-00235aab5561}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ee1ec71-091e-11df-b739-00235aab5561}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{35774234-078c-11df-aab6-00235aab5561}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35774234-078c-11df-aab6-00235aab5561}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{35774259-078c-11df-aab6-00235aab5561}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35774259-078c-11df-aab6-00235aab5561}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5bbf63f9-b06b-11de-ac68-00247e7fd0f6}\ not found.
File G:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e01f43e-1129-11df-8807-00247e7fd0f6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e01f43e-1129-11df-8807-00247e7fd0f6}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AlUNO.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e01f441-1129-11df-8807-00247e7fd0f6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e01f441-1129-11df-8807-00247e7fd0f6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa753097-20db-11e0-807f-00235aab5561}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa753097-20db-11e0-807f-00235aab5561}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa75309a-20db-11e0-807f-00247e7fd0f6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa75309a-20db-11e0-807f-00247e7fd0f6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{baead283-20fe-11e0-8cf7-00235aab5561}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{baead283-20fe-11e0-8cf7-00235aab5561}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c5c783c2-97f0-11df-a0fb-00247e7fd0f6}\ not found.
File F:\Atlas_Port.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d2eeac4e-cf8a-11e0-9636-bb14f6eafd7f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2eeac4e-cf8a-11e0-9636-bb14f6eafd7f}\ not found.
File G:\RunClubSanDisk.exe not found.
ADS C:\Windows\SysWow64\drivers:GbpKmAp.lst deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Configura‡Æo de IP do Windows
Libera‡Æo do Cache do DNS Resolver bem-sucedida.
c:\Users\Carol\Downloads\cmd.bat deleted successfully.
c:\Users\Carol\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Carol
->Temp folder emptied: 36796 bytes
->Temporary Internet Files folder emptied: 137252624 bytes
->Java cache emptied: 402530 bytes
->Flash cache emptied: 265141 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 53632 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15458681 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 82989 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 751 bytes
RecycleBin emptied: 6101138895 bytes

Total Files Cleaned = 5.965,00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 10292011_181845

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\WebEx\Log\1029\atashost.log scheduled to be moved on reboot.
C:\Windows\temp\klsD929.tmp moved successfully.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XEXWRYAX\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JOMQ0K1R\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HUTRWXKV\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\738WF329\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\deployment.properties scheduled to be moved on reboot.

Registry entries deleted on Reboot...
  • 0

#5
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
GMER LOG

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-30 11:52:01
Windows 6.0.6001 Service Pack 1
Running: 2d2iqwrh.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00247e7fd0f6
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\[email protected] 0x20 0xCA 0xBC 0x0B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x5E 0x36 0x7D 0x92 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0x8F 0x13 0xBD 0x59 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00247e7fd0f6 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\[email protected] 0x20 0xCA 0xBC 0x0B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x5E 0x36 0x7D 0x92 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0x38 0xD3 0x8A 0x40 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00247e7fd0f6 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\[email protected] 0x20 0xCA 0xBC 0x0B ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x5E 0x36 0x7D 0x92 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0x38 0xD3 0x8A 0x40 ...
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\00247e7fd0f6 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\[email protected] 0x20 0xCA 0xBC 0x0B ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x5E 0x36 0x7D 0x92 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0x38 0xD3 0x8A 0x40 ...
Reg HKLM\SYSTEM\ControlSet005\Services\BTHPORT\Parameters\Keys\00247e7fd0f6 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\[email protected] C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\[email protected] 0x20 0xCA 0xBC 0x0B ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x5E 0x36 0x7D 0x92 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0x8F 0x13 0xBD 0x59 ...

---- EOF - GMER 1.0.15 ----
  • 0

#6
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
just another thing, i don't know if this is important or not, but when i was uninstalling the Java 6 update 7 kaspersky "said" that javaws.exe was trying to access data or change data to gather remote access to computer or something like that, and that its behavior was similar to some malware that i don't remember the name and asked what i wanted to do, so i moved it to quarentena and the uninstall was completed.
  • 0

#7
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hi carol.lopes,

OK. Thank you for info. It's just notification that your java files are updated.

Can you also give me some more info about your problem. What problems do you have now?

Step 1

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Step 2

Download Virus Removal Tool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right
Posted Image


Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan
Posted Image

Allow Virus Removal Tool to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threads report from the left and press Save button
Save it to your desktop and attach to your next post


Step 3

Please don't forget to include these items in your reply:

  • Malwarebytes log
  • VRT log
It would be helpful if you could post each log in separate post
  • 0

#8
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
i'm posting only the mbam log, because the tool from kaspersky found nothing, so there was no report.
well, now my only problem is the freezing of the internet explorer, mainly when i'm using facebook. it's maddening..
also, do you know what was the cause of the other email address that appeared on the box of automatic filling that i commented on my first post? because that's what really scared me...

Edited by carol.lopes, 02 November 2011 - 06:58 PM.

  • 0

#9
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8064

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19088

02/11/2011 13:28:26
mbam-log-2011-11-02 (13-28-26).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 374776
Time elapsed: 1 hour(s), 30 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#10
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
I'm going to business trip for 3 days. I don't know if I would have Internet access in my hotel room. If I don't reply to you please excuse me for couple of days until I come back. Hope you'll understand and you'll wait for my reply.

Best regards
  • 0

#11
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hi carol.lopes,

well, now my only problem is the freezing of the internet explorer, mainly when i'm using facebook. it's maddening..


Can you try Firefox and see if this is only problem with Internet Explorer or something else?

also, do you know what was the cause of the other email address that appeared on the box of automatic filling that i commented on my first post? because that's what really scared me...


That is only possible if someone else used you PC to login on facebook. I have no other explanation. But that dosn't mean anything because that is not security risk.
  • 0

#12
carol.lopes

carol.lopes

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
I downloaded firefox and it is not freezing anymore.
and since i don't understand those reports, can you tell me if any of the things you told me to do worked, did they say that my pc had some malware or something? do you think it is clean now? sorry if i'm being annoying with all these questions ;p

thank you.
  • 0

#13
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hi carol.lopes,

Glad to hear that. I think that some of internet explorer files are messed up and it dosn't work fine. If you need IE then please start new topic in Windows Vista™ and Windows 7™ and explain your problem. If you are happy with Firefox then don't bother :).

Your system did have some malware and we manage to remove it from your system.

Your logs and system are clean now. I'm glad we fix up your computer. We need to clean up your PC from programs we used.

Step 1

Please start OTL one more time and click CleanUp button. OTL will restart your system at the end. Remove all other application we used to clean your PC.

General recommendations

Here are some recommendations you should follow to minimize infection risk in the future:

1. Enable Windows Update
  • Click Start, click Run, type sysdm.cpl, and then press ENTER.
  • Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them option.
  • Click OK button

2. Delete Temp files

Download TFC to your desktop
  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

3. Make Backups of Important Files

Please read this article Home Computer Data Backup.


4. Regularly update your software

To eliminate design flaws and security vulnerabilities, all software needs to be updated to the latest version or the vendor’s patch installed.

You should download Update Checker from here. The program will automaticly check for newer version of software installed on your system.
  • 0

#14
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP