ComboFix 10-11-05.01 - Maquina-05 05/11/2010 18:27:48.1.

2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2038.1752 [GMT -2:
00]
Executando de: d:\documents and settings\Maquina-05\Meus documentos\Downloads\Co
mboFix.exe
ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!
.
((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))
))))))))))))))))))))))))))))
.
d:\windows\systray.exe
.
(((((((((((((((( Arquivos/Ficheiros criados de 2010-10-05 to 2010-11-05 )))))
)))))))))))))))))))))))
.
Nenhum ficheiro/arquivo criado durante este período
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))
)))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))
)))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="d:\arquivos de programas\Arq
uivos comuns\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="d:\windows\system32\igfxtray.exe" [2009-03-13 141336]
"HotKeysCmds"="d:\windows\system32\hkcmd.exe" [2009-03-13 173592]
"Persistence"="d:\windows\system32\igfxpers.exe" [2009-03-13 142360]
"HDAudDeck"="d:\arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-05-1
4 33624064]
"AutorunRemover.exe"="d:\arquivos de programas\AutorunRemover\AutorunRemover.exe
" [2009-10-22 1360896]
"GrooveMonitor"="d:\arquivos de programas\Microsoft Office\Office12\GrooveMonito
r.exe" [2006-10-27 31016]
"NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SuNotification"="d:\arquivos de programas\ShadowStor\ShadowUser\suatshut.exe" [
2005-01-13 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
d:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Orbit.lnk - d:\arquivos de programas\Orbitdownloader\orbitdm.exe [2010-11-5 1719
568]
ShadowUser Pro Edition.lnk - d:\arquivos de programas\ShadowStor\ShadowUser\Shad
owUser.exe [2005-1-12 921600]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify
\sunotify]
2005-01-13 01:49 90112 ----a-w- d:\windows\system32\sunotify.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Authoriz
edApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Arquivos de programas\\Orbitdownloader\\orbitdm.exe"=
"d:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=
"d:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 Shadow;Shadow;d:\windows\system32\drivers\shadow.sys [25/1/2005 19:21 114624]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;d:\windows\system
32\drivers\viahduaa.sys [5/11/2010 17:39 1358720]
.
.
------- Scan Suplementar -------
.
uStart Page = about:blank
IE: &Download by Orbit - d:\arquivos de programas\Orbitdownloader\orbitmxt.dll/2
01
IE: &Grab video by Orbit - d:\arquivos de programas\Orbitdownloader\orbitmxt.dll
/204
IE: Do&wnload selected by Orbit - d:\arquivos de programas\Orbitdownloader\orbit
mxt.dll/203
IE: Down&load all by Orbit - d:\arquivos de programas\Orbitdownloader\orbitmxt.d
ll/202
IE: E&xportar para o Microsoft Excel - d:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3
000
TCP: {8E84E0B2-0141-44C8-BB24-9B316CDCDEE0} = 189.89.224.1,189.89.224.2
FF - ProfilePath - d:\documents and settings\Maquina-05\Dados de aplicativos\Moz
illa\Firefox\Profiles\psegkhsn.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com
---- FIREFOX POLICIES ----
d:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("b
rowser.fixup.alternate.suffix", ".com.br");
.
- - - - ORFÃOS REMOVIDOS - - - -
HKLM-Run-Systray - d:\windows\Systray.exe
HKLM-Run-Cafeexpress Client 1.0 - d:\windows\systray.exe

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http:/
/www.gmer.net
Rootkit scan 2010-11-05 18:29
Windows 5.1.2600 Service Pack 3 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = d:\arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1?????????
???????????????????????????????????????????????
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
.
Tempo para conclusão: 2010-11-05 18:29:50
ComboFix-quarantined-files.txt 2010-11-05 20:29
Pré-execução: 6 pasta(s) 98.868.469.760 bytes disponíveis
Pós execução: 8 pasta(s) 99.390.173.184 bytes disponíveis
- - End Of File - - 1AE814D81454F17FF4D6F7C892F06562