Abstract image of a woman sitting on books and studying on a laptop

Combo fix

Vagner Silva, profile picture
Vagner Silva

This document provides a summary of files and programs installed on a Windows 7 system between January 16th and February 16th 2013. It lists new files and folders created, installed programs, active services, drivers, and other system information. Changes included installing AVG Secure Search, Samsung drivers, and updates to existing programs like Flash Player and Outpost Firewall. The summary also notes exclusions made and files/folders created during the period.

1 of 9
1
2
3
4
5
6
7
8
9
ComboFix 13-02-15.01 - Red 16/02/2013 18:55:48.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.55.1046.18.4095.3027 [GMT -3:00] Executando de: c:usersRedDesktopComboFix.exe FW: Outpost Firewall Pro *Disabled* {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615} SP: Outpost Firewall Pro *Disabled/Updated* {578B8A29-863D-0449-EF15- 3926A73ACBD3} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:usersRedguefae.exe c:windowsSysWow64muzapp.exe . . (((((((((((((((( Arquivos/Ficheiros criados de 2013-01-16 to 2013-02- 16 )))))))))))))))))))))))))))) . . 2013-02-16 22:02 . 2013-02-16 22:02 -------- d-----w- c:usersDefaultAppDataLocaltemp 2013-02-16 20:56 . 2013-01-31 08:19 203104 ----a-w- c:windowssystem32driversssudmdm.sys 2013-02-16 20:56 . 2013-01-31 08:19 102368 ----a-w- c:windowssystem32driversssudbus.sys 2013-02-16 20:51 . 2012-12-18 13:06 4659712 ----a-w- c:windowsSysWow64Redemption.dll 2013-02-16 20:51 . 2012-12-18 13:06 821824 ----a-w- c:windowsSysWow64dgderapi.dll 2013-02-16 20:50 . 2013-02-16 20:56 -------- d-----w- c:program files (x86)Samsung 2013-02-16 20:50 . 2013-02-16 20:55 -------- d-----w- c:programdataSamsung 2013-02-16 20:49 . 2013-02-16 20:49 -------- d-----w- c:usersRedAppDataLocalDownloaded Installations 2013-01-19 16:31 . 2013-01-19 16:31 -------- d-----w- c:usersRedAppDataRoamingNero 2013-01-19 15:21 . 2013-01-19 15:21 -------- d-----w- c:usersRedAppDataLocalAVG Secure Search 2013-01-19 15:21 . 2013-01-21 13:01 -------- d-----w- c:programdataAVG Secure Search 2013-01-19 15:21 . 2013-02-12 14:08 39768 ----a-w- c:windowssystem32driversavgtpx64.sys 2013-01-19 15:21 . 2013-01-31 02:06 -------- d-----w- c:program files (x86)Common FilesAVG Secure Search 2013-01-19 15:21 . 2013-02-12 14:09 -------- d-----w- c:program files (x86)AVG Secure Search 2013-01-19 15:20 . 2013-01-19 15:20 -------- d--h--w- c:programdataCommon Files 2013-01-19 15:19 . 2013-01-19 15:20 -------- d-----w- c:program files (x86)Common FilesNero 2013-01-19 15:19 . 2013-01-19 15:20 -------- d-----w- c:program files (x86)Nero 2013-01-19 15:19 . 2013-01-19 15:20 -------- d-----w- c:programdataNero . . . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-02-16 20:39 . 2012-08-11 22:04 32320 ----a-w- c:windowssystem32driversFNETTBOH_305.SYS
2013-01-11 00:11 . 2012-08-12 01:20 697864 ----a-w- c:windowsSysWow64FlashPlayerApp.exe 2013-01-11 00:11 . 2012-08-11 21:09 74248 ----a-w- c:windowsSysWow64FlashPlayerCPLApp.cpl 2012-12-18 13:06 . 2012-12-18 13:06 90112 ----a-w- c:windowsMAMCityDownload.ocx 2012-12-18 13:06 . 2012-12-18 13:06 330240 ----a-w- c:windowsMASetupCaller.dll 2012-12-18 13:06 . 2012-12-18 13:06 30568 ----a-w- c:windowsMusiccityDownload.exe 2012-12-18 13:06 . 2012-12-18 13:06 974848 ----a-w- c:windowsSysWow64cis-2.4.dll 2012-12-18 13:06 . 2012-12-18 13:06 81920 ----a-w- c:windowsSysWow64issacapi_bs-2.3.dll 2012-12-18 13:06 . 2012-12-18 13:06 65536 ----a-w- c:windowsSysWow64issacapi_pe-2.3.dll 2012-12-18 13:06 . 2012-12-18 13:06 57344 ----a-w- c:windowsSysWow64MTXSYNCICON.dll 2012-12-18 13:06 . 2012-12-18 13:06 57344 ----a-w- c:windowsSysWow64MK_Lyric.dll 2012-12-18 13:06 . 2012-12-18 13:06 57344 ----a-w- c:windowsSysWow64issacapi_se-2.3.dll 2012-12-18 13:06 . 2012-12-18 13:06 569344 ----a-w- c:windowsSysWow64muzdecode.ax 2012-12-18 13:06 . 2012-12-18 13:06 491520 ----a-w- c:windowsSysWow64muzapp.dll 2012-12-18 13:06 . 2012-12-18 13:06 49152 ----a-w- c:windowsSysWow64MaJGUILib.dll 2012-12-18 13:06 . 2012-12-18 13:06 45320 ----a-w- c:windowsSysWow64MAMACExtract.dll 2012-12-18 13:06 . 2012-12-18 13:06 45056 ----a-w- c:windowsSysWow64MaXMLProto.dll 2012-12-18 13:06 . 2012-12-18 13:06 45056 ----a-w- c:windowsSysWow64MACXMLProto.dll 2012-12-18 13:06 . 2012-12-18 13:06 40960 ----a-w- c:windowsSysWow64MTTELECHIP.dll 2012-12-18 13:06 . 2012-12-18 13:06 352256 ----a-w- c:windowsSysWow64MSLUR71.dll 2012-12-18 13:06 . 2012-12-18 13:06 258048 ----a-w- c:windowsSysWow64muzoggsp.ax 2012-12-18 13:06 . 2012-12-18 13:06 245760 ----a-w- c:windowsSysWow64MSCLib.dll 2012-12-18 13:06 . 2012-12-18 13:06 24576 ----a-w- c:windowsSysWow64MASetupCleaner.exe 2012-12-18 13:06 . 2012-12-18 13:06 200704 ----a-w- c:windowsSysWow64muzwmts.dll 2012-12-18 13:06 . 2012-12-18 13:06 155648 ----a-w- c:windowsSysWow64MSFLib.dll 2012-12-18 13:06 . 2012-12-18 13:06 143360 ----a-w- c:windowsSysWow643DAudio.ax 2012-12-18 13:06 . 2012-12-18 13:06 135168 ----a-w- c:windowsSysWow64muzaf1.dll 2012-12-18 13:06 . 2012-12-18 13:06 131072 ----a-w- c:windowsSysWow64muzmpgsp.ax 2012-12-18 13:06 . 2012-12-18 13:06 122880 ----a-w- c:windowsSysWow64muzeffect.ax 2012-12-18 13:06 . 2012-12-18 13:06 118784 ----a-w- c:windowsSysWow64MaDRM.dll 2012-12-18 13:06 . 2012-12-18 13:06 110592 ----a-w- c:windowsSysWow64muzmp4sp.ax . . (((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
. . *Nota* entradas vazias e legítimas por padrão não são apresentadas. REGEDIT4 . [HKEY_LOCAL_MACHINESOFTWAREWow6432Node~Browser Helper Objects{95B7759C- 8C7F-4BF1-B163-73684A933233}] 2013-02-12 14:08 1920688 ----a-w- c:program files (x86)AVG Secure Search14.1.0.10AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerToolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:program files (x86)AVG Secure Search14.1.0.10AVG Secure Search_toolbar.dll" [2013-02-12 1920688] . [HKEY_CLASSES_ROOTclsid{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOTAVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOTAVG Secure Search.PugiObj] . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "KiesPreload"="c:program files (x86)SamsungKiesKies.exe" [2012-12-20 1476104] . [HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun] "KiesTrayAgent"="c:program files (x86)SamsungKiesKiesTrayAgent.exe" [2012- 12-20 310280] . c:programdataMicrosoftWindowsStart MenuProgramsStartup Monitor Apache Servers.lnk - c:program files (x86)Apache Software FoundationApache2.2binApacheMonitor.exe [2011-9-9 41051] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversionwindows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:progra~1AgnitumOUTPOS~1wl_hook.dll . [HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversiondrivers32] "mixer3"=wdmaud.drv . R2 acssrv;Agnitum Client Security Service;c:progra~1AgnitumOUTPOS~1acs.exe [2012-06-15 3268448] R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:program files (x86)FinalWireAIDA64 Extreme Editionkerneld.x64 [2012-05-30 28320] R3 ASWFilt;ASWFilt;c:windowssystem32FiltASWFilt64.dll [2012-03-19 66184] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:windowssystem32DRIVERSssudbus.sys [2013-01-31 102368] R3 FNETTBOH_305;FNETTBOH_305;c:windowssystem32driversFNETTBOH_305.SYS [2013- 02-16 32320] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:windowssystem32DRIVERSssudmdm.sys [2013-01-31 203104] R3 X6va009;X6va009;c:windowsSysWOW64DriversX6va009 [x] R4 NAUpdate;Nero Update;c:program files (x86)NeroUpdateNASvc.exe [2012-07-13 769432] R4 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:program files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe [2012-05-15 382272] R4 vToolbarUpdater14.1.7;vToolbarUpdater14.1.7;c:program files (x86)Common FilesAVG Secure SearchvToolbarUpdater14.1.7ToolbarUpdater.exe [2013-02-12 965296] S1 afw;Agnitum Firewall Driver;c:windowssystem32DRIVERSafw.sys [2011-03-28
38488] S1 avgtp;avgtp;c:windowssystem32driversavgtpx64.sys [2013-02-12 39768] S1 FNETURPX;FNETURPX;c:windowssystem32driversFNETURPX.SYS [2012-08-11 15936] S1 SandBox;SandBox;c:windowssystem32driversSandBox64.sys [2012-03-19 1266544] S2 Apache2.2;Apache2.2;c:program files (x86)Apache Software FoundationApache2.2binhttpd.exe [2011-09-09 20549] S2 VBoxDrv;VBox Support Driver;c:program files (x86)YouWave_AndroidvbVBoxDrv.sys [2011-11-20 202592] S3 afwcore;afwcore;c:windowssystem32driversafwcore.sys [2012-06-14 445568] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [2012-08-11 1196032] . . Conteúdo da pasta 'Tarefas Agendadas' . 2013-02-16 c:windowsTasksAdobe Flash Player Updater.job - c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-08-12 00:11] . 2013-02-16 c:windowsTasksROC_JAN2013_TB_rmv.job - c:program files (x86)AVG Secure SearchPostInstallROC.exe [2013-01-31 02:06] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershellicon overlayidentifiersOutpost] @="{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" [HKEY_CLASSES_ROOTCLSID{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}] 2012-06-15 18:46 287408 ----a-w- c:program filesAgnitumOutpost Firewall Proop_shell.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "OutpostMonitor"="c:progra~1AgnitumOUTPOS~1op_mon.exe" [2012-06-15 4366392] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows] "AppInit_DLLs"=c:progra~1AgnitumOUTPOS~1wl_hook64.dll . ------- Scan Suplementar ------- . uLocal Page = c:windowssystem32blank.htm uStart Page = about:blank mStart Page = hxxp://www.searchya.com/?s=0&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487 mLocal Page = c:windowsSysWOW64blank.htm IE: &Download by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/201 IE: &Grab video by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/204 IE: Baixar com Mipony - file://c:program files (x86)MiPonyBrowserIEContext.htm IE: Do&wnload selected by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/203 IE: Down&load all by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/202 LSP: %SystemRoot%system32PrxerDrv.dll TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:program files (x86)Common FilesAVG Secure SearchViProtocolInstaller14.1.7ViProtocol.dll FF - ProfilePath - c:usersRedAppDataRoamingMozillaFirefoxProfilesf38n2r7c.default
FF - ExtSQL: 2013-01-19 13:21; avg@toolbar; c:programdataAVG Secure SearchFireFoxExt14.1.0.10 FF - user.js: extensions.funmoods.hmpg - true FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/? f=1&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN 0D0Tzu0StBtAyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1335891272 FF - user.js: extensions.funmoods.dfltSrch - true FF - user.js: extensions.funmoods.srchPrvdr - Search FF - user.js: extensions.funmoods.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/? f=2&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN 0D0Tzu0StBtAyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1335891272 FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/? f=3&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN 0D0Tzu0StBtAyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1335891272&q= FF - user.js: extensions.funmoods.id - 002522695355EFC2 FF - user.js: extensions.funmoods.instlDay - 15577 FF - user.js: extensions.funmoods.vrsn - 1.5.23.22 FF - user.js: extensions.funmoods.vrsni - 1.5.23.22 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2219:36 FF - user.js: extensions.funmoods.prtnrId - funmoods FF - user.js: extensions.funmoods.prdct - funmoods FF - user.js: extensions.funmoods.aflt - ironpub FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods.tlbrId - base FF - user.js: extensions.funmoods.instlRef - ironpub FF - user.js: extensions.funmoods.dfltLng - FF - user.js: extensions.funmoods.excTlbr - false FF - user.js: extensions.funmoods.autoRvrt - false FF - user.js: extensions.funmoods.envrmnt - production FF - user.js: extensions.funmoods.isdcmntcmplt - true FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0 FF - user.js: extensions.BabylonToolbar.autoRvrt - false FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/? babsrc=TB_def&mntrId=fce4efc2000000000000002522695355&q= FF - user.js: extensions.BabylonToolbar.id - fce4efc2000000000000002522695355 FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541- F8DE92DD98DB} FF - user.js: extensions.BabylonToolbar.instlDay - 15585 FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.9.12 FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.9.12 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.9.1211:28 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110808&tt=3512_8 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.searchya.hmpg - true FF - user.js: extensions.searchya.hmpgUrl - hxxp://www.searchya.com/? s=0&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487 FF - user.js: extensions.searchya.dfltSrch - true FF - user.js: extensions.searchya.srchPrvdr - Search
FF - user.js: extensions.searchya.dnsErr - true FF - user.js: extensions.searchya_i.newTab - true FF - user.js: extensions.searchya.newTabUrl - hxxp://www.searchya.com/? s=2&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487 FF - user.js: extensions.searchya.tlbrSrchUrl - hxxp://www.searchya.com/? s=3&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487&q= FF - user.js: extensions.searchya.id - 002522695355EFC2 FF - user.js: extensions.searchya.instlDay - 15585 FF - user.js: extensions.searchya.vrsn - 1.5.25.0 FF - user.js: extensions.searchya.vrsni - 1.5.25.0 FF - user.js: extensions.searchya_i.vrsnTs - 1.5.25.011:37 FF - user.js: extensions.searchya.prtnrId - searchya FF - user.js: extensions.searchya.prdct - searchya FF - user.js: extensions.searchya.aflt - foxtab FF - user.js: extensions.searchya_i.smplGrp - none FF - user.js: extensions.searchya.tlbrId - base FF - user.js: extensions.searchya.instlRef - tc-100 FF - user.js: extensions.searchya.dfltLng - FF - user.js: extensions.searchya.excTlbr - false FF - user.js: extensions.searchya.autoRvrt - false FF - user.js: extensions.searchya.envrmnt - production FF - user.js: extensions.searchya.isdcmntcmplt - true FF - user.js: extensions.searchya.mntrvrsn - 1.3.0 . - - - - ORFÃOS REMOVIDOS - - - - . BHO-{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - c:progra~2Funmoods1.5.23.22bhescort.dll Toolbar-{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - c:progra~2Funmoods1.5.23.22escorTlbr.dll Wow6432Node-HKCU-Run-KiesAirMessage - c:program files (x86)SamsungKiesKiesAirMessage.exe . . . [HKEY_LOCAL_MACHINESYSTEMControlSet001servicesAIDA64Driver] "ImagePath"="??c:program files (x86)FinalWireAIDA64 Extreme Editionkerneld.x64" . [HKEY_LOCAL_MACHINESYSTEMControlSet001servicesX6va009] "ImagePath"="??c:windowsSysWOW64DriversX6va009" . --------------------- CHAVES DO REGISTRO BLOQUEADAS --------------------- . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:Windowssystem32MacromedFlashFlashUtil64_11_5_502 _110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}LocalServer32] @="c:Windowssystem32MacromedFlashFlashUtil64_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-
0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4- 0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4- 0800200C9A66}ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4- 0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_5_502 _110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}LocalServer32] @="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}InprocServer32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}MiscStatus] @="0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}ToolboxBitmap32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx, 1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}Version]
@="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}InprocServer32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}ToolboxBitmap32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx, 1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}Version] @="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1- B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1- B0C4-0800200C9A66}ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1- B0C4-0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1- 08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity] @Denied: (Full) (Everyone) . Tempo para conclusão: 2013-02-16 19:05:27 ComboFix-quarantined-files.txt 2013-02-16 22:05 . Pré-execução: 83.803.574.272 bytes disponíveis
Pós execução: 88.894.566.400 bytes disponíveis . - - End Of File - - 3D19EA6D09A1C6663E6BC8E5F7A04275

More Related Content

TXT
Combo fix
FERNANDO FILINTO DA SILVA
 
TXT
Log file
scoundral
 
PDF
OSMC 2015: Linux Performance Profiling and Monitoring by Werner Fischer
NETWAYS
 
TXT
mmmm
DanicaPosadas
 
PDF
OSDC 2017 - Werner Fischer - Linux performance profiling and monitoring
NETWAYS
 
PPTX
了解IO协议栈
Feng Yu
 
PDF
Linux Performance Profiling and Monitoring
Georg Schönberger
 
PDF
Crash_Report_Mechanism_In_Tizen
Lex Yu
 
Combo fix
FERNANDO FILINTO DA SILVA
 
Log file
scoundral
 
OSMC 2015: Linux Performance Profiling and Monitoring by Werner Fischer
NETWAYS
 
mmmm
DanicaPosadas
 
OSDC 2017 - Werner Fischer - Linux performance profiling and monitoring
NETWAYS
 
了解IO协议栈
Feng Yu
 
Linux Performance Profiling and Monitoring
Georg Schönberger
 
Crash_Report_Mechanism_In_Tizen
Lex Yu
 

What's hot (17)

DOCX
Oracle 12c far sync standby instance
Monowar Mukul
 
PDF
Diseqc
Jakab Zsolt
 
DOC
SAV
Akash Indani
 
PDF
pstack, truss etc to understand deeper issues in Oracle database
Riyaj Shamsudeen
 
TXT
Casnewb
S Beng Lim
 
PDF
Hadoop Performance comparison
arunkumar sadhasivam
 
PDF
第5回CCMSハンズオン(ソフトウェア講習会): AkaiKKRチュートリアル 2. AkaiKKRの実習
Computational Materials Science Initiative
 
PPT
Dbms plan - A swiss army knife for performance engineers
Riyaj Shamsudeen
 
ODP
Advanced Diagnostics 2
Aero Plane
 
TXT
Quick reference for zookeeper commands
Rajkumar Asohan, PMP
 
DOC
Capital onehadoopclass
Doug Chang
 
PDF
스트리밍과 디지털 권리 관리
우영 주
 
PDF
My old security advisories on HMI/SCADA and industrial software released betw...
Luigi Auriemma
 
PDF
A close encounter_with_real_world_and_odd_perf_issues
Riyaj Shamsudeen
 
TXT
Error
Venkatesan Elangovan
 
PPTX
OpenWorld Sep14 12c for_developers
Connor McDonald
 
TXT
Quick reference for solr
Rajkumar Asohan, PMP
 
Oracle 12c far sync standby instance
Monowar Mukul
 
Diseqc
Jakab Zsolt
 
SAV
Akash Indani
 
pstack, truss etc to understand deeper issues in Oracle database
Riyaj Shamsudeen
 
Casnewb
S Beng Lim
 
Hadoop Performance comparison
arunkumar sadhasivam
 
第5回CCMSハンズオン(ソフトウェア講習会): AkaiKKRチュートリアル 2. AkaiKKRの実習
Computational Materials Science Initiative
 
Dbms plan - A swiss army knife for performance engineers
Riyaj Shamsudeen
 
Advanced Diagnostics 2
Aero Plane
 
Quick reference for zookeeper commands
Rajkumar Asohan, PMP
 
Capital onehadoopclass
Doug Chang
 
스트리밍과 디지털 권리 관리
우영 주
 
My old security advisories on HMI/SCADA and industrial software released betw...
Luigi Auriemma
 
A close encounter_with_real_world_and_odd_perf_issues
Riyaj Shamsudeen
 
Error
Venkatesan Elangovan
 
OpenWorld Sep14 12c for_developers
Connor McDonald
 
Quick reference for solr
Rajkumar Asohan, PMP
 
Ad

Viewers also liked (9)

PDF
Collaboration letter taxonomist
toniespeleo
 
PPTX
Trabalho sobre Pedro Nunes
anabelaac
 
PPT
Pedros Nunes
florbelaribeiro
 
PPTX
Estátua de Pedro Nunes
Vanda Pereira Bregieiro
 
DOCX
Pedro Nunes Andreia6ºB
tuchav
 
PPT
Pedro Nunes Daniel Rodrigues
danielrodrigues09
 
PPT
Biografia De Pedro Nunes
emilia1966
 
PPT
Climate Change and the Philippines
Jorge Golle
 
PPT
History of the philippines
Linzxshy Ckhrisky
 
Collaboration letter taxonomist
toniespeleo
 
Trabalho sobre Pedro Nunes
anabelaac
 
Pedros Nunes
florbelaribeiro
 
Estátua de Pedro Nunes
Vanda Pereira Bregieiro
 
Pedro Nunes Andreia6ºB
tuchav
 
Pedro Nunes Daniel Rodrigues
danielrodrigues09
 
Biografia De Pedro Nunes
emilia1966
 
Climate Change and the Philippines
Jorge Golle
 
History of the philippines
Linzxshy Ckhrisky
 
Ad

Similar to Combo fix (20)

TXT
Combo fix
FERNANDO FILINTO DA SILVA
 
TXT
Zhp diag
julian audouard
 
TXT
Frst
bpkole
 
PDF
JomaSoft VDCF - Solaris Private Cloud
JomaSoft
 
PDF
Attacking IoT Devices from a Web Perspective - Linux Day
Simone Onofri
 
TXT
Freefixer log
reiryuzaki
 
PDF
Oracle cluster installation with grid and iscsi
Chanaka Lasantha
 
PDF
Oracle cluster installation with grid and nfs
Chanaka Lasantha
 
DOCX
12c: Testing audit features for Data Pump (Export & Import) and RMAN jobs
Monowar Mukul
 
PDF
Software Livre - Parte 2
nuno.jose.duarte
 
PDF
Learning the command line
Adrian Cardenas
 
PDF
Backups
Svet Ivantchev
 
PPTX
mago3D workshop(English) in Thailand , 2018.07
Gaia3D,Inc.
 
TXT
C fosspeed setup_log
Ramadan Hasibuan
 
TXT
Prod java-error
Ramakrishna Chava
 
TXT
Prod java-error
Ramakrishna Chava
 
PDF
DCEU 18: Tips and Tricks of the Docker Captains
Docker, Inc.
 
PDF
Study on Android Emulator
Samael Wang
 
TXT
Dx diag
Duvan Pinzón
 
TXT
Illusion® v2 wpi
camilopascuaza18
 
Combo fix
FERNANDO FILINTO DA SILVA
 
Zhp diag
julian audouard
 
Frst
bpkole
 
JomaSoft VDCF - Solaris Private Cloud
JomaSoft
 
Attacking IoT Devices from a Web Perspective - Linux Day
Simone Onofri
 
Freefixer log
reiryuzaki
 
Oracle cluster installation with grid and iscsi
Chanaka Lasantha
 
Oracle cluster installation with grid and nfs
Chanaka Lasantha
 
12c: Testing audit features for Data Pump (Export & Import) and RMAN jobs
Monowar Mukul
 
Software Livre - Parte 2
nuno.jose.duarte
 
Learning the command line
Adrian Cardenas
 
Backups
Svet Ivantchev
 
mago3D workshop(English) in Thailand , 2018.07
Gaia3D,Inc.
 
C fosspeed setup_log
Ramadan Hasibuan
 
Prod java-error
Ramakrishna Chava
 
Prod java-error
Ramakrishna Chava
 
DCEU 18: Tips and Tricks of the Docker Captains
Docker, Inc.
 
Study on Android Emulator
Samael Wang
 
Dx diag
Duvan Pinzón
 
Illusion® v2 wpi
camilopascuaza18
 

Combo fix

  • 1. ComboFix 13-02-15.01 - Red 16/02/2013 18:55:48.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.55.1046.18.4095.3027 [GMT -3:00] Executando de: c:usersRedDesktopComboFix.exe FW: Outpost Firewall Pro *Disabled* {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615} SP: Outpost Firewall Pro *Disabled/Updated* {578B8A29-863D-0449-EF15- 3926A73ACBD3} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((( Outras Exclusões ))))))))))))))))))))))))))))))))))))))))))))))))))) . . c:usersRedguefae.exe c:windowsSysWow64muzapp.exe . . (((((((((((((((( Arquivos/Ficheiros criados de 2013-01-16 to 2013-02- 16 )))))))))))))))))))))))))))) . . 2013-02-16 22:02 . 2013-02-16 22:02 -------- d-----w- c:usersDefaultAppDataLocaltemp 2013-02-16 20:56 . 2013-01-31 08:19 203104 ----a-w- c:windowssystem32driversssudmdm.sys 2013-02-16 20:56 . 2013-01-31 08:19 102368 ----a-w- c:windowssystem32driversssudbus.sys 2013-02-16 20:51 . 2012-12-18 13:06 4659712 ----a-w- c:windowsSysWow64Redemption.dll 2013-02-16 20:51 . 2012-12-18 13:06 821824 ----a-w- c:windowsSysWow64dgderapi.dll 2013-02-16 20:50 . 2013-02-16 20:56 -------- d-----w- c:program files (x86)Samsung 2013-02-16 20:50 . 2013-02-16 20:55 -------- d-----w- c:programdataSamsung 2013-02-16 20:49 . 2013-02-16 20:49 -------- d-----w- c:usersRedAppDataLocalDownloaded Installations 2013-01-19 16:31 . 2013-01-19 16:31 -------- d-----w- c:usersRedAppDataRoamingNero 2013-01-19 15:21 . 2013-01-19 15:21 -------- d-----w- c:usersRedAppDataLocalAVG Secure Search 2013-01-19 15:21 . 2013-01-21 13:01 -------- d-----w- c:programdataAVG Secure Search 2013-01-19 15:21 . 2013-02-12 14:08 39768 ----a-w- c:windowssystem32driversavgtpx64.sys 2013-01-19 15:21 . 2013-01-31 02:06 -------- d-----w- c:program files (x86)Common FilesAVG Secure Search 2013-01-19 15:21 . 2013-02-12 14:09 -------- d-----w- c:program files (x86)AVG Secure Search 2013-01-19 15:20 . 2013-01-19 15:20 -------- d--h--w- c:programdataCommon Files 2013-01-19 15:19 . 2013-01-19 15:20 -------- d-----w- c:program files (x86)Common FilesNero 2013-01-19 15:19 . 2013-01-19 15:20 -------- d-----w- c:program files (x86)Nero 2013-01-19 15:19 . 2013-01-19 15:20 -------- d-----w- c:programdataNero . . . ((((((((((((((((((((((((((((((((((((( Relatório Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-02-16 20:39 . 2012-08-11 22:04 32320 ----a-w- c:windowssystem32driversFNETTBOH_305.SYS
  • 2. 2013-01-11 00:11 . 2012-08-12 01:20 697864 ----a-w- c:windowsSysWow64FlashPlayerApp.exe 2013-01-11 00:11 . 2012-08-11 21:09 74248 ----a-w- c:windowsSysWow64FlashPlayerCPLApp.cpl 2012-12-18 13:06 . 2012-12-18 13:06 90112 ----a-w- c:windowsMAMCityDownload.ocx 2012-12-18 13:06 . 2012-12-18 13:06 330240 ----a-w- c:windowsMASetupCaller.dll 2012-12-18 13:06 . 2012-12-18 13:06 30568 ----a-w- c:windowsMusiccityDownload.exe 2012-12-18 13:06 . 2012-12-18 13:06 974848 ----a-w- c:windowsSysWow64cis-2.4.dll 2012-12-18 13:06 . 2012-12-18 13:06 81920 ----a-w- c:windowsSysWow64issacapi_bs-2.3.dll 2012-12-18 13:06 . 2012-12-18 13:06 65536 ----a-w- c:windowsSysWow64issacapi_pe-2.3.dll 2012-12-18 13:06 . 2012-12-18 13:06 57344 ----a-w- c:windowsSysWow64MTXSYNCICON.dll 2012-12-18 13:06 . 2012-12-18 13:06 57344 ----a-w- c:windowsSysWow64MK_Lyric.dll 2012-12-18 13:06 . 2012-12-18 13:06 57344 ----a-w- c:windowsSysWow64issacapi_se-2.3.dll 2012-12-18 13:06 . 2012-12-18 13:06 569344 ----a-w- c:windowsSysWow64muzdecode.ax 2012-12-18 13:06 . 2012-12-18 13:06 491520 ----a-w- c:windowsSysWow64muzapp.dll 2012-12-18 13:06 . 2012-12-18 13:06 49152 ----a-w- c:windowsSysWow64MaJGUILib.dll 2012-12-18 13:06 . 2012-12-18 13:06 45320 ----a-w- c:windowsSysWow64MAMACExtract.dll 2012-12-18 13:06 . 2012-12-18 13:06 45056 ----a-w- c:windowsSysWow64MaXMLProto.dll 2012-12-18 13:06 . 2012-12-18 13:06 45056 ----a-w- c:windowsSysWow64MACXMLProto.dll 2012-12-18 13:06 . 2012-12-18 13:06 40960 ----a-w- c:windowsSysWow64MTTELECHIP.dll 2012-12-18 13:06 . 2012-12-18 13:06 352256 ----a-w- c:windowsSysWow64MSLUR71.dll 2012-12-18 13:06 . 2012-12-18 13:06 258048 ----a-w- c:windowsSysWow64muzoggsp.ax 2012-12-18 13:06 . 2012-12-18 13:06 245760 ----a-w- c:windowsSysWow64MSCLib.dll 2012-12-18 13:06 . 2012-12-18 13:06 24576 ----a-w- c:windowsSysWow64MASetupCleaner.exe 2012-12-18 13:06 . 2012-12-18 13:06 200704 ----a-w- c:windowsSysWow64muzwmts.dll 2012-12-18 13:06 . 2012-12-18 13:06 155648 ----a-w- c:windowsSysWow64MSFLib.dll 2012-12-18 13:06 . 2012-12-18 13:06 143360 ----a-w- c:windowsSysWow643DAudio.ax 2012-12-18 13:06 . 2012-12-18 13:06 135168 ----a-w- c:windowsSysWow64muzaf1.dll 2012-12-18 13:06 . 2012-12-18 13:06 131072 ----a-w- c:windowsSysWow64muzmpgsp.ax 2012-12-18 13:06 . 2012-12-18 13:06 122880 ----a-w- c:windowsSysWow64muzeffect.ax 2012-12-18 13:06 . 2012-12-18 13:06 118784 ----a-w- c:windowsSysWow64MaDRM.dll 2012-12-18 13:06 . 2012-12-18 13:06 110592 ----a-w- c:windowsSysWow64muzmp4sp.ax . . (((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
  • 3. . . *Nota* entradas vazias e legítimas por padrão não são apresentadas. REGEDIT4 . [HKEY_LOCAL_MACHINESOFTWAREWow6432Node~Browser Helper Objects{95B7759C- 8C7F-4BF1-B163-73684A933233}] 2013-02-12 14:08 1920688 ----a-w- c:program files (x86)AVG Secure Search14.1.0.10AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerToolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:program files (x86)AVG Secure Search14.1.0.10AVG Secure Search_toolbar.dll" [2013-02-12 1920688] . [HKEY_CLASSES_ROOTclsid{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOTAVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOTAVG Secure Search.PugiObj] . [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun] "KiesPreload"="c:program files (x86)SamsungKiesKies.exe" [2012-12-20 1476104] . [HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun] "KiesTrayAgent"="c:program files (x86)SamsungKiesKiesTrayAgent.exe" [2012- 12-20 310280] . c:programdataMicrosoftWindowsStart MenuProgramsStartup Monitor Apache Servers.lnk - c:program files (x86)Apache Software FoundationApache2.2binApacheMonitor.exe [2011-9-9 41051] . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversionwindows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:progra~1AgnitumOUTPOS~1wl_hook.dll . [HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversiondrivers32] "mixer3"=wdmaud.drv . R2 acssrv;Agnitum Client Security Service;c:progra~1AgnitumOUTPOS~1acs.exe [2012-06-15 3268448] R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:program files (x86)FinalWireAIDA64 Extreme Editionkerneld.x64 [2012-05-30 28320] R3 ASWFilt;ASWFilt;c:windowssystem32FiltASWFilt64.dll [2012-03-19 66184] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:windowssystem32DRIVERSssudbus.sys [2013-01-31 102368] R3 FNETTBOH_305;FNETTBOH_305;c:windowssystem32driversFNETTBOH_305.SYS [2013- 02-16 32320] R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:windowssystem32DRIVERSssudmdm.sys [2013-01-31 203104] R3 X6va009;X6va009;c:windowsSysWOW64DriversX6va009 [x] R4 NAUpdate;Nero Update;c:program files (x86)NeroUpdateNASvc.exe [2012-07-13 769432] R4 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:program files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe [2012-05-15 382272] R4 vToolbarUpdater14.1.7;vToolbarUpdater14.1.7;c:program files (x86)Common FilesAVG Secure SearchvToolbarUpdater14.1.7ToolbarUpdater.exe [2013-02-12 965296] S1 afw;Agnitum Firewall Driver;c:windowssystem32DRIVERSafw.sys [2011-03-28
  • 4. 38488] S1 avgtp;avgtp;c:windowssystem32driversavgtpx64.sys [2013-02-12 39768] S1 FNETURPX;FNETURPX;c:windowssystem32driversFNETURPX.SYS [2012-08-11 15936] S1 SandBox;SandBox;c:windowssystem32driversSandBox64.sys [2012-03-19 1266544] S2 Apache2.2;Apache2.2;c:program files (x86)Apache Software FoundationApache2.2binhttpd.exe [2011-09-09 20549] S2 VBoxDrv;VBox Support Driver;c:program files (x86)YouWave_AndroidvbVBoxDrv.sys [2011-11-20 202592] S3 afwcore;afwcore;c:windowssystem32driversafwcore.sys [2012-06-14 445568] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:windowssystem32driversviahduaa.sys [2012-08-11 1196032] . . Conteúdo da pasta 'Tarefas Agendadas' . 2013-02-16 c:windowsTasksAdobe Flash Player Updater.job - c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-08-12 00:11] . 2013-02-16 c:windowsTasksROC_JAN2013_TB_rmv.job - c:program files (x86)AVG Secure SearchPostInstallROC.exe [2013-01-31 02:06] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershellicon overlayidentifiersOutpost] @="{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" [HKEY_CLASSES_ROOTCLSID{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}] 2012-06-15 18:46 287408 ----a-w- c:program filesAgnitumOutpost Firewall Proop_shell.dll . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] "OutpostMonitor"="c:progra~1AgnitumOUTPOS~1op_mon.exe" [2012-06-15 4366392] . [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows] "AppInit_DLLs"=c:progra~1AgnitumOUTPOS~1wl_hook64.dll . ------- Scan Suplementar ------- . uLocal Page = c:windowssystem32blank.htm uStart Page = about:blank mStart Page = hxxp://www.searchya.com/?s=0&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487 mLocal Page = c:windowsSysWOW64blank.htm IE: &Download by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/201 IE: &Grab video by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/204 IE: Baixar com Mipony - file://c:program files (x86)MiPonyBrowserIEContext.htm IE: Do&wnload selected by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/203 IE: Down&load all by Orbit - c:program files (x86)Orbitdownloaderorbitmxt.dll/202 LSP: %SystemRoot%system32PrxerDrv.dll TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:program files (x86)Common FilesAVG Secure SearchViProtocolInstaller14.1.7ViProtocol.dll FF - ProfilePath - c:usersRedAppDataRoamingMozillaFirefoxProfilesf38n2r7c.default
  • 5. FF - ExtSQL: 2013-01-19 13:21; avg@toolbar; c:programdataAVG Secure SearchFireFoxExt14.1.0.10 FF - user.js: extensions.funmoods.hmpg - true FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/? f=1&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN 0D0Tzu0StBtAyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1335891272 FF - user.js: extensions.funmoods.dfltSrch - true FF - user.js: extensions.funmoods.srchPrvdr - Search FF - user.js: extensions.funmoods.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/? f=2&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN 0D0Tzu0StBtAyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1335891272 FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://start.funmoods.com/? f=3&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN 0D0Tzu0StBtAyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1335891272&q= FF - user.js: extensions.funmoods.id - 002522695355EFC2 FF - user.js: extensions.funmoods.instlDay - 15577 FF - user.js: extensions.funmoods.vrsn - 1.5.23.22 FF - user.js: extensions.funmoods.vrsni - 1.5.23.22 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2219:36 FF - user.js: extensions.funmoods.prtnrId - funmoods FF - user.js: extensions.funmoods.prdct - funmoods FF - user.js: extensions.funmoods.aflt - ironpub FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods.tlbrId - base FF - user.js: extensions.funmoods.instlRef - ironpub FF - user.js: extensions.funmoods.dfltLng - FF - user.js: extensions.funmoods.excTlbr - false FF - user.js: extensions.funmoods.autoRvrt - false FF - user.js: extensions.funmoods.envrmnt - production FF - user.js: extensions.funmoods.isdcmntcmplt - true FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0 FF - user.js: extensions.BabylonToolbar.autoRvrt - false FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/? babsrc=TB_def&mntrId=fce4efc2000000000000002522695355&q= FF - user.js: extensions.BabylonToolbar.id - fce4efc2000000000000002522695355 FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541- F8DE92DD98DB} FF - user.js: extensions.BabylonToolbar.instlDay - 15585 FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.9.12 FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.9.12 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.9.1211:28 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110808&tt=3512_8 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.searchya.hmpg - true FF - user.js: extensions.searchya.hmpgUrl - hxxp://www.searchya.com/? s=0&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487 FF - user.js: extensions.searchya.dfltSrch - true FF - user.js: extensions.searchya.srchPrvdr - Search
  • 6. FF - user.js: extensions.searchya.dnsErr - true FF - user.js: extensions.searchya_i.newTab - true FF - user.js: extensions.searchya.newTabUrl - hxxp://www.searchya.com/? s=2&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487 FF - user.js: extensions.searchya.tlbrSrchUrl - hxxp://www.searchya.com/? s=3&a=foxtab&chnl=tc- 100&cd=2XzuyEtN2Y1L1QzutDtDtByDtBtByCzyyDtAyDyD0E0F0CtBtN0D0Tzu0StByEyDtN1L2Xzut BtFtCtFtCtFtAtCtB&cr=902815487&q= FF - user.js: extensions.searchya.id - 002522695355EFC2 FF - user.js: extensions.searchya.instlDay - 15585 FF - user.js: extensions.searchya.vrsn - 1.5.25.0 FF - user.js: extensions.searchya.vrsni - 1.5.25.0 FF - user.js: extensions.searchya_i.vrsnTs - 1.5.25.011:37 FF - user.js: extensions.searchya.prtnrId - searchya FF - user.js: extensions.searchya.prdct - searchya FF - user.js: extensions.searchya.aflt - foxtab FF - user.js: extensions.searchya_i.smplGrp - none FF - user.js: extensions.searchya.tlbrId - base FF - user.js: extensions.searchya.instlRef - tc-100 FF - user.js: extensions.searchya.dfltLng - FF - user.js: extensions.searchya.excTlbr - false FF - user.js: extensions.searchya.autoRvrt - false FF - user.js: extensions.searchya.envrmnt - production FF - user.js: extensions.searchya.isdcmntcmplt - true FF - user.js: extensions.searchya.mntrvrsn - 1.3.0 . - - - - ORFÃOS REMOVIDOS - - - - . BHO-{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - c:progra~2Funmoods1.5.23.22bhescort.dll Toolbar-{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - c:progra~2Funmoods1.5.23.22escorTlbr.dll Wow6432Node-HKCU-Run-KiesAirMessage - c:program files (x86)SamsungKiesKiesAirMessage.exe . . . [HKEY_LOCAL_MACHINESYSTEMControlSet001servicesAIDA64Driver] "ImagePath"="??c:program files (x86)FinalWireAIDA64 Extreme Editionkerneld.x64" . [HKEY_LOCAL_MACHINESYSTEMControlSet001servicesX6va009] "ImagePath"="??c:windowsSysWOW64DriversX6va009" . --------------------- CHAVES DO REGISTRO BLOQUEADAS --------------------- . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:Windowssystem32MacromedFlashFlashUtil64_11_5_502 _110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}LocalServer32] @="c:Windowssystem32MacromedFlashFlashUtil64_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{73C9DFA0-750D-11E1-B0C4-
  • 7. 0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4- 0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4- 0800200C9A66}ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINESOFTWAREClassesInterface{6AE38AE0-750C-11E1-B0C4- 0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_5_502 _110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}LocalServer32] @="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{73C9DFA0-750D-11E1-B0C4- 0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}InprocServer32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}MiscStatus] @="0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}ToolboxBitmap32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx, 1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}Version]
  • 8. @="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8- 444553540000}VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}InprocServer32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}ToolboxBitmap32] @="c:WindowsSysWOW64MacromedFlashFlash32_11_5_502_110.ocx, 1" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}Version] @="1.0" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8- 444553540000}VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1- B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1- B0C4-0800200C9A66}ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINESOFTWAREClassesWow6432NodeInterface{6AE38AE0-750C-11E1- B0C4-0800200C9A66}TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1- 08002BE10318}0000AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity] @Denied: (Full) (Everyone) . Tempo para conclusão: 2013-02-16 19:05:27 ComboFix-quarantined-files.txt 2013-02-16 22:05 . Pré-execução: 83.803.574.272 bytes disponíveis
  • 9. Pós execução: 88.894.566.400 bytes disponíveis . - - End Of File - - 3D19EA6D09A1C6663E6BC8E5F7A04275