BleepingComputer.com: virus found CSRCS.EXE

Jump to content

Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

virus found CSRCS.EXE LOG FILE COMBOFIX

#1 User is offline   edson4000 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 1
  • Joined: 23-November 09

  Posted 23 November 2009 - 05:13 PM

Hi everybody, please help-me

every time that i put my pendrive in my pc, the antivirus avast acuse the virus csrcs.exe, so, i already went to the register and found this and removed it.

but every time that I inicialize the operational system a message is show "cant find csrcs.exe" (something like that)
so, I run the combofix program and it generate this log, please, help-me:

thank you so much

ComboFix 09-11-22.08 - User 23/11/2009 19:51.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.3033.2618 [GMT -3:00]
Executando de: c:\documents and settings\User\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091123-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-10-23 to 2009-11-23 ))))))))))))))))))))))))))))
.

2009-11-23 22:01 . 2009-11-23 22:01 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-11-23 20:58 . 2009-11-23 20:58 -------- d-----w- c:\arquivos de programas\Microsoft Visual Studio .NET
2009-11-23 20:57 . 2009-11-23 20:59 -------- d-----w- C:\oraclexe
2009-11-23 19:15 . 2009-11-23 19:15 216933372 ----a-w- c:\arquivos de programas\38127_oracle_database_express_edition_10g_release_2.exe
2009-11-22 19:50 . 2009-11-22 19:50 -------- d-----w- c:\arquivos de programas\VS Revo Group
2009-11-22 18:45 . 2009-11-22 18:45 -------- d-----w- c:\windows\Sun
2009-11-21 14:41 . 2009-11-21 14:41 -------- d-----w- c:\arquivos de programas\Microsoft SQL Server
2009-11-21 14:41 . 2009-11-21 14:41 -------- d-----w- c:\arquivos de programas\Microsoft Silverlight
2009-11-21 14:41 . 2009-11-21 14:41 -------- d-----w- c:\arquivos de programas\Microsoft Synchronization Services
2009-11-21 14:41 . 2009-11-21 14:41 -------- d-----w- c:\arquivos de programas\Microsoft SQL Server Compact Edition
2009-11-21 14:41 . 2009-11-21 14:41 187328 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll
2009-11-21 14:40 . 2009-11-21 14:40 416 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-11-21 14:39 . 2009-11-21 14:41 -------- d-----w- c:\arquivos de programas\Microsoft Visual Studio 9.0
2009-11-21 14:39 . 2009-11-21 14:39 -------- d-----w- c:\arquivos de programas\Microsoft.NET
2009-11-21 14:39 . 2009-11-21 14:39 -------- d-----w- c:\arquivos de programas\Microsoft SDKs
2009-11-21 14:38 . 2009-11-21 14:38 -------- d-----w- c:\windows\system32\XPSViewer
2009-11-21 14:38 . 2009-11-21 14:38 -------- d-----w- c:\arquivos de programas\Reference Assemblies
2009-11-21 14:38 . 2009-11-21 14:38 -------- d-----w- C:\f7b175f8ad51cb1a50e43c142df15f99
2009-11-21 14:38 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-11-21 14:38 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-11-21 14:38 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-11-21 14:38 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-11-21 14:38 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-11-21 14:38 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-11-21 14:38 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-11-20 03:31 . 2009-11-20 03:31 2729464 ----a-w- c:\arquivos de programas\vbsetup.exe
2009-11-20 03:30 . 2009-11-20 03:31 2714112 ----a-w- c:\arquivos de programas\vcssetup.exe
2009-11-14 13:13 . 2008-04-13 22:20 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-11-14 13:13 . 2008-04-13 22:20 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-11-14 13:13 . 2008-04-13 21:58 14720 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2009-11-14 13:13 . 2008-04-13 21:58 14720 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2009-11-14 13:13 . 2008-04-13 14:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-11-14 13:13 . 2008-04-13 14:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-11-14 13:13 . 2008-04-13 14:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-11-14 13:13 . 2008-04-13 14:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-07 21:59 . 2009-11-23 20:00 -------- d-----w- c:\documents and settings\User\Tracing
2009-11-07 21:57 . 2009-11-07 21:57 -------- d-----w- c:\arquivos de programas\Microsoft
2009-11-07 21:56 . 2009-11-07 21:56 -------- d-----w- c:\arquivos de programas\Windows Live SkyDrive
2009-11-07 21:56 . 2009-11-07 21:57 -------- d-----w- c:\arquivos de programas\Windows Live
2009-11-07 21:50 . 2009-11-07 21:50 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Windows Live
2009-11-07 21:45 . 2009-11-07 21:45 -------- d-----w- c:\arquivos de programas\MSXML 4.0
2009-11-07 21:04 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-11-07 21:03 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-11-07 21:01 . 2009-08-05 01:57 2193408 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-11-07 21:01 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-11-07 21:01 . 2009-08-04 17:27 2149376 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-11-07 21:01 . 2009-06-25 08:27 732672 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-11-07 21:01 . 2009-03-06 14:20 286208 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-11-07 21:01 . 2009-02-09 11:25 111104 -c----w- c:\windows\system32\dllcache\services.exe
2009-11-07 21:01 . 2009-02-09 10:53 730624 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-11-07 21:01 . 2009-02-09 10:53 683520 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-11-07 21:01 . 2009-02-09 10:53 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-11-07 21:01 . 2009-02-09 10:53 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-11-07 21:01 . 2009-02-09 10:53 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-11-07 21:01 . 2009-08-04 17:27 2028032 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-11-07 21:00 . 2008-04-21 21:15 216064 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-11-07 21:00 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-11-07 20:59 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-11-07 20:59 . 2008-09-04 17:16 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-11-07 20:59 . 2008-10-15 16:36 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-11-07 20:59 . 2008-05-01 14:36 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-11-07 20:58 . 2008-04-11 19:05 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-11-07 20:58 . 2009-08-13 15:21 512000 -c----w- c:\windows\system32\dllcache\jscript.dll
2009-11-07 20:58 . 2008-05-09 10:55 90112 -c----w- c:\windows\system32\dllcache\wshext.dll
2009-11-07 20:58 . 2008-05-09 10:55 430080 -c----w- c:\windows\system32\dllcache\vbscript.dll
2009-11-07 20:58 . 2008-05-09 10:55 180224 -c----w- c:\windows\system32\dllcache\scrobj.dll
2009-11-07 20:58 . 2008-05-09 10:55 172032 -c----w- c:\windows\system32\dllcache\scrrun.dll
2009-11-07 20:58 . 2008-05-09 08:45 135168 -c----w- c:\windows\system32\dllcache\cscript.exe
2009-11-07 20:58 . 2008-05-08 11:24 155648 -c----w- c:\windows\system32\dllcache\wscript.exe
2009-11-07 20:58 . 2008-06-14 17:34 272384 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-11-07 20:58 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-11-07 20:53 . 2008-10-16 17:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-11-07 20:47 . 2004-08-04 03:45 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-11-07 20:39 . 2008-04-13 22:20 32285 ------w- c:\windows\system32\hsfcisp2.dll
2009-11-07 20:38 . 2009-11-07 20:40 -------- d-----w- c:\windows\ServicePackFiles
2009-11-07 20:28 . 2009-11-07 20:28 -------- d-----w- C:\Tools
2009-11-07 19:27 . 2009-11-07 19:27 -------- d-----w- c:\windows\system32\Adobe
2009-11-07 19:23 . 2009-11-07 19:24 1962544 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-11-07 19:23 . 2009-11-07 20:31 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\NOS
2009-11-07 19:22 . 2009-11-20 03:33 -------- d-----w- c:\documents and settings\User\Dados de aplicativos\LimeWire
2009-11-07 19:22 . 2009-11-07 19:22 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-07 19:22 . 2009-11-07 19:22 -------- d-----w- c:\arquivos de programas\Java
2009-11-07 19:22 . 2009-11-07 19:22 152576 ----a-w- c:\documents and settings\User\Dados de aplicativos\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-07 19:20 . 2009-11-07 19:20 -------- d-----w- c:\arquivos de programas\LimeWire
2009-11-07 19:19 . 2009-11-07 19:19 -------- d-----w- c:\documents and settings\User\Dados de aplicativos\TeamViewer
2009-11-07 19:19 . 2009-11-07 19:19 -------- d-----w- c:\arquivos de programas\TeamViewer
2009-11-07 19:19 . 2009-11-07 19:19 -------- d-----w- c:\documents and settings\User\temp
2009-11-07 19:19 . 2009-11-07 19:19 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\DVD Shrink
2009-11-07 19:19 . 2009-11-07 19:19 -------- d-----w- c:\arquivos de programas\DVD Shrink
2009-11-07 19:15 . 2009-11-07 21:43 -------- d-----w- c:\windows\system32\pt-br
2009-11-07 19:13 . 2009-11-07 22:07 -------- d--h--w- c:\windows\$hf_mig$
2009-11-07 19:11 . 2008-04-13 22:20 26624 ----a-w- c:\documents and settings\LocalService\Dados de aplicativos\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-11-07 19:11 . 2009-11-07 19:11 -------- d-----w- c:\arquivos de programas\Windows Media Connect 2
2009-11-07 19:10 . 2009-11-07 19:10 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-11-07 19:10 . 2009-11-07 19:10 -------- d-----w- c:\windows\system32\LogFiles
2009-11-07 19:01 . 2009-11-23 17:50 -------- d-----w- c:\documents and settings\User\Dados de aplicativos\CyberLink
2009-11-07 19:00 . 2009-11-23 17:50 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\CyberLink

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-23 21:08 . 2009-11-07 18:24 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information
2009-11-23 20:59 . 2009-11-07 18:19 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help
2009-11-23 20:57 . 2009-11-07 18:23 -------- d-----w- c:\arquivos de programas\Arquivos comuns\InstallShield
2009-11-21 15:05 . 2009-11-07 18:56 -------- d-----w- c:\arquivos de programas\SUPERAntiSpyware
2009-11-21 14:39 . 2001-10-28 13:07 80464 ----a-w- c:\windows\system32\perfc016.dat
2009-11-21 14:39 . 2001-10-28 13:07 473672 ----a-w- c:\windows\system32\perfh016.dat
2009-11-21 14:38 . 2009-11-07 18:21 -------- d-----w- c:\arquivos de programas\MSBuild
2009-11-07 22:12 . 2009-11-07 18:21 -------- d-----w- c:\arquivos de programas\Microsoft Works
2009-11-07 20:40 . 2009-11-07 18:10 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-07 19:09 . 2009-11-07 19:09 2232 ----a-w- c:\windows\java\Packages\Data\JBXRHVFZ.DAT
2009-11-07 19:09 . 2009-11-07 19:09 155995 ----a-w- c:\windows\java\Packages\3VVNLNZZ.ZIP
2009-11-07 19:09 . 2009-11-07 19:09 2678 ----a-w- c:\windows\java\Packages\Data\GLVP3F35.DAT
2009-11-07 19:09 . 2009-11-07 19:09 2678 ----a-w- c:\windows\java\Packages\Data\S931J1N9.DAT
2009-11-07 19:09 . 2009-11-07 19:09 2678 ----a-w- c:\windows\java\Packages\Data\MLBVP3JR.DAT
2009-11-07 19:09 . 2009-11-07 19:09 2678 ----a-w- c:\windows\java\Packages\Data\GVLRXVDR.DAT
2009-11-07 19:09 . 2009-11-07 19:09 2678 ----a-w- c:\windows\java\Packages\Data\3ZB79337.DAT
2009-11-07 18:59 . 2009-11-07 18:59 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\WinZip
2009-11-07 18:58 . 2009-11-07 18:57 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Adobe
2009-11-07 18:57 . 2009-11-07 18:57 117760 ----a-w- c:\documents and settings\User\Dados de aplicativos\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-07 18:56 . 2009-11-07 18:56 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com
2009-11-07 18:56 . 2009-11-07 18:56 -------- d-----w- c:\documents and settings\User\Dados de aplicativos\SUPERAntiSpyware.com
2009-11-07 18:56 . 2009-11-07 18:56 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-09-11 14:19 . 2004-08-04 03:45 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:04 . 2004-08-04 03:45 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:29 . 2004-08-04 03:45 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:29 . 2004-08-04 03:45 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:29 . 2004-08-04 03:45 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:01 . 2004-08-04 03:45 247326 ----a-w- c:\windows\system32\strmdll.dll
.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"RemoteControl"="c:\arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut"="c:\arquivos de programas\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]
"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\arquivos de programas\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208]
"InCD"="c:\arquivos de programas\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 134656]
"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-11-07 149280]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-12-23 18077696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\arquivos de programas\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 17:21 548352 ----a-w- c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Arquivos de programas\\TeamViewer\\Version4\\TeamViewer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7/11/2009 15:52 114768]
R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\SUPERAntiSpyware\sasdifsv.sys [12/10/2009 20:24 9968]
R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\SUPERAntiSpyware\SASKUTIL.SYS [12/10/2009 20:24 74480]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/11/2009 15:52 20560]
R2 OracleServiceXE;OracleServiceXE;c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE --> c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE [?]
S2 OracleXETNSListener;OracleXETNSListener;c:\oraclexe\app\oracle\product\10.2.0\server\BIN\TNSLSNR.EXE [2/2/2006 00:49 204800]
S3 SASENUM;SASENUM;c:\arquivos de programas\SUPERAntiSpyware\SASENUM.SYS [12/10/2009 20:24 7408]
S4 OracleJobSchedulerXE;OracleJobSchedulerXE;c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE --> c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE [?]
.
.
------- Scan Suplementar -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Explorer_Run-csrcs - c:\windows\system32\csrcs.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-23 19:54
Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3604)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Tempo para conclusão: 2009-11-23 19:55
ComboFix-quarantined-files.txt 2009-11-23 22:55

Pré-execução: 9 pasta(s) 486.315.294.720 bytes disponíveis
Pós execução: 12 pasta(s) 486.342.799.360 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 839669E46F49915080492E3473D83B1F

#2 User is offline   Animal 

  • Bleepin' Animinion
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Site Admin
  • Posts: 18,909
  • Joined: 18-August 05
  • Gender:Male
  • Location:Location, Location

Posted 23 November 2009 - 05:36 PM

Please note the message text in blue at the top of the Am I infected? What do I do? forum.

ComboFix logs should not to be posted outside the HijackThis forums and then only when requested by a HJT Team member. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for general public or personal use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Please create a new topic explaining the nature of your problem in the Am I infected? What do I do? forum. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results.

If needed, we will direct you to our HJT Preparation Guide.

Thank you for using BleepingComputer as your malware removal source.

This topic is now closed. If you have any questions, please PM a Moderator.
The BC Staff/Animal
The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown

Posted Image
A learning experience is one of those things that say, "You know that thing you just did? Don't do that." — Douglas Adams.
Why is the word abbreviation so long?
Follow BleepingComputer on: Facebook | Twitter | Google+

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users