Publicado em 19 de fev.

[Arquivado] &nbspÁnalise de Log

Bom,

To precisando que analisem o log retirado hoje via HijackThis, meu computador ta meio lerdo e quando abro o Internet Explorer abre duas vezes o processo e a mesma coisa anda acontecendo com o Chrome (só o Firefox que to usando).

Estou usando o Kaspersky PURE 9.1.0.124 e não esta adiantando...

Segue Log:

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 00:17:27, on 19/2/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Arquivos de programas\Arquivos comuns\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\avp.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orkut.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 109.123.70.47:80

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local

O1 - Hosts: 173.192.170.88 drghwaweg45j4i6u3q32fg2h.com

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HDAudDeck] C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe"

O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\avp.exe"

O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Arquivos de programas\Arquivos comuns\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Arquivos de programas\Arquivos comuns\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: Adicionar ao Antibanner - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm

O8 - Extra context menu item: Advanced Email Extractor - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Scan link with AEE - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/link.html

O9 - Extra button: &Teclado Virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Veri&ficação de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra button: Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: Advanced Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Arquivos%20de%20programas\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1286333767890

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\ARQUIV~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\avp.exe

O23 - Service: CryptoStorage control service (CSObjectsSrv) - Infowatch - C:\Arquivos de programas\Arquivos comuns\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Arquivos de programas\Arquivos comuns\Adobe\SwitchBoard\SwitchBoard.exe

End of file - 8290 bytes

Discussão (14)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

Renato Utsch· 19 de fev.

Olá!

Seja bem vindo à seção de Remoção de Malwares do Imasters Fórums!

Por favor, siga as instruções abaixo:

Faça o Download do DDS e salve no Desktop (Área de trabalho).

Temporariamente desative os seus programas de proteção.

Duplo clique em dds.scr.

Irá surgir uma tela preta com algumas informações. Não clique em nada, apenas aguarde!

Quando terminar, duas janelas abrirão: DDS.txt e Attach.txt.

Salve o resultado e cole-o no seu tópico.

OBS: Caso o link disponibilizado não funcione, tente baixar o DDS por ESTE link.

Abraços :D

Working System· 19 de fev.

Opa...obrigado pela resposta brother...segue o DDS.txt:

>
DDS (Ver_10-12-12.02) - NTFSx86

Run by Roseli Mareti at 14:13:21,04 on s b 19/02/2011

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1918.1196 [GMT -2:00]

AV: avast! Antivirus Enabled/Updated {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: Kaspersky PURE Disabled/Updated {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky PURE Disabled

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Arquivos de programas\Arquivos comuns\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Arquivos de programas\Arquivos comuns\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe

C:\Arquivos de programas\Alwil Software\Avast5\AvastUI.exe

C:\Arquivos de programas\uTorrent\uTorrent.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Outlook Express\msimn.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\Roseli Mareti\Meus documentos\Lucas\Nova pasta\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.orkut.com/

uSearch Page =

uSearch Bar =

uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

uInternet Settings,ProxyOverride = local

uInternet Settings,ProxyServer = 109.123.70.47:80

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Auxiliar de Conexão do Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\arquivos de programas\arquivos comuns\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\arquivos de programas\kaspersky lab\kaspersky pure\klwtbbho.dll

TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [MsnMsgr] "c:\arquivos de programas\windows live\messenger\msnmsgr.exe" /background

uRun: [MSMSGS] "c:\arquivos de programas\messenger\msmsgs.exe" /background

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [HDAudDeck] c:\arquivos de programas\via\viaudioi\hdadeck\HDeck.exe 1

mRun: [Lexmark X1100 Series] "c:\arquivos de programas\lexmark x1100 series\lxbkbmgr.exe"

mRun: [AVP] "c:\arquivos de programas\kaspersky lab\kaspersky pure\avp.exe"

mRun: [AdobeCS5ServiceManager] "c:\arquivos de programas\arquivos comuns\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [AdobeCS4ServiceManager] "c:\arquivos de programas\arquivos comuns\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

mRun: [avast5] "c:\arquivos de programas\alwil software\avast5\avastUI.exe" /nogui

mRunOnce: [<NO NAME>]

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\menuin~1\progra~1\inicia~1\utilit~1.lnk - c:\windows\system32\sistray.exe

IE: Advanced Email Extractor - c:\arquivos%20de%20programas\advanced%20email%20extractor%20pro\AeePMsie.dll/page.html

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\micros~2\office11\EXCEL.EXE/3000

IE: Scan link with AEE - c:\arquivos%20de%20programas\advanced%20email%20extractor%20pro\AeePMsie.dll/link.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\arquivos de programas\messenger\msmsgs.exe

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\arquivos de programas\kaspersky lab\kaspersky pure\klwtbbho.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\arquiv~1\micros~2\office11\REFIEBAR.DLL

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\arquivos de programas\kaspersky lab\kaspersky pure\klwtbbho.dll

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1286333767890

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\arquiv~1\arquiv~1\skype\SKYPE4~1.DLL

Notify: klogon - c:\windows\system32\klogon.dll

AppInit_DLLs: c:\arquiv~1\kasper~1\kasper~1\kloehk.dll

Hosts: 173.192.170.88 drghwaweg45j4i6u3q32fg2h.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\roseli~1\dadosd~1\mozilla\firefox\profiles\x2ihzpvd.default\

FF - prefs.js: network.proxy.type - 1

FF - component: c:\arquivos de programas\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll

FF - plugin: c:\arquivos de programas\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\arquivos de programas\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\arquivos de programas\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\arquivos de programas\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\documents and settings\all users\dados de aplicativos\zylom\zylomgamesplayer\npzylomgamesplayer.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\arquivos de programas\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Kaspersky URL Advisor: linkfilter@kaspersky.ru - c:\arquivos de programas\mozilla firefox\extensions\linkfilter@kaspersky.ru

FF - Ext: QuickProxy: {d5ea4520-61a1-11da-8cd6-0800200c9a66} - %profile%\extensions\{d5ea4520-61a1-11da-8cd6-0800200c9a66}

FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com

============= SERVICES / DRIVERS ===============

R0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\drivers\CSCrySec.sys [2009-12-14 88632]

R0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-2-19 294608]

R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\drivers\CSVirtualDiskDrv.sys [2009-12-14 39352]

R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]

R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2011-2-15 315408]

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-19 141312]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-2-19 17744]

R2 avast! Antivirus;avast! Antivirus;c:\arquivos de programas\alwil software\avast5\AvastSvc.exe [2011-2-19 40384]

R2 CSObjectsSrv;CryptoStorage control service;c:\arquivos de programas\arquivos comuns\infowatch\cryptostorage\ProtectedObjectsSrv.exe [2009-12-21 743992]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-10-5 279680]

S2 AVP;Kaspersky PURE;c:\arquivos de programas\kaspersky lab\kaspersky pure\avp.exe [2010-10-1 348760]

S2 gupdate;Google Update Service (gupdate);c:\arquivos de programas\google\update\GoogleUpdate.exe [2010-10-13 136176]

S3 ivuozfi;ivuozfi;\??\c:\windows\system32\08.tmp --> c:\windows\system32\08.tmp [?]

S3 SwitchBoard;SwitchBoard;c:\arquivos de programas\arquivos comuns\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 tvsnaeniw;tvsnaeniw;\??\c:\windows\system32\055.tmp --> c:\windows\system32\055.tmp [?]

S3 zruasdppp;zruasdppp;\??\c:\windows\system32\09.tmp --> c:\windows\system32\09.tmp [?]

S4 MySQL51;MySQL51;"c:\arquivos de programas\mysql\mysql server 5.1\bin\mysqld" --defaults-file="c:\arquivos de programas\mysql\mysql server 5.1\my.ini" mysql51 --> c:\arquivos de programas\mysql\mysql server 5.1\bin\mysqld [?]

=============== Created Last 30 ================

2011-02-19 06:49:33 38848 ----a-w- c:\windows\avastSS.scr

2011-02-19 06:49:22 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\Alwil Software

2011-02-19 05:54:19 -------- d-----w- c:\arquivos de programas\WebExtractor

2011-02-19 01:53:28 -------- d-----w- C:\UsbFix

2011-02-19 01:52:59 1220299 ----a-w- C:\UsbFix.exe

2011-02-16 00:19:31 162392 ----a-w- c:\arquivos de programas\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll

2011-02-16 00:19:14 97859 ----a-w- c:\windows\system32\drivers\klick.dat

2011-02-16 00:19:14 114243 ----a-w- c:\windows\system32\drivers\klin.dat

2011-02-16 00:17:07 -------- d-----w- c:\arquivos de programas\arquivos comuns\InfoWatch

2011-02-16 00:17:04 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\Kaspersky Lab

2011-02-16 00:17:04 -------- d-----w- c:\arquivos de programas\Kaspersky Lab

2011-02-16 00:10:42 -------- d-----w- c:\arquivos de programas\Microsoft Bootvis

2011-02-16 00:00:46 -------- d-----w- c:\docume~1\roseli~1\dadosd~1\Registry Mechanic

2011-02-15 23:58:23 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\Kaspersky Lab Setup Files

2011-02-15 23:56:59 -------- d-----w- c:\arquivos de programas\arquivos comuns\PC Tools

2011-02-15 23:45:57 -------- d-----w- C:\CARROS

2011-02-15 23:29:26 -------- dc-h--w- c:\windows\ie8

2011-02-14 08:43:01 -------- d-----w- c:\windows\system32\wbem\repository\FS

2011-02-14 08:43:01 -------- d-----w- c:\windows\system32\wbem\Repository

2011-02-13 06:05:49 -------- d-----w- c:\docume~1\alluse~1\dadosd~1\XoftSpySE

2011-02-13 05:52:56 -------- d-----w- C:\_OTL

2011-02-13 05:41:36 -------- d-----w- C:\Program Files

2011-02-12 08:41:46 149504 ----a-w- c:\windows\UNWISE.EXE

2011-02-12 08:41:46 -------- d-----w- c:\arquivos de programas\arquivos comuns\TweakMarketing

2011-02-12 08:41:46 -------- d-----w- c:\arquivos de programas\Advanced Email Extractor PRO

2011-02-12 08:39:03 -------- d-----w- C:\extractor

2011-02-12 08:38:42 -------- d-----w- c:\arquivos de programas\JC-Email Segmenter Plus

2011-02-12 08:37:25 -------- d-----w- c:\arquivos de programas\FindEmail

2011-02-12 08:26:26 -------- d-----w- c:\arquivos de programas\Web Data Extractor 3.7

2011-02-11 10:17:38 43008 ----a-w- c:\windows\system32\MSMAPI32.oca

2011-02-11 10:17:38 265728 ----a-w- c:\windows\system32\MSCOMCTL.oca

2011-02-11 10:11:24 1652736 ----a-w- c:\windows\system32\mshtml.oca

2011-02-11 10:11:22 64000 ----a-w- c:\windows\system32\ieframe.oca

2011-02-11 10:11:22 29184 ----a-w- c:\windows\system32\MSINET.oca

2011-02-11 10:11:22 135168 ----a-w- c:\windows\system32\MSCOMCT2.oca

2011-02-11 10:09:57 -------- d-----w- c:\arquivos de programas\Web Publish

2011-02-11 09:19:53 -------- d-----w- c:\arquivos de programas\Resource Hacker

2011-02-11 04:38:45 -------- d-----w- c:\arquivos de programas\Service-Desk-Crm

2011-02-11 04:38:41 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-02-11 04:38:41 249856 ------w- c:\windows\Setup1.exe

2011-02-10 18:33:09 -------- d-----w- c:\windows\system32\F6DAA0

2011-01-31 02:35:48 -------- d-----w- C:\AudacityPortable

2011-01-31 02:28:17 -------- d-----w- c:\arquivos de programas\AnalogX

2011-01-25 14:48:49 -------- d-----w- C:\DPEC

2011-01-25 14:48:33 -------- d-----w- C:\database

==================== Find3M ====================

2011-01-13 03:33:41 0 ----a-w- c:\documents and settings\roseli mareti\m.tmp

2010-12-03 00:03:25 796672 ----a-w- c:\windows\GPInstall.exe

============= FINISH: 14:13:54,34 ===============

Agora, o Attach.txt:

>
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 5/10/2010 20:44:03

System Uptime: 18/2/2011 19:01:24 (19 hours ago)

Motherboard: FOXCONN | | M61PMV

Processor: AMD Athlon 7750 Dual-Core Processor | AMD Athlon 7750 Dual-Core Processor | 2712/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 75 GiB total, 0,695 GiB free.

D: is CDROM ()

E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP4: 18/2/2011 07:45:27 - Ponto de verificação do sistema

RP5: 19/2/2011 04:49:22 - avast! Free Antivirus Setup

==== Installed Programs ======================

7-Zip 4.57

Adobe AIR

Adobe Anchor Service CS4

Adobe Bridge CS4

Adobe CMaps CS4

Adobe Community Help

Adobe CSI CS4

Adobe Default Language CS4

Adobe Device Central CS4

Adobe Dreamweaver CS4

Adobe ExtendScript Toolkit CS4

Adobe Extension Manager CS4

Adobe Fireworks CS3

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Media Player

Adobe Output Module

Adobe PDF Library Files CS4

Adobe Photoshop CS5

Adobe Search for Help

Adobe Service Manager Extension

Adobe Setup

Adobe Shockwave Player

Adobe Type Support CS4

Adobe Update Manager CS4

Adobe XMP Panels CS4

Advanced Archive Password Recovery

Advanced Email Extractor PRO

Agere Systems PCI Soft Modem

AnalogX Vocal Remover

Apple Application Support

Apple Software Update

Arquivo do WinRAR

Assistente de Conexão do Windows Live

µTorrent

avast! Free Antivirus

C-Media WDM Audio Driver

CCleaner

Cheat Engine 5.5

Cheat Engine 5.6.1

Compatibility Pack for the 2007 Office system

Connect

Emissor de Nota Fiscal Eletronica (NF-e)

Ferramenta de Carregamento do Windows Live

FindEmail 2.2.8

Foxit Reader

Google Chrome

Google Earth

Google Update Helper

HijackThis 2.0.2

JC-Email Segmenter Plus

K-Lite Mega Codec Pack 4.2.5

Kaspersky PURE

kuler

Lexmark X1100 Series

Microsoft .NET Framework 2.0

Microsoft Application Error Reporting

Microsoft Bootvis

Microsoft Choice Guard

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office Professional Edição 2003

Microsoft Silverlight

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual Studio 6.0 Enterprise Edition

Microsoft Web Publishing Wizard 1.53

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Mozilla Firefox (3.6.13)

MSVCRT

MySQL Server 5.1

NVIDIA Drivers

PDF Settings CS5

Photoshop Camera Raw

Platform

QuickTime

Real Alternative 1.9.0

Resource Hacker Version 3.5.2

Segoe UI

SiS VGA Utilities

SiSAGP driver

Skype™ 5.1

Spyware Terminator

Suite Shared Configuration CS4

UltraISO Premium V8.63

UsbFix By El Desaparecido & C_XX

VIA Gerenciador de dispositivo de plataforma

VobSub v2.23 (Remove Only)

Web Data Extractor 3.7

Web Data Extractor 8.1

WebFldrs XP

WinAVI Video Converter

WinAVI Video Converter 9.0

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Messenger

Windows Media Player Firefox Plugin

Windows XP Service Pack 2

XP Codec Pack

==== End Of File ===========================

Renato Utsch· 19 de fev.

Olá!

Por favor, siga as instruções abaixo:

<< 1 >>

Faça o download do HostsXpert e salve em uma pasta própria (como C:\HostsXpert)

Extraia o arquivo .zip

Clique em Restore MS Hosts File.

-
OBSERVAÇÃO: Caso o HostsXpert reportar algum erro, clique em Make Writeable? e, após isso, clique em Restore MS Hosts File.

<< 2 >>

Siga as instruções do tutorial abaixo e execute o Ad-Remover. Utilize a opção CLEAN. Poste o log gerado.

Tutorial do Ad-Remover

<< 3 >>

Temporariamente desative seus programas de proteção!

Faça o download do BankerFix e salve no desktop (área de trabalho).

Reinicie o computador em

Modo Seguro (pressione a tecla F8 intermitentemente, ou F5 em alguns casos, durante a inicialização) Feche todos os programas abertos, menos o BankerFix. Duplo clique em BankerFix.exe Tenha certeza de que está conectado na internet e clique em OK. Após a instalação, clique em OK para executar o BankerFix. Aperte qualquer tecla na janela do BankerFix. Ele fará o resto. Você receberá uma mensagem informando se foi encontrado algum problema. Feche o BankerFix. Vá em C:\Linha Defensiva\relatorio.txt. Copie todo o conteúdo do arquivo e poste em sua próxima mensagem.

<< 4 >>

Poste um novo log do DDS.

Abraços :D

Working System· 20 de fev.

Vamos lá...o relatório AD-REPORT:

======= REPORT FROM AD-REMOVER 2.0.0.2,E | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 16/02/11

Contact: AdRemover[DOT]contact[AT]gmail[DOT]com

website: http://www.teamxscript.org

C:\Arquivos de programas\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 22:13:26 on 19/02/2011, Normal boot

Microsoft Windows XP Professional Service Pack 2 (X86)

Roseli Mareti@ESCRITORIO ( )

============== ACTION(S) ==============

File deleted: C:\Arquivos de programas\Mozilla FireFox\Components\AskSearch.js

Folder deleted: C:\Documents and Settings\Roseli Mareti\Dados de aplicativos\Mozilla\FireFox\Profiles\x2ihzpvd.default\conduit

Folder deleted: C:\Documents and Settings\Roseli Mareti\Dados de aplicativos\Mozilla\FireFox\Profiles\x2ihzpvd.default\ConduitEngine

Folder deleted: C:\Documents and Settings\Roseli Mareti\Dados de aplicativos\Mozilla\FireFox\Profiles\x2ihzpvd.default\extensions\engine@conduit.com

Folder deleted: C:\Documents and Settings\Roseli Mareti\Dados de aplicativos\PriceGong

(!) -- Temporary files deleted.

-- File opened: C:\Documents and Settings\Roseli Mareti\Dados de aplicativos\Mozilla\FireFox\Profiles\x2ihzpvd.default\Prefs.js --

Line deleted: user_pref("CT2552374.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT255...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/BR", "\"0\"")...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/945276/941054/BR", "\"0\"")...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2552374", ...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63425009534667...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=1/11/20...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=11/8/20...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/21/2...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/27/2...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/30/2...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/17/20...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2552374&octid=...

Line deleted: user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=pt-br", "\"...

Line deleted: user_pref("CommunityToolbar.EngineOwner", "CT2552374");

Line deleted: user_pref("CommunityToolbar.EngineOwnerGuid", "{12fc3d37-2a42-4fe3-8489-81296878cba5}");

Line deleted: user_pref("CommunityToolbar.EngineOwnerToolbarId", "softonic_brasil");

Line deleted: user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Line deleted: user_pref("CommunityToolbar.OriginalEngineOwner", "CT2552374");

Line deleted: user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{12fc3d37-2a42-4fe3-8489-81296878cba5}");

Line deleted: user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "softonic_brasil");

Line deleted: user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr...

Line deleted: user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2552374");

Line deleted: user_pref("CommunityToolbar.ToolbarsList2", "CT2552374");

Line deleted: user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Line deleted: user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Fri Feb 18 2011 22:11:15 GMT-0200");

Line deleted: user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Line deleted: user_pref("CommunityToolbar.alert.locale", "en");

Line deleted: user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Line deleted: user_pref("CommunityToolbar.alert.loginLastCheckTime", "Fri Feb 18 2011 22:11:15 GMT-0200");

Line deleted: user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1291052234");

Line deleted: user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Line deleted: user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Line deleted: user_pref("CommunityToolbar.alert.showTrayIcon", false);

Line deleted: user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Line deleted: user_pref("CommunityToolbar.alert.userId", "8131fb32-daa4-4504-a27b-db2a903343e5");

Line deleted: user_pref("ConduitEngine.FirstServerDate", "11/30/2010 23");

Line deleted: user_pref("ConduitEngine.FirstTime", true);

Line deleted: user_pref("ConduitEngine.FirstTimeFF3", true);

Line deleted: user_pref("ConduitEngine.HasUserGlobalKeys", true);

Line deleted: user_pref("ConduitEngine.Initialize", true);

Line deleted: user_pref("ConduitEngine.InitializeCommonPrefs", true);

Line deleted: user_pref("ConduitEngine.InstalledDate", "Tue Nov 30 2010 18:36:13 GMT-0200");

Line deleted: user_pref("ConduitEngine.IsMulticommunity", false);

Line deleted: user_pref("ConduitEngine.IsOpenThankYouPage", false);

Line deleted: user_pref("ConduitEngine.IsOpenUninstallPage", true);

Line deleted: user_pref("ConduitEngine.LanguagePackLastCheckTime", "Fri Feb 18 2011 22:11:36 GMT-0200");

Line deleted: user_pref("ConduitEngine.LastLogin_3.2.1.3", "Sat Feb 19 2011 21:33:14 GMT-0200");

Line deleted: user_pref("ConduitEngine.PublisherContainerWidth", 0);

Line deleted: user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Line deleted: user_pref("ConduitEngine.SettingsLastCheckTime", "Sat Feb 19 2011 21:33:14 GMT-0200");

Line deleted: user_pref("ConduitEngine.UserID", "UN44073588401824866");

Line deleted: user_pref("ConduitEngine.engineLocale", "pt-BR");

Line deleted: user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Fri Feb 18 2011 22:11:36 GMT-0200");

Line deleted: user_pref("ConduitEngine.initDone", true);

Line deleted: user_pref("ConduitEngine.usagesFlag", 2);

-- File closed --

Key deleted: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key deleted: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key deleted: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key deleted: HKLM\Software\Classes\TypeLib\{090ACFA1-1580-11D1-8AC0-00C0F00910F9}

Key deleted: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key deleted: HKLM\Software\Classes\TypeLib\{B4E90801-B83C-11D0-8B40-00C0F00AE35A}

Key deleted: HKLM\Software\Classes\Conduit.Engine

Key deleted: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd

Key deleted: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1

Key deleted: HKLM\Software\Classes\Toolbar.CT2552374

Key deleted: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL

Key deleted: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key deleted: HKLM\Software\AskBarDis

Key deleted: HKCU\Software\PriceGong

Key deleted: HKU\.DEFAULT\Software\AskToolbar

Key deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}

Key deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}

Value deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

============== ADDITIONNAL SCAN ==============

** Mozilla Firefox Version [3.6.13 (pt-BR)] **

Plugins\npFoxitReaderPlugin.dll (Foxit Software Company)

HKLM_MozillaPlugins\@zylom.com/ZylomGamesPlayer (x)

Searchplugins\buscape.xml (hxxp://busca.buscape.com.br/cprocura)

Searchplugins\mercadolivre.xml (hxxp://pmstrk.mercadolivre.com.br/jm/PmsTrk)

Searchplugins\wikipedia-br.xml (hxxp://pt.wikipedia.org/wiki/Especial:Busca)

Searchplugins\yahoo-br.xml (hxxp://br.search.yahoo.com/search)

-- C:\Documents and Settings\Roseli Mareti\Dados de aplicativos\Mozilla\FireFox\Profiles\x2ihzpvd.default --

Extensions\firebug@software.joehewitt.com (Firebug)

Extensions\{12fc3d37-2a42-4fe3-8489-81296878cba5} (Softonic_Brasil Community Toolbar)

Extensions\{d5ea4520-61a1-11da-8cd6-0800200c9a66} (QuickProxy)

Prefs.js - browser.download.dir, C:\\Documents and Settings\\Roseli Mareti\\Meus documentos\\Lucas\\Nova pasta

Prefs.js - browser.download.lastDir, C:\\Documents and Settings\\Roseli Mareti\\Meus documentos

Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13

========================================

** Internet Explorer Version [8.0.6001.18702] **

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896

HKCU_Main|Start Page - hxxp://fr.msn.com/

HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm

HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Start Page - hxxp://fr.msn.com/

HKCU_SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} - "?" (?)

HKCU_SearchScopes\{210073B5-670D-4ABE-A7CB-83EDBC77BF35} - "Orbit Search (Powered By Google)" (hxxp://search.orbitdownloader.com/ie.php?q={searchTerms}&enc={inputEncoding})

HKCU_SearchScopes\{8e04bb2c-d5aa-493b-bd76-4d162c4fa21b} - "iCall" (hxxp://www.ask.com/web?q={searchTerms}&o=1492&l=dis)

HKCU_Toolbar\WebBrowser|{C55BBCD6-41AD-48AD-9953-3609C48EACC7} (x)

HKLM_ElevationPolicy\{09E9B8FC-3D94-4A9B-AD2E-A64255121895} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtbws.exe (Kaspersky Lab)

HKLM_ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2} - C:\Arquivos de programas\Orbitdownloader\orbitdm.exe (x)

HKLM_ElevationPolicy\{4671F4B7-89F5-4701-B641-570278D5C856} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe (Kaspersky Lab)

HKLM_ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} - C:\Arquivos de programas\Java\jre6\bin\ssvagent.exe (x)

HKCU_Extensions\{AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - "Email Extractor" (C:\Arquivos de programas\Advanced Email Extractor PRO\AeePMsie.dll,2)

HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)

BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)

BHO\{9030D464-4C02-4ABF-8ECC-5164760863C6} - "Auxiliar de Conexão do Windows Live" (C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll)

========================================

C:\Arquivos de programas\Ad-Remover\Quarantine: 67 File(s)

C:\Arquivos de programas\Ad-Remover\Backup: 14 File(s)

C:\Ad-Report-CLEAN[1].txt - 19/02/2011 22:13:36 (11529 Byte(s))

End at: 22:14:15, 19/02/2011

============== E.O.F ==============

RELATÓRIO BANKER FIX:

BankerFix 3.1 VALKYRIE - Removedor de BankersLinha Defensiva | http://www.linhadefensiva.org

http://www.linhadefensiva.org/bankerfix/

-------------------------------------------------------

Data: 2011-02-19 - 22:19

-------------------------------------------------------

Lista de Definição: 2010-12-25-1 | CORE: 2010-12-28-6

=======================================================

----- Fim -------------------------

RELATÓRIO DDS.txt:

>
DDS (Ver_10-12-12.02) - NTFSx86

Run by Roseli Mareti at 22:24:24,32 on s b 19/02/2011

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.1918.1376 [GMT -2:00]

AV: Kaspersky PURE Disabled/Updated {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky PURE Disabled

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmgr.exe

C:\Arquivos de programas\Lexmark X1100 Series\lxbkbmon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Arquivos de programas\Arquivos comuns\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Arquivos de programas\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Arquivos de programas\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\Roseli Mareti\Desktop\dds.scr

============== Pseudo HJT Report ===============

uWindow Title =