[Resolvido!]Spyware

Olá pessoal,

Peguei um Spyware que mostrava um X vermelho perto do relógio, esse spyware desativou minha área de trabalho e colocou um outro plano de fundo dizendo que meu computador está infectado. Usei o Microsoft Antispyware, consegui remover o X vermelho, mas minha área de trablaho naum foi recuperada e janelas redirecionando para outros site ainda aparecem, abaixo o log:

Logfile of HijackThis v1.99.1

Scan saved at 10:14:04, on 8/12/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Explorer.EXE

C:\ARQUIV~1\Iomega\System32\AppServices.exe

C:\Arquivos de programas\Panda Software\Panda Antivirus Titanium\Pavsrv51.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\Arquivos de programas\Iomega\AutoDisk\ADService.exe

C:\Arquivos de programas\Panda Software\Panda Antivirus Titanium\AVENGINE.EXE

C:\Arquivos de programas\Panda Software\Panda Antivirus Titanium\pavProxy.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

C:\Arquivos de programas\Scansoft\PaperPort\pptd40nt.exe

C:\windows\adtech2006.exe

C:\Arquivos de programas\Microsoft AntiSpyware\gcasServ.exe

C:\Arquivos de programas\Microsoft AntiSpyware\gcasDtServ.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\WinRAR\WinRAR.exe

C:\DOCUME~1\TURISM~1.TUR\CONFIG~1\Temp\Rar$EX00.391\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.uol.com.br

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.uol.com.br

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com

F3 - REG:win.ini: run=C:\WINDOWS\inet20009\services.exe

O4 - HKLM\..\Run: [Microsoft Servicez Manager] servicemgrz.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Arquivos de programas\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_05\bin\jusched.exe

O4 - HKLM\..\Run: [PaperPort PTD] C:\Arquivos de programas\Scansoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Arquivos de programas\Scansoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Arquivos de programas\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe

O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Arquivos de programas\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\RunServices: [Microsoft Servicez Manager] servicemgrz.exe

O4 - Startup: Palm Desktop.lnk = C:\Palm\palm.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Arquivos de programas\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)

O17 - HKLM\System\CCS\Services\Tcpip\..\{981DE450-90C4-4FD1-99F7-B661458E0DE2}: NameServer = 200.204.0.10,200.176.2.12

O20 - Winlogon Notify: Mixer - C:\WINDOWS\SYSTEM32\sndmix.dll

O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\MNJET35.DLL

O21 - SSODL: SysTray.Exys - {7368D5FC-6F5C-4f5b-B964-E67214F67852} - C:\WINDOWS\system32\enijlccb.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Iomega App Services - Iomega Corporation - C:\ARQUIV~1\Iomega\System32\AppServices.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Arquivos de programas\Panda Software\Panda Antivirus Titanium\Pavsrv51.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Arquivos de programas\Iomega\AutoDisk\ADService.exe

Por Favor que me ajudem, pois pelo que percebi existem várias versões desse spyware do X vermelho.