Usamos cookies para medir audiência e melhorar sua experiência. Você pode aceitar ou recusar a qualquer momento. Veja sobre o iMasters.
Ola pessoal fiz uma scaneamento pelo Antivir num pc que não tinha an-tivirus pegou 20 virus, Orkut não quer mais abrir veja a foto que apresenta quando pede para abrir o orkut:
/applications/core/interface/imageproxy/imageproxy.php?img=http://img172.imageshack.us/img172/8960/pcinfectadoax0.jpg&key=0b4ac67668147d6c792334762d7937cdb275aa6f55d4cfd863cbc19636d277ef" alt="pcinfectadoax0.jpg" />
ComboFix 08-04-04.1 - Samuel 2008-04-05 17:54:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.135 [GMT -3:00]
Executando de: C:\Documents and Settings\Samuel\Desktop\ComboFix.exe
* Criado um novo ponto de restauro
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((( Ficheiros criados de 2008-03-05 to 2008-04-05 ))))))))))))))))))))))))))))))))
.
2008-04-04 11:51 . 2008-04-04 11:51 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2
2008-04-04 11:49 . 2008-04-04 11:49 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-04-04 11:49 . 2008-04-04 11:50 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF2008-04-04 11:49 . 2008-04-05 09:08 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-04-04 11:39 . 2008-04-04 11:39 <DIR> d-------- C:\Arquivos de programas\CCleaner
2008-04-04 10:38 . 2008-04-04 10:38 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avira
2008-04-04 10:38 . 2008-04-04 10:38 <DIR> d-------- C:\Arquivos de programas\Avira2008-04-02 10:54 . 2008-04-02 10:54 98,343 --a------ C:\WINDOWS\hpqins16.dat
2008-03-23 21:18 . 2008-03-23 21:18 268 --ah----- C:\sqmdata00.sqm
2008-03-23 21:18 . 2008-03-23 21:18 244 --ah----- C:\sqmnoopt00.sqm
2008-03-16 09:12 . 2008-03-16 09:12 <DIR> d---s---- C:\Documents and Settings\Samuel\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll
2008-03-15 16:44 . 2008-03-30 12:19 1,651 --a------ C:\WINDOWS\system32\msnprint.dll
2008-03-09 18:12 . 2008-03-24 16:02 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI
2008-03-08 17:47 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-03-08 17:47 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-03-08 17:47 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-07 22:57 . 2008-04-05 07:18 <DIR> d-------- C:\Documents and Settings\Samuel\Contacts
2008-03-07 20:41 . 2008-03-07 20:41 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Windows Live Toolbar
2008-03-07 20:18 . 2008-03-07 20:18 <DIR> d-------- C:\Arquivos de programas\Windows Live Toolbar
2008-03-07 20:03 . 2008-03-07 20:03 <DIR> d-------- C:\Documents and Settings\Samuel\Dados de aplicativos\MSN Search Toolbar
2008-03-07 20:00 . 2008-03-07 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\MSN Search Toolbar
2008-03-07 19:01 . 2008-03-07 22:51 <DIR> d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller
2008-03-07 19:00 . 2008-03-07 22:51 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller
2008-03-07 19:00 . 2008-03-07 22:52 <DIR> d-------- C:\Arquivos de programas\Windows Live
2008-03-05 13:42 . 2008-03-05 13:42 <DIR> d-------- C:\Arquivos de programas\MSXML 4.0
.((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-02 13:54 --------- d-----w C:\Arquivos de programas\HP
2008-03-25 17:46 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\Image Zone Express
2008-03-01 21:27 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\Printer Info Cache
2008-03-01 21:24 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\HP
2008-03-01 21:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\WEBREG
2008-03-01 21:22 --------- d-----w C:\Arquivos de programas\Arquivos comuns\HP
2008-03-01 21:21 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\HP
2008-03-01 21:20 --------- d-----w C:\Arquivos de programas\Hewlett-Packard
2008-03-01 21:20 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard
2008-03-01 21:19 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Hewlett-Packard
2008-03-01 19:37 21,275 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-03-01 19:37 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information
2008-03-01 19:37 --------- d-----w C:\Arquivos de programas\GREATEK
2008-02-12 12:40 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\Ahead
2008-02-12 12:27 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Ahead
2008-02-12 12:27 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Ahead
2008-02-12 12:25 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Nero
2008-02-12 12:25 --------- d-----w C:\Arquivos de programas\Nero
2008-02-04 00:52 15,600 ----a-w C:\WINDOWS\gdrv.sys
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
Nota entradas vazias & legítimas por defeito não são mostradas.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136]
"MsnMsgr"="C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="sm56hlpr.exe" [2005-07-05 17:47 544768 C:\WINDOWS\sm56hlpr.exe]
"VTTimer"="VTTimer.exe" [2006-09-21 05:36 53248 C:\WINDOWS\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2007-02-05 20:30 176128 C:\WINDOWS\system32\S3Trayp.exe]
"HDAudDeck"="C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe" [2007-05-11 04:47 790528]
"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"GTKCU"="C:\Arquivos de programas\GREATEK\GTKCU\GTKCU.exe" [2006-12-18 14:09 315392]
"HP Software Update"="C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]
"avgnt"="C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-04 11:02 249896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\
HP Digital Imaging Monitor.lnk - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=
R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-03-26 04:26]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-03-29 00:36]
R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-03-26 04:26]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2007-03-04 22:54]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-04-17 00:58]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-02-03 21:52]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Conteúdo da pasta 'Tarefas Agendadas'
"2008-04-05 15:14:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-05 17:55:49
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????????????
Procurando ficheiros ocultos ...
Varredura completada com sucesso
Ficheiros ocultos: 0
**************************************************************************
.
Tempo para conclusão: 2008-04-05 17:56:34
ComboFix-quarantined-files.txt 2008-04-05 20:56:09
Pre-Run: 153,316,528,128 bytes disponíveis
Post-Run: 153,309,016,064 bytes disponíveis
.
2008-04-04 22:13:48 --- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 18:06:06, on 5/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Arquivos de programas\GREATEK\GTKCU\GTKCU.exe
C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe
C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe
C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe
C:\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.yahoo.com
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Arquivos de programas\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GTKCU] "C:\Arquivos de programas\GREATEK\GTKCU\GTKCU.exe" -nogui
O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &MSN Search - res://C:\Arquivos de programas\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Arquivos de programas\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Arquivos de programas\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?3c741f6dc9ed455a837358d4e7dd7dd
O8 - Extra context menu item: Open in new foreground tab - res://C:\Arquivos de programas\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?3c741f6dc9ed455a837358d4e7dd7dd
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: GREATEK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
Carregando comentários...