Publicado em 10 de jul.

[Resolvido!] Malware pop up CiD

#topicos-resolvidos-seguranca-malwares

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:58:47, on 9/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\tsnp325.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorUpdate.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

C:\ARQUIV~1\AVG\AVG8\avgrsx.exe

C:\ARQUIV~1\AVG\AVG8\avgnsx.exe

C:\ARQUIV~1\AVG\AVG8\avgemc.exe

C:\Arquivos de programas\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Documents and Settings\Administrador.CASA-394B976A04\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://wlcreateid/

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Arquivos de programas\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Barra de ferramentas &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [draw memo up hide] C:\Documents and Settings\All Users.WINDOWS\Dados de aplicativos\platform dupe draw memo\bleh tray.exe

O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe

O4 - HKLM\..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe

O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [spywareTerminator] "C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARQUIV~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [spywareTerminatorUpdate] "C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorUpdate.exe"

O4 - HKCU\..\Run: [NitroPC] "C:\Arquivos de programas\NitroPC\NitroPC.exe" -minimized

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Crawler Search - tbr:iemenu

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1246823069359

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Arquivos de programas\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARQUIV~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

End of file - 8624 bytes

Discussão (15)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

MGuitar· 10 de jul.

Você possui três antivirus instalados: AVG, Avast! e Avira AntiVir. Isso não é recomendado. Pois além de gerar conflitos, o desempenho de seu sistema irá diminuir. Seu sistema não estará mais protegido com três antivirus também. Pelo contrário.

Sugiro que deixe apenas o Avira AntiVir e remova os outros dois.

- Faça download do [Lop S&D](http://eric.71.mespages.googlepages.com/LopSD.exe) e salve-o no desktop;

 

● Dê um duplo clique no *Lop S&D*. Na janela que abrir pressione a tecla **P** e tecle **Enter**;

● Na próxima tela pressione o numero **2** e tecle Enter;

● Sua tela irá piscar. Isso é normal. Aguarde até que seja gerado um relatório.

keysha· 10 de jul.

Seguindo todos os passos. Relatório do LopR:

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2

X86-based PC ( Uniprocessor Free : AMD Athlon XP 2200+ )

BIOS : Award Modular BIOS v6.0

USER : Administrador ( Administrator )

BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.30 (Activated)

A:\ (USB)

C:\ (Local Disk) - NTFS - Total:232 Go (Free:215 Go)

D:\ (CD or DVD)

E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [2] ( qui 09/07/2009|19:46 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ REMOVIDOS

Deletado! - C:\WINDOWS\Tasks\AE9B283891B0D8CC.job

Deletado! - C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\platform dupe draw memo\bleh tray.dat

Deletado! - C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\2plusd~1\Burn creative grey grid.exe

Deletado! - C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\platform dupe draw memo

Deletado! - C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\2plusd~1

Deletado! - C:\Arquivos de programas\2plusd~1

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Lista de pastas em DADOSD~1

[06/07/2009|12:34] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Adobe

[08/07/2009|23:38] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\AVGTOOLBAR

[09/07/2009|17:29] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Canneverbe_Limited

[09/06/2009|23:17] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Identities

[06/07/2009|10:32] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\InstallShield

[09/07/2009|04:21] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\IObit

[09/06/2009|22:44] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Macromedia

[09/07/2009|18:56] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Microsoft

[09/06/2009|21:47] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Mozilla

[09/07/2009|19:41] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Skype

[09/07/2009|18:39] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\skypePM

[09/07/2009|13:00] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Spyware Terminator

[06/07/2009|11:02] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Sun

[08/07/2009|16:53] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\uTorrent

[09/07/2009|14:13] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\Winamp

[05/07/2009|23:59] C:\DOCUME~1\ADMINI~3.CAS\DADOSD~1\WinRAR

[26/04/2009|18:48] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Adobe

[29/09/2008|20:34] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Apple

[07/03/2009|19:15] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Apple Computer

[20/04/2009|15:41] C:\DOCUME~1\ALLUSE~1\DADOSD~1\avg8

[31/03/2009|17:09] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Avira

[02/06/2009|19:17] C:\DOCUME~1\ALLUSE~1\DADOSD~1\BVRP Software

[19/08/2008|03:22] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Hewlett-Packard

[19/08/2008|03:35] C:\DOCUME~1\ALLUSE~1\DADOSD~1\HP

[19/08/2008|03:32] C:\DOCUME~1\ALLUSE~1\DADOSD~1\HP Product Assistant

[19/08/2008|03:44] C:\DOCUME~1\ALLUSE~1\DADOSD~1\HPSSUPPLY

[08/06/2007|18:25] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Messenger Plus!

[11/12/2008|22:09] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Microsoft

[06/05/2009|12:34] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Skype

[02/06/2009|19:32] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy

[27/03/2008|12:49] C:\DOCUME~1\ALLUSE~1\DADOSD~1\TEMP

[19/08/2008|03:52] C:\DOCUME~1\ALLUSE~1\DADOSD~1\WEBREG

[22/04/2007|19:10] C:\DOCUME~1\ALLUSE~1\DADOSD~1\Windows Genuine Advantage

[21/11/2008|22:28] C:\DOCUME~1\ALLUSE~1\DADOSD~1\WLInstaller

[06/07/2009|12:24] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Adobe

[07/07/2009|22:59] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Avanquest Software

[09/07/2009|11:26] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\AVG Security Toolbar

[09/07/2009|18:56] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\avg8

[09/07/2009|05:33] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Avira

[06/07/2009|10:07] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\BVRP Software

[05/07/2009|14:39] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Hewlett-Packard

[09/07/2009|07:21] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Kaspersky Lab Setup Files

[06/07/2009|15:21] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Messenger Plus!

[09/07/2009|17:16] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Microsoft

[06/07/2009|04:09] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Skype

[09/07/2009|04:50] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Spybot - Search & Destroy

[09/07/2009|18:39] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\Spyware Terminator

[09/07/2009|19:08] C:\DOCUME~1\ALLUSE~1.WIN\DADOSD~1\TEMP

[22/04/2007|18:23] C:\DOCUME~1\DEFAUL~1\DADOSD~1\Microsoft

[01/08/2008|17:45] C:\DOCUME~1\LOCALS~1\DADOSD~1\Adobe

[19/08/2008|03:53] C:\DOCUME~1\LOCALS~1\DADOSD~1\HP

[22/05/2008|12:33] C:\DOCUME~1\LOCALS~1\DADOSD~1\Microsoft

[09/06/2009|19:49] C:\DOCUME~1\LOCALS~1.AUT\DADOSD~1\Microsoft

[09/07/2009|09:30] C:\DOCUME~1\LOCALS~1.000\DADOSD~1\Adobe

[09/07/2009|00:26] C:\DOCUME~1\LOCALS~1.000\DADOSD~1\AVGTOOLBAR

[09/07/2009|18:56] C:\DOCUME~1\LOCALS~1.000\DADOSD~1\Microsoft

[22/05/2008|12:33] C:\DOCUME~1\NETWOR~1\DADOSD~1\Microsoft

[09/06/2009|19:49] C:\DOCUME~1\NETWOR~1.AUT\DADOSD~1\Microsoft

[09/07/2009|18:56] C:\DOCUME~1\NETWOR~1.000\DADOSD~1\Microsoft

--------------------\\ Tarefas Agendadas na pasta C:\WINDOWS\Tasks

[09/07/2009 19:40][--ah-----] C:\WINDOWS\tasks\SA.DAT

[28/10/2001 15:07][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Lista de pastas em C:\Arquivos de programas

[06/07/2009|12:17] C:\Arquivos de programas\Adobe

[18/05/2007|14:44] C:\Arquivos de programas\Adobe CS

[22/04/2007|19:06] C:\Arquivos de programas\Ahead

[22/04/2007|19:09] C:\Arquivos de programas\Alwil Software

[20/02/2008|23:29] C:\Arquivos de programas\AnalogX

[29/05/2009|07:27] C:\Arquivos de programas\ANE

 [29/09/2008|20:34] C:\Arquivos de programas\Apple Software Update

 [09/07/2009|07:44] C:\Arquivos de programas\Arquivos comuns

 [02/06/2009|19:02] C:\Arquivos de programas\Audio Recorder for FREE

 [09/07/2009|05:33] C:\Arquivos de programas\Avira

 [25/04/2009|17:42] C:\Arquivos de programas\Brasfoot2009

 [28/04/2009|13:47] C:\Arquivos de programas\Cálculo Trabalhista Rápido

 [31/03/2009|14:20] C:\Arquivos de programas\CCleaner

 [09/07/2009|17:28] C:\Arquivos de programas\CDBurnerXP

 [17/07/2008|03:45] C:\Arquivos de programas\CDex

 [06/07/2009|04:31] C:\Arquivos de programas\Circle Developemet

 [22/04/2007|18:20] C:\Arquivos de programas\ComPlus Applications

 [06/07/2009|11:58] C:\Arquivos de programas\Crawler

 [02/06/2009|19:11] C:\Arquivos de programas\DivX

 [25/04/2007|15:11] C:\Arquivos de programas\DremTeamShare

 [25/04/2007|12:14] C:\Arquivos de programas\Efficient Networks

 [08/07/2009|15:19] C:\Arquivos de programas\eMule

 [29/05/2009|07:27] C:\Arquivos de programas\EssentialPIM

 [29/02/2008|12:00] C:\Arquivos de programas\Google

 [02/06/2009|19:04] C:\Arquivos de programas\Gravity

 [19/08/2008|03:31] C:\Arquivos de programas\Hewlett-Packard

 [19/08/2008|03:44] C:\Arquivos de programas\HP

 [06/07/2009|10:07] C:\Arquivos de programas\InstallShield Installation Information

 [09/07/2009|10:26] C:\Arquivos de programas\Internet Explorer

 [31/03/2009|15:14] C:\Arquivos de programas\IObit

 [06/07/2009|11:04] C:\Arquivos de programas\Java

 [17/07/2008|03:34] C:\Arquivos de programas\LocalCDDB

 [02/06/2009|19:18] C:\Arquivos de programas\Macromedia

 [31/03/2009|15:22] C:\Arquivos de programas\Marcos Velasco Security

 [02/06/2009|19:18] C:\Arquivos de programas\Megacubo

 [09/06/2009|21:18] C:\Arquivos de programas\Messenger

 [06/07/2009|04:31] C:\Arquivos de programas\Messenger Plus! Live

 [12/03/2009|15:01] C:\Arquivos de programas\Microsoft

 [22/04/2007|18:24] C:\Arquivos de programas\microsoft frontpage

 [15/09/2008|07:07] C:\Arquivos de programas\Microsoft Office

 [26/02/2009|15:51] C:\Arquivos de programas\Microsoft Silverlight

 [22/04/2007|19:04] C:\Arquivos de programas\Microsoft Visual Studio

 [12/06/2008|22:04] C:\Arquivos de programas\Microsoft Works

 [22/04/2007|19:04] C:\Arquivos de programas\Microsoft.NET

 [29/06/2009|19:47] C:\Arquivos de programas\Motorola Phone Tools

 [09/06/2009|19:47] C:\Arquivos de programas\Movie Maker

 [09/07/2009|19:43] C:\Arquivos de programas\Mozilla Firefox

 [09/07/2009|10:42] C:\Arquivos de programas\MSBuild

 [24/06/2009|00:50] C:\Arquivos de programas\MSECache

 [09/06/2009|19:45] C:\Arquivos de programas\MSN Gaming Zone

 [21/08/2008|10:26] C:\Arquivos de programas\MSXML 4.0

 [09/07/2009|10:17] C:\Arquivos de programas\MSXML 6.0

 [16/10/2008|21:24] C:\Arquivos de programas\Multiply

 [09/06/2009|19:47] C:\Arquivos de programas\NetMeeting

 [02/06/2009|19:19] C:\Arquivos de programas\OnGame

 [09/06/2009|19:46] C:\Arquivos de programas\Outlook Express

 [17/02/2009|14:36] C:\Arquivos de programas\Programas RFB

 [07/03/2009|19:17] C:\Arquivos de programas\QuickTime

 [09/07/2009|10:41] C:\Arquivos de programas\Reference Assemblies

 [02/06/2009|19:04] C:\Arquivos de programas\Serif

 [22/04/2007|18:22] C:\Arquivos de programas\Serviços on-line

 [06/07/2009|04:10] C:\Arquivos de programas\Skype

 [28/04/2008|22:57] C:\Arquivos de programas\SopCast

 [06/07/2009|12:00] C:\Arquivos de programas\Spybot - Search & Destroy

 [09/07/2009|13:10] C:\Arquivos de programas\Spyware Terminator

 [02/06/2009|19:24] C:\Arquivos de programas\SRP

 [17/07/2008|22:56] C:\Arquivos de programas\Sun

 [02/06/2009|19:03] C:\Arquivos de programas\The KMPlayer

 [22/04/2007|18:52] C:\Arquivos de programas\Uninstall Information

 [06/07/2009|04:04] C:\Arquivos de programas\uTorrent

 [14/11/2008|22:56] C:\Arquivos de programas\VideoLAN

 [07/02/2008|11:13] C:\Arquivos de programas\Webteh

 [05/07/2009|22:52] C:\Arquivos de programas\Winamp

 [12/03/2009|14:59] C:\Arquivos de programas\Windows Live

 [12/03/2009|15:00] C:\Arquivos de programas\Windows Live SkyDrive

 [02/06/2009|19:12] C:\Arquivos de programas\Windows Media Connect 2

 [09/06/2009|19:47] C:\Arquivos de programas\Windows Media Player

 [09/06/2009|19:45] C:\Arquivos de programas\Windows NT

 [22/04/2007|18:22] C:\Arquivos de programas\WindowsUpdate

 [05/07/2009|23:59] C:\Arquivos de programas\WinRAR

 [22/04/2007|18:24] C:\Arquivos de programas\xerox

 [02/06/2009|19:03] C:\Arquivos de programas\Xvid

 [09/07/2009|05:17] C:\Arquivos de programas\Zone Labs

 

 --------------------\\ Lista de pastas em C:\Arquivos de programas\Arquivos comuns

 

 [06/07/2009|12:21] C:\Arquivos de programas\Arquivos comuns\Adobe

 [16/10/2008|21:24] C:\Arquivos de programas\Arquivos comuns\Adobe AIR

 [22/04/2007|19:06] C:\Arquivos de programas\Arquivos comuns\Ahead

 [28/04/2009|13:41] C:\Arquivos de programas\Arquivos comuns\Borland Shared

 [22/04/2007|19:04] C:\Arquivos de programas\Arquivos comuns\DESIGNER

 [19/08/2008|03:31] C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard

 [19/08/2008|03:32] C:\Arquivos de programas\Arquivos comuns\HP

 [02/06/2009|19:18] C:\Arquivos de programas\Arquivos comuns\InstallShield

 [26/04/2007|12:38] C:\Arquivos de programas\Arquivos comuns\Java

 [02/06/2009|19:18] C:\Arquivos de programas\Arquivos comuns\Macromedia

 [05/03/2009|00:07] C:\Arquivos de programas\Arquivos comuns\Microsoft Shared

 [22/04/2007|18:21] C:\Arquivos de programas\Arquivos comuns\MSSoap

 [22/04/2007|15:15] C:\Arquivos de programas\Arquivos comuns\ODBC

 [22/04/2007|18:21] C:\Arquivos de programas\Arquivos comuns\Serviços

 [06/07/2009|04:09] C:\Arquivos de programas\Arquivos comuns\Skype

 [06/07/2009|10:32] C:\Arquivos de programas\Arquivos comuns\snp325

 [22/04/2007|15:15] C:\Arquivos de programas\Arquivos comuns\SpeechEngines

 [16/11/2008|02:40] C:\Arquivos de programas\Arquivos comuns\Symantec Shared

 [09/06/2009|19:46] C:\Arquivos de programas\Arquivos comuns\System

 [10/10/2008|21:47] C:\Arquivos de programas\Arquivos comuns\Windows Live

 [06/02/2008|05:27] C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

 

 --------------------\\ Process

 

 ( 34 Processes )

 

 ... OK !

 

 --------------------\\ Procura pelo S_Lop

 

 Não foram encontradas pastas com o Lop!

 

 --------------------\\ Procura por Arquivos/Ficheiros e pastas do Lop

 

 Não foram encontradas pastas com o Lop!

 

 --------------------\\ Procura no Registro

 

 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

 

 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

 

 ..... OK !

 

 --------------------\\ Verificando o Arquivos/Ficheiros Hosts

 

 Arquivos/Ficheiros Hosts LIMPO

 

 

 --------------------\\ Procurando Arquivos/Ficheiros ocultos com o Catchme

 

 catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [http://www.gmer.net](http://www.gmer.net)

 Rootkit scan 2009-07-09 19:49:47

 Windows 5.1.2600 Service Pack 2 NTFS

 scanning hidden processes ...

 scanning hidden files ...

 scan completed successfully

 hidden processes: 0

 hidden files: 0

 

 --------------------\\ Procurando por outras infecções

 

 

 Não foram encontradas outras infecções.

 

 [F:1472][D:6]-> C:\DOCUME~1\ADMINI~3.CAS\CONFIG~1\Temp

 [F:1][D:0]-> C:\DOCUME~1\ADMINI~3.CAS\Cookies

 [F:2][D:0]-> C:\DOCUME~1\ADMINI~3.CAS\CONFIG~1\TEMPOR~1\content.IE5

 

 1 - "C:\Lop SD\LopR_1.txt" - qui 09/07/2009|19:50 - Option : [2]

 

 --------------------\\ Verificação completa em 19:50:33

MGuitar· 11 de jul.

Vá em Painel de Controle > Adicionar ou Remover Programas. Encontre e desinstale os três itens abaixo:

Crawler

Messenger Plus!

Messenger Plus! Live

OBS: O problema com as pop-ups CID foi causado pelo lop - adware instalado, geralmente, pelo Messenger Plus quando instala-se o patrocinador. Para evitar este problema ao instalar o Messenger Plus, basta não aceitar a instalação do patrocinador no comaço da instalação, marcando a opção da imagem abaixo:

/applications/core/interface/imageproxy/imageproxy.php?img=http://i27.tinypic.com/2myz28o.jpg&key=5f3eaba2dd4f248d2cf874cf78d2175a876b2b8dcbcc0e6706558cfb1e4bbbfe" alt="2myz28o.jpg" />

- Faça o download do [RSIT](http://images.malwareremoval.com/random/RSIT.exe) e salve no seu desktop;

 

● Dê dois cliques em **RSIT.exe** para executar o programa;

● Na janela que abrir clique no botão **Continue** para que a ferramenta comece a rodar;

● Quando a ferramenta terminar de rodar, abrirá um log automaticamente no bloco de notas contendo o resultado do scan. Cole o resultado desse log (**log.txt**) na sua próxima resposta;

● Cole também o conteúdo do arquivo info.txt que estará em C:\rsit\info.txt.

Pergunta: As janelas CID ainda aparecem?

keysha· 11 de jul.

Não vi mais nenhuma maldita janela de propaganda se abrindo. Espero ter me livrado de outras pragas no processo... O excesso de anti virus foi uma medida desesperada mesmo, passei todo tipo de anti spy e anti virus mas não conseguia me livrar dessas pop ups. Muito obrigada!

Logfile of random's system information tool 1.06 (written by random/random)

Run by Administrador at 2009-07-11 07:28:08

Microsoft Windows XP Professional Service Pack 2

System drive C: has 220 GB (92%) free of 238 GB

Total RAM: 768 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 07:28:23, on 11/7/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\WINDOWS\FixCamera.exe

C:\WINDOWS\tsnp325.exe

C:\WINDOWS\vsnp325.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorUpdate.exe

C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Documents and Settings\Administrador.CASA-394B976A04\Desktop\RSIT.exe

C:\Documents and Settings\Administrador.CASA-394B976A04\Desktop\Administrador.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://wlcreateid/

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe

O4 - HKLM\..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe

O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [spywareTerminator] "C:\Arquivos de programas\Spyware Terminator\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\RunOnce: [MessengerPlusLiveUninstall] "C:\DOCUME~1\ADMINI~3.CAS\CONFIG~1\Temp\MsgPlusUninstall.exe" /Cleanup