Publicado em 11 de set.

[Arquivado] Anti vírus não consegue excluir infecções

Olá! Scanei o pc com o Avast que detectou algumas infecções mas não consegue excluir do sistema. Além disso o lento está muito lento.

Obrigada!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:21:25, on 11/9/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS2\System32\smss.exe

C:\WINDOWS2\system32\csrss.exe

C:\WINDOWS2\system32\winlogon.exe

C:\WINDOWS2\system32\services.exe

C:\WINDOWS2\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\System32\svchost.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS2\system32\spoolsv.exe

C:\WINDOWS2\system32\svchost.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe

C:\WINDOWS2\msd.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS2\system32\ctfmon.exe

C:\WINDOWS2\system32\HPZipm12.exe

C:\DOCUME~1\teste\CONFIG~1\Temp\625.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\system32\ctfmon.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS2\System32\alg.exe

C:\Arquivos de programas\Adobe\Reader 8.0.1\Reader\AcroRd32.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\DOCUME~1\teste\CONFIG~1\Temp\b.exe

C:\Arquivos de programas\Adobe\Reader 8.0.1\Reader\AcroRd32Info.exe

C:\Documents and Settings\teste\Meus documentos\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uerj.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: (no name) - {01A4FF23-2B20-435B-9930-F5AE9FF5039a} - C:\WINDOWS2\system32\ftsnnzfc.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: XML module - {500bca15-57a7-4eaf-8143-8c619470b13d} - C:\WINDOWS2\system32\msxml71.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {A92D7474-F0FA-4B67-A8AE-688B10EC2400} - c:\windows2\system32\ahbwggi.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn0\yt.dll

O4 - HKLM\..\Run: [smapp] C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\DOCUME~1\teste\CONFIG~1\Temp\625.exe

O4 - HKCU\..\Run: [PopRock] C:\DOCUME~1\teste\CONFIG~1\Temp\b.exe

O4 - HKCU\..\Run: [12CFG515-K641-55SF-N66P] C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556\pqlmq.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe

O4 - HKCU\..\Run: [NordBull] C:\WINDOWS2\msc.exe

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS2\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugin/Cab/GbPluginABN.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O20 - Winlogon Notify: gafltuau - C:\WINDOWS2\SYSTEM32\ahbwggi.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Serviço de transferência inteligente de plano de fundo (BITS) - Unknown owner - C:\WINDOWS2\

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS2\system32\HPZipm12.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Atualizações Automáticas (wuauserv) - Unknown owner - C:\WINDOWS2\

End of file - 7412 bytes

Discussão (8)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

PedroN· 11 de set.

• Baixe: < ComboFix.exe >

• Salve-o no Desktop!

• Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

• Feche todas as janelas e execute a ferramenta!

• Na solicitação: "Negação de garantia de software" --> Clique em Sim!

• Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.-- Salve-a no desktop,renomeada como: Kombo.exe

-- Ps: Nomeie durante o salvamento,e não após salvá-la!

-- Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança.

-- Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

-- Ps: Evite executar,voluntariamente,esta ferramenta!Siga,àcima,todas as recomendações propostas.

• Abrir-se-á a janela Auto Scan. --> Aguarde!

• Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

• Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter.

• Aguarde a conclusão!

• Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

• Para parar ou sair do ComboFix,tecle "N" --> Enter.

----------------------

• Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

EvelinSF· 11 de set.

Olá! Abaixo estão os logs requeridos.

ComboFix 09-09-10.03 - teste 11/09/2009 17:03.1.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.511.207 [GMT -3:00]

Executando de: c:\documents and settings\teste\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1351 [VPS 090910-0] On-access scanning disabled (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

c:\arquivos de programas\Mjcore

c:\arquivos de programas\videosoft

c:\arquivos de programas\videosoft\Shared Files\ViewRep7.dll

c:\arquivos de programas\videosoft\Shared Files\Vsflex7.ocx

c:\arquivos de programas\videosoft\Shared Files\VSPRINT7.ocx

c:\arquivos de programas\videosoft\Shared Files\VSStr7.ocx

C:\DBAV11.txt

c:\documents and settings\DBCG\Dados de aplicativos\SpeedRunner

c:\documents and settings\DBCG\Dados de aplicativos\SpeedRunner\config.cfg

c:\documents and settings\teste\Meus documentos\reg1.reg

c:\documents and settings\teste\Meus documentos\reg11.reg

c:\documents and settings\teste\Meus documentos\regbom.reg

c:\recycler\S-1-5-21-0243636035-3055115376-381863306-1556

c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1077

c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1811

c:\recycler\S-1-5-21-0623469751-5950421964-904583001-1586

c:\recycler\S-1-5-21-0908414787-0067719534-655518109-2790

c:\recycler\S-1-5-21-1414675525-2995292151-240474771-7710

c:\recycler\S-1-5-21-1850841133-3186776248-771065789-8735

c:\recycler\S-1-5-21-2052187370-5892541565-461065525-3420

c:\recycler\S-1-5-21-2683169199-7064280156-898852153-4928

c:\recycler\S-1-5-21-4282504769-6765711613-337680039-8908

c:\recycler\S-1-5-21-4414992093-1324326746-655593322-9755

c:\recycler\S-1-5-21-4614530231-4322848462-751609339-2108

c:\recycler\S-1-5-21-5270526077-9404783981-773468267-1080

c:\recycler\S-1-5-21-5484587507-7833992115-016872197-9970

c:\recycler\S-1-5-21-5910350778-0813701585-928076290-3762

c:\recycler\S-1-5-21-6535783798-4741802910-172999391-8423

c:\recycler\S-1-5-21-9178656968-6925991351-239457770-5601

c:\recycler\S-1-5-21-9256038977-9305819719-207950675-1000

c:\windows\Installer\146f1b4.msi

c:\windows\Installer\158abcd.msi

c:\windows\Installer\159efd.msi

c:\windows\Installer\159f02.msi

c:\windows\Installer\159f08.msi

c:\windows\Installer\159f0d.msi

c:\windows\Installer\159f12.msi

c:\windows\Installer\159f18.msi

c:\windows\Installer\159f1d.msi

c:\windows\Installer\159f22.msi

c:\windows\Installer\159f27.msi

c:\windows\Installer\159f2c.msi

c:\windows\Installer\159f31.msi

c:\windows\Installer\159f37.msi

c:\windows\Installer\159f3c.msi

c:\windows\Installer\159f41.msi

c:\windows\Installer\159f47.msi

c:\windows\Installer\159f4c.msi

c:\windows\Installer\159f54.msi

c:\windows\Installer\159f59.msi

c:\windows\Installer\159f65.msi

c:\windows\Installer\159f6b.msi

c:\windows\Installer\159f71.msi

c:\windows\Installer\159f76.msi

c:\windows\Installer\159f7b.msi

c:\windows\Installer\159f80.msi

c:\windows\Installer\159f8b.msi

c:\windows\Installer\159f90.msi

c:\windows\Installer\159f96.msi

c:\windows\Installer\159f9b.msi

c:\windows\Installer\1667a.msi

c:\windows\Installer\1b4aac.msi

c:\windows\Installer\292658.msi

c:\windows\Installer\29265d.msi

c:\windows\Installer\2926b1.msi

c:\windows\Installer\32b9a0.msi

c:\windows\Installer\41a811.msi

c:\windows\Installer\44ce8.msi

c:\windows\Installer\4924e.msi

c:\windows\Installer\7110d.msi

c:\windows\Installer\71113.msi

c:\windows\Installer\92071.msi

c:\windows2\inf.jpg

c:\windows2\msa.exe

c:\windows2\msb.exe

c:\windows2\msc.exe

c:\windows2\msd.exe

c:\windows2\system32\ahbwggi.dll

c:\windows2\system32\drivers\afeqdwkd.sys

c:\windows2\system32\drivers\xcbodszz.sys

c:\windows2\system32\ftsnnzfc.dll

c:\windows2\system32\msXMl71.dll

c:\windows2\system32\ppsbfmn.dll

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Legacy_KQDKNFVF

-------\Legacy_XCBODSZZ

-------\Service_AVPsys

-------\Service_kqdknfvf

-------\Service_xcbodszz

(((((((((((((((( Arquivos/Ficheiros criados de 2009-08-11 to 2009-09-11 ))))))))))))))))))))))))))))

2009-09-11 20:00 . 2009-09-11 20:00 -------- d-----w- c:\documents and settings\teste\Dados de aplicativos\hdhixpww

2009-09-09 16:56 . 2009-09-09 16:56 -------- d-----w- c:\documents and settings\NetworkService.AUTORIDADE NT\Dados de aplicativos\hdhixpww

2009-09-08 17:57 . 2009-08-17 16:04 23152 ----a-w- c:\windows2\system32\drivers\aswRdr.sys

2009-09-08 17:57 . 2009-08-17 16:04 51376 ----a-w- c:\windows2\system32\drivers\aswTdi.sys

2009-09-08 17:57 . 2009-08-17 16:03 26944 ----a-w- c:\windows2\system32\drivers\aavmker4.sys

2009-09-08 17:56 . 2009-08-17 16:06 93392 ----a-w- c:\windows2\system32\drivers\aswmon.sys

2009-09-08 17:56 . 2009-08-17 16:06 94160 ----a-w- c:\windows2\system32\drivers\aswmon2.sys

2009-09-08 17:56 . 2009-08-17 16:05 114768 ----a-w- c:\windows2\system32\drivers\aswSP.sys

2009-09-08 17:56 . 2009-08-17 16:05 20560 ----a-w- c:\windows2\system32\drivers\aswFsBlk.sys

2009-09-08 17:56 . 2009-08-17 16:02 97480 ----a-w- c:\windows2\system32\AvastSS.scr

2009-09-08 17:56 . 2009-08-17 16:10 1279456 ----a-w- c:\windows2\system32\aswBoot.exe

2009-09-08 16:07 . 2009-09-10 20:09 190464 ----a-w- C:\xubdc.exe

2009-09-08 13:07 . 2009-09-10 20:08 87552 ----a-w- C:\thdnoy.exe

2009-09-01 18:27 . 2009-09-01 18:27 -------- d-----w- C:\BJPrinter

2009-08-13 14:14 . 2008-04-14 02:20 221184 ----a-w- c:\windows2\system32\wmpns.dll

2009-08-13 14:07 . 2009-08-13 14:07 -------- d-----w- C:\FOUND.032

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-09-10 14:41 . 2001-10-28 18:07 50432 ----a-w- c:\windows2\system32\pblwecee.dat

2009-09-10 14:41 . 2001-10-28 18:07 2944 ----a-w- c:\windows2\system32\drivers\null.sys

2009-09-10 14:41 . 2001-10-28 18:06 4224 ----a-w- c:\windows2\system32\drivers\beep.sys

2009-09-02 14:28 . 2009-06-05 15:26 162 ----a-w- c:\windows2\system32\drivers\GbpKmAp.lst

2009-09-01 13:21 . 2009-06-04 17:36 27240 ----a-w- c:\windows2\system32\drivers\GbpKm.sys

2009-08-05 19:01 . 2009-08-05 19:00 -------- d-----w- c:\documents and settings\teste\Dados de aplicativos\SmartDraw

2009-08-05 18:50 . 2009-08-05 18:50 -------- d-----w- c:\documents and settings\teste\Dados de aplicativos\Yahoo!

2009-08-05 18:50 . 2009-08-05 18:50 -------- d-----w- c:\documents and settings\All Users.WINDOWS2\Dados de aplicativos\Yahoo! Companion

2009-08-05 18:50 . 2009-08-05 18:50 -------- d-----w- c:\arquivos de programas\CCleaner

2009-08-05 18:44 . 2009-08-05 18:44 -------- d-----w- c:\arquivos de programas\SmartDraw 2009

2009-08-05 09:00 . 2004-08-04 06:45 205312 ----a-w- c:\windows2\system32\mswebdvd.dll

2009-07-17 19:03 . 2004-08-04 06:45 58880 ----a-w- c:\windows2\system32\atl.dll

2009-07-14 02:43 . 2004-08-04 06:45 286208 ----a-w- c:\windows2\system32\wmpdxm.dll

2009-07-01 15:55 . 2009-07-01 15:55 410984 ----a-w- c:\windows2\system32\deploytk.dll

2009-06-29 15:58 . 2004-08-04 06:45 827392 ----a-w- c:\windows2\system32\wininet.dll

2009-06-29 15:58 . 2004-08-04 06:45 78336 ----a-w- c:\windows2\system32\ieencode.dll

2009-06-29 15:58 . 2004-08-04 06:45 17408 ----a-w- c:\windows2\system32\corpol.dll

2009-06-16 14:39 . 2004-08-04 06:45 119808 ----a-w- c:\windows2\system32\t2embed.dll

2009-06-16 14:39 . 2001-10-28 18:06 81920 ----a-w- c:\windows2\system32\fontsub.dll

2009-06-15 10:44 . 2004-08-04 06:45 81408 ----a-w- c:\windows2\system32\tlntsess.exe

2009-06-15 10:44 . 2004-08-04 06:45 77824 ----a-w- c:\windows2\system32\telnet.exe

2001-05-24 15:59 . 2007-10-06 14:23 162304 ----a-w- c:\arquivos de programas\UNWISE.EXE

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

Nota entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Smapp"="c:\arquivos de programas\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]

"avast!"="c:\arquiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows2\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn]

2009-09-01 13:21 299944 ----a-w- c:\arquiv~1\GbPlugin\gbiehabn.dll

[HKLM\~\startupfolder\C:^Documents and Settings^teste^Menu Iniciar^Programas^Inicializar^Avision Scanner Utility.lnk]

path=c:\documents and settings\teste\Menu Iniciar\Programas\Inicializar\Avision Scanner Utility.lnk

backup=c:\windows2\pss\Avision Scanner Utility.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\Messenger\\MSMSGS.EXE"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

"c:\\Arquivos de programas\\Arquivos comuns\\Mozilla Shared\\firefox.exe"=

R0 GbpKm;Gbp KernelMode;c:\windows2\system32\drivers\GbpKm.sys [4/6/2009 14:36 27240]

R1 aswSP;avast! Self Protection;c:\windows2\system32\drivers\aswSP.sys [8/9/2009 14:56 114768]

R2 aswFsBlk;aswFsBlk;c:\windows2\system32\drivers\aswFsBlk.sys [8/9/2009 14:56 20560]

R2 Av630an;Av630an;c:\windows2\system32\drivers\av630an.sys [8/6/2009 13:03 107072]

R2 Av630bn;Av630bn;c:\windows2\system32\drivers\av630bn.sys [8/6/2009 13:03 107680]

R2 Av630cn;Av630cn;c:\windows2\system32\drivers\av630cn.sys [8/6/2009 13:03 102336]

R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [5/7/2007 12:25 53736]

S2 asqrbhlfx;Update Boot;c:\windows2\system32\svchost.exe -k netsvcs [4/8/2004 03:45 14336]

S2 ijwrqbjq;Manager Windows;c:\windows2\system32\svchost.exe -k netsvcs [4/8/2004 03:45 14336]

S2 qbhnvzmlr;Windows Shell;c:\windows2\system32\svchost.exe -k netsvcs [4/8/2004 03:45 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ijwrqbjq

qbhnvzmlr

asqrbhlfx

Conteúdo da pasta 'Tarefas Agendadas'

2009-09-11 c:\windows2\Tasks\SDMsgUpdate (TE).job

c:\arquiv~1\SMARTD~1\MESSAGES\SDNotify.exe [2009-08-05 14:29]

------- Scan Suplementar -------

uStart Page = hxxp://www.uerj.br/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

- - - ORFÃOS REMOVIDOS - - - -

BHO-{01A4FF23-2B20-435B-9930-F5AE9FF5039a} - c:\windows2\system32\ftsnnzfc.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-11 17:12

Windows 5.1.2600 Service Pack 3 FAT NTAPI

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\asqrbhlfx]

"ServiceDll"="c:\windows2\system32\pplgqx.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ijwrqbjq]

"ServiceDll"="c:\windows2\system32\pplgqx.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\qbhnvzmlr]

"ServiceDll"="c:\windows2\system32\pplgqx.dll"

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS2\\system32\\FM20ENU.DLL"

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - > 'winlogon.exe'(648)

c:\arquiv~1\GbPlugin\gbiehAbn.dll

- - - - - - > 'explorer.exe'(3216)

c:\windows2\system32\WININET.dll

c:\arquiv~1\GbPlugin\gbiehAbn.dll

c:\windows2\system32\WPDShServiceObj.dll

c:\windows2\system32\PortableDeviceTypes.dll

c:\windows2\system32\PortableDeviceApi.dll

c:\arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

c:\arquivos de programas\Microsoft Office\OFFICE11\msohev.dll

------------------------ Outros Processos em Execução ------------------------

c:\arquivos de programas\GBPLUGIN\GBPSV.EXE

c:\arquivos de programas\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE

c:\arquivos de programas\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE

c:\arquivos de programas\NERO\NERO 7\INCD\INCDSRV.EXE

c:\arquivos de programas\JAVA\JRE6\BIN\JQS.EXE

c:\arquivos de programas\ARQUIVOS COMUNS\MICROSOFT SHARED\VS7DEBUG\MDM.EXE

c:\windows2\SYSTEM32\HPZIPM12.EXE

c:\arquivos de programas\ANALOG DEVICES\SOUNDMAX\SMAGENT.EXE

c:\arquivos de programas\ALWIL SOFTWARE\AVAST4\ASHDISP.EXE

c:\arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

c:\arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

c:\arquivos de programas\ALWIL SOFTWARE\AVAST4\SETUP\AVAST.SETUP

**************************************************************************

Tempo para conclusão: 2009-09-11 17:14 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-09-11 20:14

Pré-execução: 13 pasta(s) 60.625.190.912 bytes disponíveis

Pós execução: 50 pasta(s) 60.992.061.440 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS2

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS2="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

258 --- E O F --- 2009-08-26 19:39

____________________________________________________________

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:18:06, on 11/9/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS2\System32\smss.exe

C:\WINDOWS2\system32\csrss.exe

C:\WINDOWS2\system32\winlogon.exe

C:\WINDOWS2\system32\services.exe

C:\WINDOWS2\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS2\system32\svchost.exe

C:\WINDOWS2\System32\svchost.exe

C:\WINDOWS2\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS2\system32\spoolsv.exe

C:\WINDOWS2\system32\svchost.exe

C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS2\system32\HPZipm12.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS2\system32\svchost.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS2\System32\alg.exe

C:\WINDOWS2\System32\svchost.exe

C:\WINDOWS2\system32\wuauclt.exe

C:\WINDOWS2\explorer.exe

C:\Documents and Settings\teste\Meus documentos\Downloads\HiJackThis.exe

C:\WINDOWS2\system32\wbem\wmiprvse.exe