[Resolvido!]SOCKET ERROR 11004

[katiaserra 0]

Estou com o problema de muita gente:

 

Log do Hijackhis

 

Logfile of HijackThis v1.99.1

Scan saved at 20:56:27, on 19/4/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\vsnpstd.exe

C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

C:\WINDOWS\System32\rundll32.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

C:\Arquivos de programas\Eset\nod32krn.exe

C:\WINDOWS\System32\system32.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\HijackThis.exe

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.119.192.46:8080

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ssh2 Class - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\WINDOWS\System32\scpsssh2.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\WINDOWS\Downloaded Program Files\gbiehabn.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [nod32kui] "C:\Arquivos de programas\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [WatchDog] C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [Zone Labs Client] C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [system32] C:\WINDOWS\System32\system32.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - Startup: A4Proxy.lnk = C:\Arquivos de programas\A4Proxy\A4Proxy.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: system32.exe

O8 - Extra context menu item: Download All with WinGet - res://C:\Arquivos de programas\Indentix\WinGet\WinIE.dll/301

O8 - Extra context menu item: Download with WinGet - res://C:\Arquivos de programas\Indentix\WinGet\WinIE.dll/300

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab

O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Arquivos de programas\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[jgarcia 1]

Cara katiaserra,

 

Vamos lá.

 

Habilite o Windows para mostrar todos os arquivos (até ocultos).

 

1ª Etapa

 

Baixe o Killbox em:

Killbox

 

Execute o KillBox:

1) Selecione Delete on reboot;

 

2) Copie a lista abaixo em negrito para a área de transferência. Selecione --> Editar --> Copiar:

C:\WINDOWS\System32\system32.exe

3) Retorne ao Killbox. Clique em File --> Paste from clipboard --> All files;

 

4) Aperte em "X". Responda "não" à pergunta.

 

É prudente que você faça a impressão deste documento ou salve-o em um lugar de fácil acesso, pois na próxima etapa entraremos em Modo Seguro e a conexão à internet não será possível.

 

2ª Etapa

 

Reinicie o computador em Modo Seguro (após reiniciar aperte a tecla F8 até aparecer uma tela preta em DOS e escolha Modo Seguro).

 

Execute o HijackThis, clique em Do a system scan only e marque:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O4 - HKLM\..\Run: [system32] C:\WINDOWS\System32\system32.exe

O4 - Global Startup: system32.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab

O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab

Clique em Fix Checked.

 

3ª Etapa

 

Reinicie em modo normal.

 

Um abraço. - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.119.192.46:8080

Sua conexão é compartilhada?

 

Poste um novo log do HijackThis.

 

Abraços.

[katiaserra 0]

Não consogui deletar Global Startup: system32.exe, esta sendo usado.

Não minha conexão NÃO É COMPARTILHADA, tenho o Virtua 2 megas e só esse PC.

 

Mas qdo reiniciei já não apareceu a mensagem de socket error 11004

Novo Log Do Hijackthis:

 

Logfile of HijackThis v1.99.1

Scan saved at 20:00:05, on 20/4/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\vsnpstd.exe

C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

C:\WINDOWS\System32\rundll32.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Arquivos de programas\Eset\nod32krn.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Arquivos de programas\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.119.192.46:8080

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ssh2 Class - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\WINDOWS\System32\scpsssh2.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\WINDOWS\Downloaded Program Files\gbiehabn.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [nod32kui] "C:\Arquivos de programas\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [WatchDog] C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [Zone Labs Client] C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - Startup: A4Proxy.lnk = C:\Arquivos de programas\A4Proxy\A4Proxy.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: system32.exe

O8 - Extra context menu item: Download All with WinGet - res://C:\Arquivos de programas\Indentix\WinGet\WinIE.dll/301

O8 - Extra context menu item: Download with WinGet - res://C:\Arquivos de programas\Indentix\WinGet\WinIE.dll/300

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Arquivos de programas\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[jgarcia 1]

Cara katiaserra,

 

Vamos lá.

 

Reinicie o computador em Modo Seguro.

 

Execute o HijackThis, clique em Do a system scan only e marque:

O4 - Global Startup: system32.exe

Clique em Fix Checked.

 

Reinicie em modo normal.

 

Poste um novo log do HijackThis.

 

Abraços.

 

PS.: Você disse que a conexão não é compartilhada, mas há um Proxy em seu PC:

O4 - Startup: A4Proxy.lnk = C:\Arquivos de programas\A4Proxy\A4Proxy.exe

... você que o instalou?

[katiaserra 0]

Desculpe a demora,tive que esperar o pessoal do virtua trocar meu modem:

 

Não consegui tirar o Global Startup:system 32.exe.

nem em modo de segurança e nem normal.

 

Unable to delete the file

04-Global Startup:system32.exe

 

The file may be in use.Use task manager to shutdown the program and run Hijackthis again to delete this file.

 

log do Hijackthis:

 

 

Logfile of HijackThis v1.99.1

Scan saved at 23:58:48, on 22/4/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\vsnpstd.exe

C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

C:\WINDOWS\System32\rundll32.exe

C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Arquivos de programas\Eset\nod32krn.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\HijackThis.exe

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ssh2 Class - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\WINDOWS\System32\scpsssh2.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\WINDOWS\Downloaded Program Files\gbiehabn.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [nod32kui] "C:\Arquivos de programas\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [WatchDog] C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [Zone Labs Client] C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - Startup: A4Proxy.lnk = C:\Arquivos de programas\A4Proxy\A4Proxy.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: system32.exe

O8 - Extra context menu item: Download by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlpage.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Arquivos de programas\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[jgarcia 1]

Cara katiaserra,

 

Execute o Active Scan da Panda.

 

Retorne com o resultado.

 

Abraços.

[katiaserra 0]

log do activescan

Incident Status Location

 

Potentially unwanted tool:application/funweb Not disinfected c:\windows\downloaded program files\f3initialsetup1.0.0.15.inf

Adware:adware/cws Not disinfected Windows Registry

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@ad.yieldmanager[1].txt

Spyware:Cookie/Admotion Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@admotion.com[1].txt

Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@adopt.hbmediapro[2].txt

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@ads.pointroll[2].txt

Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@adultfriendfinder[2].txt

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@apmebf[2].txt

Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@as-eu.falkag[1].txt

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@atwola[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@belnk[1].txt

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@c5.zedo[1].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@de.uol.com[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@dist.belnk[2].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@google.com[3].txt

Spyware:Cookie/go Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@go[1].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@ig.com[1].txt

Spyware:Cookie/Paypopup Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@paypopup[1].txt

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@perf.overture[1].txt

Spyware:Cookie/Rn11 Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@rn11[2].txt

Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@sel.as-eu.falkag[2].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@terra.com[1].txt

Spyware:Cookie/Tucows Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@tucows[1].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@uol.com[1].txt

Spyware:Cookie/Buydomains Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@www47.buydomains[1].txt

Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@www48.seeq[1].txt

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\nois tudo\Cookies\nois tudo@xiti[1].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Dados de aplicativos\Mozilla\Profiles\default\ab1n5dr2.slt\cookies.txt[.google.com.br/]

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\nois tudo\Dados de aplicativos\Mozilla\Profiles\default\ab1n5dr2.slt\cookies.txt[.2o7.net/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\nois tudo\Dados de aplicativos\Mozilla\Profiles\default\ab1n5dr2.slt\cookies.txt[.doubleclick.net/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.doubleclick.net/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.realmedia.com/]

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.2o7.net/]

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.google.com.br/]

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.belnk.com/]

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.statcounter.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.fastclick.net/]

Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.revenue.net/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.atdmt.com/]

Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\nois tudo\Recent\Dados de aplicativos\Mozilla\Profiles\default\s1trc4yq.slt\cookies.txt[.maxserving.com/]

Potentially unwanted tool:Application/MyWebSearch Not disinfected E:\programas\SmileyCentralSetup2.0.4.18.exe

Virus:Trj/Banbra.CCY Disinfected E:\programas\geradordecreditos.exe

Virus:Trj/Banbra.CCY Disinfected E:\programas\geradordecreditos(1).exe

[jgarcia 1]

Cara katiaserra,

 

Vamos lá.

 

1ª Etapa

 

Baixe o CCleaner em:

CCleaner

 

Baixe, mas não execute ainda.

 

Baixe o SpySweeper em:

SpySweeper

 

Baixe e atualize, mas não execute ainda.

 

2ª Etapa

 

Execute o KillBox:

1) Selecione Delete on reboot;

 

2) Copie a lista abaixo em negrito para a área de transferência. Selecione --> Editar --> Copiar:

c:\windows\downloaded program files\f3initialsetup1.0.0.15.inf

E:\programas\SmileyCentralSetup2.0.4.18.exe

3) Retorne ao Killbox. Clique em File --> Paste from clipboard --> All files;

 

4) Aperte em "X". Responda "não" à pergunta.

 

É prudente que você faça a impressão deste documento ou salve-o em um lugar de fácil acesso, pois na próxima etapa entraremos em Modo Seguro e a conexão à internet não será possível.

 

3ª Etapa

 

Reinicie o computador em Modo Seguro.

 

Execute uma verificação completa com o SpySweeper.

 

4ª Etapa

 

Reinicie em Modo Normal.

 

Execute o CCleaner e clique em Executar Cleaner.

 

Execute o Active Scan da Panda e veja se ainda detecta algo.

 

Um abraço.

[katiaserra 0]

Agora fica aparecendo essa janelinha com essa mensagem, é um spyware???

 

[jgarcia 1]

Agora fica aparecendo essa janelinha com essa mensagem, é um spyware???

Parece que sim.

 

Execute as ações sugeridas, retorne com o resultado e um novo log do HijackThis.

 

Abraços.

[katiaserra 0]

Resultado do Active Scan

Status Location

 

Potentially unwanted tool:application/funweb Not disinfected HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

 

Log do Hijackthis depois de todos os procedimentos

Logfile of HijackThis v1.99.1

Scan saved at 10:29:01, on 25/4/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\Arquivos de programas\Eset\nod32krn.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Arquivos de programas\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\vsnpstd.exe

C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\System32\msiexec.exe

C:\Arquivos de programas\ESET\nod32kui.exe

C:\Arquivos de programas\HijackThis.exe

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ssh2 Class - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\WINDOWS\System32\scpsssh2.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Arquivos de programas\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O2 - BHO: G-Buster Browser Defense ABN AMRO - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\WINDOWS\Downloaded Program Files\gbiehabn.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\pt-br\msntb.dll

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [nod32kui] "C:\Arquivos de programas\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [WatchDog] C:\Arquivos de programas\mobile PhoneTools\WatchDog.exe

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Arquivos de programas\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [Zone Labs Client] C:\Arquivos de programas\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Download by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlpage.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...tup1.0.0.15.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399007} (GbPluginObj Class) - https://wwws.realsecureweb.com.br/mpr/plugi...GbPluginABN.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Arquivos de programas\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Arquivos de programas\Webroot\Spy Sweeper\WRSSSDK.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[jgarcia 1]

Cara katiaserra,

 

Reinicie em Modo Seguro.

 

Vá em Iniciar --> Executar --> digite regedit --> dê Ok.

 

Navegue até à seguinte subchave:

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units

 

Delete a seguinte subpasta:

 

{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

 

Saia do Editor do Registro.

 

Reinicie em Modo Normal.

 

Execute o CCleaner novamente.

 

Rode o scan da Panda e veja se ainda detecta algo.

 

Abraços.

[katiaserra 0]

Desculpe a demora da resposta, Problema resolvido, O panda Não dectou nada.

Muito Obrigada: :clap:

[jgarcia 1]

Opa katiaserra,

 

Fico feliz por saber que a sua máquina está LIMPA. :thumbsup:

 

Para finalizar:

 

1. Desabilite e Reabilite a função de Restauração Automática do XP. Clique aqui para ver como;

 

2. Atualize o seu Sistema Operacional urgentemente.

 

Para que tenha uma idéia, já foram lançados 02 (dois) grandes pacotes de atualização de (SP1 e SP2) e você só possui o primeiro deles instalado (SP1). Utilize o Windows Up Date contido no menu Iniciar ou solicite o CD SP2 a um amigo (melhor opção).

 

Abraços.

[katiaserra 0]

Eu ja baixei o a atualização 2 vezes porém , com essas atualizações não consigo mais me conectar com a internet, não sei se é a Placa De rede ou o Virtua, por isso deixei o SP1 mesmo. Obrigado Abraços.

[jgarcia 1]

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto é necessário enviar uma Mensagem Privada para um Moderador com um link para o tópico.