[Arquivado]Guard.exe/Secure32.exe/Sucker.exe

Natalinus_007 · Julho 6, 2006

Eu mexi no msconfig e consegui tira alguns progamas do iniciar, mas depois de 3 vezes q ligo o pc eles voltam, e como tem alguns progamas do iniciar que eu tirei,ñ sei se o hijack vai pegar todos os virus,malwares e etc, entaum me ajudem pls.Deis de já agradeço ^^ :joia:

jgarcia · Julho 6, 2006

Opa Natalinus_007,

Faça o seguinte:

Baixe o HijackThis versão 1.99.1.

Depois > Iniciar > Meu Computador > 02 cliques no C > Coloca o HijackThis no C (extraindo do zip --> para uma pasta própria tipo c:/Hijack).

Execute o Hijack a partir do C, fechando os demais programas (deixando somente a área de trabalho).

Clique em Do a system scan and save a logfile, mas não marque nada, apenas poste o log gerado aqui neste mesmo tópico.

Abraços.

Natalinus_007 · Julho 7, 2006

Ok. Desculpa pela demora em responder, meu windows tah mto ruim , lento, travando, etc..

Logfile of HijackThis v1.99.1

Scan saved at 22:34:01, on 6/7/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\SnI\command.exe

C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\k4nv.exe

C:\Arquivos de programas\Network Monitor\netmon.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\update\updmangr.exe

C:\WINDOWS\win32host.exe

C:\WINDOWS\winsock\csrss.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\System32\mssvcc.exe

C:\WINDOWS\System32\firewall.exe

C:\WINDOWS\System32\win32bootcfg.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\WINDOWS\System32\sucker.exe

C:\WINDOWS\System32\secure32.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\RAM Idle LE\RAM_XP.exe

C:\Arquivos de programas\DAEMON Tools\daemon.exe

C:\Hijack\HijackThis.exe

C:\Arquivos de programas\ewido anti-spyware 4.0\ewido.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Cacheman\Cacheman.exe

C:\WINDOWS\System32\secure32.exe

C:\WINDOWS\System32\sucker.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [Microsoft ® Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [msconfig38] mssvcc.exe

O4 - HKLM\..\Run: [Windows MS Update 32] sucker.exe

O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exe

O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Arquivos de programas\Winamp\winampa.exe

O4 - HKLM\..\Run: [Win32 Security Protocol] secure32.exe

O4 - HKLM\..\Run: [systemService] osvcbvaooty.exe

O4 - HKLM\..\Run: [speed-O-Meter] C:\Arquivos de programas\Cymphonix\Speed-O-Meter\CymSpeed.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [RAM Idle Professional] C:\Arquivos de programas\RAM Idle LE\RAM_XP.exe

O4 - HKLM\..\Run: [Microsoft ® Windows Update Manager Tool] C:\WINDOWS\update\updmangr.exe

O4 - HKLM\..\Run: [MBM 5] "C:\Arquivos de programas\Motherboard Monitor 5\MBM5.EXE"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Arquivos de programas\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [!ewido] "C:\Arquivos de programas\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - HKLM\..\RunServices: [Windows MS Update 32] sucker.exe

O4 - HKLM\..\RunServices: [systemService] osvcbvaooty.exe

O4 - HKLM\..\RunServices: [Macromedia Flash Update] yarhjah.exe

O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe

O4 - HKLM\..\RunServices: [Win32 Security Protocol] secure32.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Cacheman] C:\Arquivos de programas\Cacheman\Cacheman.exe

O4 - HKCU\..\Run: [Windows MS Update 32] sucker.exe

O4 - HKCU\..\Run: [Win32 Security Protocol] secure32.exe

O4 - HKCU\..\RunOnce: [Windows MS Update 32] sucker.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Portbuster XP - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: &Portbuster 2002 - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1151014437093

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\s2rslc971f.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SnI\command.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Arquivos de programas\ewido anti-spyware 4.0\guard.exe

O23 - Service: K4NV - Unknown owner - C:\WINDOWS\k4nv.exe

O23 - Service: Network Monitor - Unknown owner - C:\Arquivos de programas\Network Monitor\netmon.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\WINDOWS\update\updmangr.exe

O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe

O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

jgarcia · Julho 7, 2006

Opa Natalinus_007,

1. Baixe o SmitfraudFix;

2. Desabilite a proteção do seu anti-vírus (temporariamente);

3. Extraia o arquivo SmitFraudFix para o seu desktop;

4. Reinicie em Modo Seguro;

5. Execute o SmitfraudFix --> Opção 2;

6. Responda sim (oui) à pergunta sobre a limpeza no registro;

7. Aguarde o término do scan e a geração do log;

8. Reinicie em Modo Normal;

9. Poste o log do SmitfraudFix (opção 2) + log HijackThis (gerado em Modo Normal).

Aguardo retorno.

Abraços.

Natalinus_007 · Julho 8, 2006

Olha, como eu tava usando o pc tirei muita coisa do iniciar pra ve se os virus sessção entuam tah ai o log do hijack, sem os processos dos virus (mas q voltam pro iniciar depois de eu liga o pc 3-4 vezes)

AJUDA PLS, TA APARECENDO CERCA DE 50 POPUPS POR CADA 2 MINUTOS!!

Logfile of HijackThis v1.99.1

Scan saved at 00:00:29, on 8/7/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\winsock\csrss.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\System32\mssvcc.exe

C:\Hijack\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Microsoft ® Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [msconfig38] mssvcc.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\RunServices: [Windows MS Update 32] sucker.exe

O4 - HKLM\..\RunServices: [systemService] osvcbvaooty.exe

O4 - HKLM\..\RunServices: [Macromedia Flash Update] yarhjah.exe

O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe

O4 - HKLM\..\RunServices: [Win32 Security Protocol] secure32.exe

O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlpage.htm

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Portbuster XP - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: &Portbuster 2002 - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1151014437093

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\m0po0a73ed.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

jgarcia · Julho 8, 2006

Opa Natalinus_007,

Vamos lá.

Habilite o Windows para mostrar todos os arquivos (até ocultos).

1ª Etapa

Baixe o Killbox em:

Killbox

Baixe, mas não execute ainda.

Baixe o SpySweeper em:

SpySweeper

Baixe e atualize o banco de dados, mas não execute ainda.

2ª Etapa

Faça o seguinte:

Iniciar -->Executar --> digite services.msc e dê OK.

Procure o serviço Windows TCP/IP Socket Driver.

Dê um clique direito nele e vá para Propriedades.

Clique em Parar e modifique o Tipo de Inicialização para Desativado.

1. Execute o Killbox, clique em Delete on Reboot.

2. Copie a lista abaixo em negrito para a área de transferência. Selecione --> Editar --> Copiar.

C:\WINDOWS\winsock\csrss.exe
C:\WINDOWS\System32\mssvcc.exe

C:\WINDOWS\System32\sucker.exe

C:\WINDOWS\System32\osvcbvaooty.exe

C:\WINDOWS\System32\yarhjah.exe

C:\WINDOWS\System32\secure32.exe

C:\WINDOWS\system32\m0po0a73ed.dll

3. Retorne ao Killbox. Clique em File > Paste from clipboard. Clique em All Files.

4. Aperte em "X". Responda "não" à pergunta.

É prudente que você faça a impressão deste documento ou salve-o em um lugar de fácil acesso, pois na próxima etapa entraremos em Modo de Seguro e a conexão à internet não será possível.

3ª Etapa

Reinicie o computador em Modo Seguro (após reiniciar aperte a tecla F8 até aparecer uma tela preta em DOS e escolha Modo Seguro).

Execute o HijackThis, clique em Open the Misc Tools section.

Clique em Delete an NT service.

Coloque:

Windows TCP/IP Socket Driver

Elimine o serviço.

Execute o HijackThis novamente, clique em Do a system scan only e marque:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\winsock\csrss.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\winsock\csrss.exe

O4 - HKLM\..\Run: [Microsoft ® Windows TCP/IP Socket Driver] C:\WINDOWS\winsock\csrss.exe

O4 - HKLM\..\Run: [msconfig38] mssvcc.exe

O4 - HKLM\..\RunServices: [Windows MS Update 32] sucker.exe

O4 - HKLM\..\RunServices: [systemService] osvcbvaooty.exe

O4 - HKLM\..\RunServices: [Macromedia Flash Update] yarhjah.exe

O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe

O4 - HKLM\..\RunServices: [Win32 Security Protocol] secure32.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\m0po0a73ed.dll

O23 - Service: Windows TCP/IP Socket Driver (winsck) - Unknown owner - C:\WINDOWS\winsock\csrss.exe

Clique em Fix Checked.

4ª Etapa

Ainda em Modo Seguro execute uma verificação completa com o SpySweeper.

5ª Etapa

Reinicie em Modo Normal.

Poste o novo log do HijackThis.

Aguardo retorno.

Um abraço.

Natalinus_007 · Julho 9, 2006

Malz Pela Demora (Viajando)

Tá Ai :)

Logfile of HijackThis v1.99.1

Scan saved at 19:51:57, on 9/7/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\ctfmon.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Webroot\Spy Sweeper\SpySweeper.exe

C:\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [!ewido] "C:\Arquivos de programas\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - HKLM\..\Run: [spySweeper] "C:\Arquivos de programas\Webroot\Spy Sweeper\SpySweeper.exe" /startintray

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlpage.htm

O9 - Extra button: Portbuster XP - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra 'Tools' menuitem: &Portbuster 2002 - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1151014437093

O17 - HKLM\System\CCS\Services\Tcpip\..\{B55992B0-A448-4680-86F7-B0C346921437}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\l82s0if7e82.dll (file missing)

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Arquivos de programas\Webroot\Spy Sweeper\WRSSSDK.exe

Natalinus_007 · Julho 9, 2006

Logfile of HijackThis v1.99.1

Scan saved at 20:51:38, on 9/7/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

D:\arkivos\OT\MtkRox\MixSoft OTController.exe

C:\WINDOWS\System32\cmd.exe

D:\arkivos\OT\MtkRox\YurOTS.exe

C:\Arquivos de programas\EasyPHP1-7\easyphp.exe

C:\ARQUIV~1\EASYPH~2\MySql\bin\mysqld.exe

C:\ARQUIV~1\EASYPH~2\Apache\apache.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\Arquivos de programas\Webroot\Spy Sweeper\SpySweeper.exe

C:\Hijack\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com