[Resolvido!]Não consigo instalar nenhum antivirus

aspdeco · Janeiro 2, 2007

Não consigo instalar nenhum antivirus, nenhum arquivo .exe é instalado...

Os executáveis desaparecem em segundos quando os procuro.!

Abaixo o log do Hijack...

alguem me ajude pro favor!!!!!!!!!

Logfile of HijackThis v1.99.1

Scan saved at 13:46:16, on 2/1/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\eMule\emule.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

&http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de

programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [FreeRAM XP] "C:\Arquivos de programas\YourWare Solutions\FreeRAM XP

Pro\FreeRAM XP Pro.exe" -win

O4 - HKCU\..\Run: [bPS Spyware Remover] C:\Arquivos de programas\BulletProofSoft.com\BPS Spyware & Adware Remover\SpyRem.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart16.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{537E7C28-7149-49F8-80E9-F477F12FB350}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

jgarcia · Janeiro 2, 2007

Opa aspdeco,

Baixe o F-Secure Blacklight em:

F-Secure Blacklight

Salve-o em sua área de trabalho e o execute. Aceite o acordo.

Se ele encontrar algum arquivo, ignore, pois quero apenas o log.

Ao final do scan será gerado o arquivo fsb-xxxxx.log (onde xxx são números). Preciso que você copie o log e poste em sua próxima resposta.

Abraços.

aspdeco · Janeiro 2, 2007

Olá Jgarcia....baixei o F-Secure Blacklight, salvei em minha área de trabalho e executei!ele encontrou alguns arquivos, mas ignorei como você recomendou!segue o log gerado...01/02/07 17:38:40 [info]: BlackLight Engine 1.0.55 initialized01/02/07 17:38:40 [info]: OS: 5.1 build 2600 (Service Pack 2)01/02/07 17:38:40 [Note]: 7019 401/02/07 17:38:40 [Note]: 7005 001/02/07 17:39:16 [Note]: 7006 001/02/07 17:39:16 [Note]: 7011 132401/02/07 17:39:16 [Note]: 7026 001/02/07 17:39:16 [Note]: 7026 001/02/07 17:39:16 [Note]: 7024 301/02/07 17:39:16 [info]: Hidden process: C:\WINDOWS\9129837.exe01/02/07 17:39:16 [Note]: 7024 301/02/07 17:39:16 [info]: Hidden process: C:\WINDOWS\system32\hldrrr.exe01/02/07 17:39:41 [Note]: FSRAW library version 1.7.102101/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Empty.txt01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Filters.xml01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\news.png01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\paint.png01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Profiles\Blank.txt01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Sample1.jpg01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Sample2.jpg01/02/07 17:40:07 [Note]: 10002 301/02/07 17:40:07 [Note]: 10002 201/02/07 17:40:07 [Note]: 10002 201/02/07 17:40:15 [info]: Hidden file: c:\Documents and Settings\Geral\Dados de aplicativos\hidires\hidr.exe01/02/07 17:40:15 [Note]: 10002 201/02/07 17:40:15 [info]: Hidden file: c:\Documents and Settings\Geral\Dados de aplicativos\hidires\m_hook.sys01/02/07 17:40:15 [Note]: 10002 201/02/07 17:40:15 [Note]: 10002 301/02/07 17:40:15 [Note]: 10002 301/02/07 17:40:15 [Note]: 10002 201/02/07 17:40:15 [Note]: 10002 201/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\new_drv.sys01/02/07 17:40:57 [Note]: 10002 201/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ 2.1.16.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\E-SangIn Standard LAN BarCode Server v19.8 Korean.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\E-SangIn Standard PC BarCode v19.8 Korean.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\E-Soft Audio Converter v2.3.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\e-Speedy Mail v2.00.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\e-Stack Room v3.71.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\E-Stack Room v3.72.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ES-Calc v2.1a.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ES-Calc v2.2.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ES-Calc v2.2b.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ES-Computing EditPlus v2.12 build 139 Update Only.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\EscapeClose Pro v1.41 by RP2K.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v3.0 build 75.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v2.1 build 40.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape v1.2 for PalmOS.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSoft Audio Edit v3.4.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v2.2 build 55 Keygen.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSafe Protect v2.1.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSafe ViruSafe 8.0.13.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSan Audio CD Burner v2.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSan MP3 Builder v2.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSan Photo2PDF v1.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESRD StressCheck v5.0.76.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBPDF Analysis 1.5.1.169.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBPDF Analysis 1.5.2.175.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBStats 1.2.3.241.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBStats Lite 1.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBStats Lite 1.1.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBStats Lite 1.2.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBStats Standard 1.2.2.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBUnit Pro Conversion Utility v4.3.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\EscapeClose Pro v1.41.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eScan Enterprise Edition v2.5.181 for Win9x ME.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eScan Enterprise Edition v2.5.181 for WinNT 2000.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape From Monkey Island v1.1+.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape From Monkey Island v1.1.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape v1.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape v1.1.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape v1.2 by TSRH.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape v1.2.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape Velocity Nova Fixed.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\EscapeClose Pro v1.3.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\EscapeClose Pro v1.4.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\EscapeClose Pro v1.7.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Escape Master v1.1 Java.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v2.2 build 55 Keyfile.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eShopper Deluxe v1.4 by FHCF.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESBStats Standard 1.1.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSafe Protect v2.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSafe Protect 2.0.13.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSafe Protect Enterprise 2.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSafe Protect v2.1.1 build 17.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESDi v1.12.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESDi v1.13 by Lucid.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESDi v1.13 by Revenge.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESDi v1.14.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\ESDi v1.1.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v2.02.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSearch v1.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Eserv 2.80.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Eserv 2.90.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Eset NOD32 Antivirus v2.000.6.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eShopper Deluxe v2.0.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Esker VSI-FAX v5.0 FreeBSD.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\eSoft Media Box MP3 Workstation v6.2.zip01/02/07 17:40:57 [Note]: 10002 301/02/07 17:40:57 [info]: Hidden file: c:\WINDOWS\shared\Espion 2004 v4.0.1 Multilanguage.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESRD StressCheck v5.0.82.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Audio Edit v3.4 by Haze.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESftp v2.0 by Period.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESftp v2.0 by Variance.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESftp v2.0.0.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESftp v3.0.0.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eShopper Deluxe v2.0 by TSRH.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eShopper Deluxe v2.1.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\EShopper Deluxe v2.2.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESI Group AutoSEA2 2004 v2.5.0.8 UNIX.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESI Group AutoSEA2 2004 v2.5.0.8 Win32.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESI PAM-CRASH 2G 2004.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESI ProCAST v2004.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESig97 v3.31 Keygen.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESig97 v3.31 Serial.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Esker VSI-FAX v5.0 LINUX.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESListing v1.00 French.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSmart Explorer v4.9.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Audio Converter v2.3.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Audio Converter v3.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Audio Converter v4.0 by Haze.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Audio Converter v4.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Interactive Tower Mogul v1.2.0 Demo for PocketPC.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eSoft Media Box MP3 Workstation v6.2 by Haze.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESP Mail Check v2.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESP v1.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESP-Electronic Survey Program v3.23.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\espAnadir Clasific Pro v1.5.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Espion 2004 v4.0 Multilanguage.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Espion French.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\EspMeter 1.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESQuotes 1.0.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESQuotes 1.1.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESQuotes 1.2 by Eclipse.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESQuotes 1.2 by PGC.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESRD StressCheck v5.0.79.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESRD StressCheck v5.0.84.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\ESRD StressCheck v6.1.20.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v3.0 build 87 by Evaluator.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v3.0 build 87 by TSRH.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v3.2 build 130 Multilanguage.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Essential NetTools v3.2 build 133 Fixed.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\eStara Softphone v3.0.0.18.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Estimate Master v3.03 by SCF.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Estimate Master v3.03.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [info]: Hidden file: c:\WINDOWS\shared\Estimate Master v3.08.zip01/02/07 17:40:58 [Note]: 10002 301/02/07 17:40:58 [Note]: 10002 201/02/07 17:40:58 [Note]: 10002 201/02/07 17:40:58 [info]: Hidden file: C:\WINDOWS\9129837.exe01/02/07 17:40:58 [Note]: 10002 201/02/07 17:41:32 [Note]: 10002 201/02/07 17:41:32 [Note]: 10002 201/02/07 17:41:45 [info]: Hidden file: C:\WINDOWS\system32\hldrrr.exe01/02/07 17:41:45 [Note]: 10002 201/02/07 17:42:17 [Note]: 2000 101201/02/07 17:44:59 [Note]: 7007 0

aspdeco · Janeiro 2, 2007

mais um problema, mas não sei se tem ligação com o de cima....por isso estou colocando aqui!as vezes, quando estou navengando, aparece a seguinte msg...[ A instrução no "0x00141264" fez referencia a memoria no "0x077291cc". A memoria não pôde ser "read".]o que pode ser?? será que devo formatar o pc?? se fizer isso, todos os problemas serão resolvidos??Obrigado Jgarcia e espero resposta!!...abraço

jgarcia · Janeiro 2, 2007

Opa aspdeco,

Vamos lá.

Habilite o Windows para mostrar todos os arquivos (até ocultos).

Desabilite a função de Restauração Automática do XP.

1ª Etapa

Baixe o Killbox em:

Killbox

Baixe, mas não execute ainda.

Baixe a ferramenta de correção da Symantec.

Baixe -> vá em Arquivo -> Salvar como em seu desktop, mas não a execute ainda.

Baixe o CCleaner em:

CCleaner

Baixe, mas não execute ainda.

2ª Etapa

1. Execute o Killbox, clique em Delete on Reboot.

2. Copie a lista abaixo em negrito para a área de transferência. Selecione tudo com o auxílio do mouse --> vá até a aba Editar na barra do navegador --> clique em Copiar.

c:\Documents and Settings\Geral\Dados de aplicativos\hidires\hidr.exe

c:\Documents and Settings\Geral\Dados de aplicativos\hidires\m_hook.sys

C:\WINDOWS\system32\hldrrr.exe

C:\WINDOWS\9129837.exe

c:\WINDOWS\new_drv.sys

3. Retorne ao Killbox. Clique em File > Paste from clipboard. Clique em All Files.

4. Aperte em "X". Responda "não" à pergunta.

3ª Etapa

Reinicie o computador em Modo Seguro (ao reiniciar aperte a tecla F8 repetidamente até que apareça uma tela preta em DOS e escolha a opção Modo Seguro).

Vá em Iniciar -> Executar -> digite regedit -> dê Ok.

Execute a ferramenta de correção. Para isto dê um clique-direito sobre UnHookExec.inf contido em seu desktop e depois em instalar.

Navegue e delete as seguintes subchaves, se houver:

HKEY_CURRENT_USER\Software\FirstRRRun

HKEY_CURRENT_USER\Software\FIRSTRUXZX

Navegue até a seguinte subchave:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

No painel à direita, delete os seguintes valores, se houver:

"drvsyskit" = "%Userprofiles%\Application Data\hidires\hidr.exe"

"drvsyskit" = "%Userprofiles%\Application Data\hidn\hidn2.exe"

"german.exe" = "%System%\wintems.exe"

"german.exe" = "%System%\hldrrr.exe"

Navegue até a seguinte subchave:

HKEY_CURRENT_USER\Software\DateTime4

No painel à direita, restaure os seguintes valores originais, se necessário:

"port" = "0x5B7E"

"uid" = "[RANDOM]"

"wdrn" = "0x00000001"

Navegue até a seguinte subchave:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

Selecione a pasta (Control) -> dê um clique-direito -> Novo -> Chave -> coloque o nome de Safeboot.

Criada a pasta Safeboot, a selecione -> dê um clique-direito -> Novo -> Valor da sequência -> dê o nome de AlternateShell.

No painel à direita selecione AlternateShell -> dê um clique-direito -> Modificar -> no local destinado ao valor coloque cmd.exe.

Saia do Editor do Registro.

Localize e delete:

c:\Documents and Settings\Geral\Dados de aplicativos\hidires <- a pasta

Vá até a pasta C:\!Killbox e delete o conteúdo.

4ª Etapa

Reinicie em Modo Normal.

Execute o CCleaner e clique em Executar Cleaner.

Verifique se o problema foi resolvido e poste um novo log do HijackThis.

Aguardo retorno.

Um abraço.

PS.: Não se faz necessária a formatação. Siga as instruções e tudo dará certo. ;)

aspdeco · Janeiro 2, 2007

olá jgarcia...tentei por 4 vezes reiniciar em modo seguro (tecla F8) mas o pc não reinicia....somente no modo normal!... =[o que pode ser??abraços

jgarcia · Janeiro 3, 2007

Opa aspdeco,

Execute as ações em Modo Normal mesmo.

Abraços.

aspdeco · Janeiro 3, 2007

nossa jgarcia....más notícias (pra mim) rsrs!!passei rápido por sua resposta que esqueci de desabilitar a Restauração Automatica do Xp! será que isso foi o problema???mas já desativei e farei as recomendações em Modo Normal mesmo!....assim que terminar, postarei o log do Hijack....até breve amigo!! obrigado...abraços

jgarcia · Janeiro 3, 2007

passei rápido por sua resposta que esqueci de desabilitar a Restauração Automatica do Xp! será que isso foi o problema???

Com certeza não.

mas já desativei e farei as recomendações em Modo Normal mesmo!....

Ok, mas antes dê uma olhada neste tutorial que ensina a reiniciar em Modo Seguro e veja se estava agindo corretamente.

assim que terminar, postarei o log do Hijack....

Sem problemas. Fico no aguardo.

Abraços.

aspdeco · Janeiro 3, 2007

Olá jgarcia!!!

fiz como recomendou....e consegui instalar o Spybot e o AVG free.....

você recomenda usar esses dois???

segue o novo log do Hijack...

Logfile of HijackThis v1.99.1

Scan saved at 14:36:27, on 3/1/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\checkers5.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe

O4 - HKCU\..\Run: [bPS Spyware Remover] C:\Arquivos de programas\BulletProofSoft.com\BPS Spyware & Adware Remover\SpyRem.exe

O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe

O4 - HKCU\..\Run: [checkers] C:\WINDOWS\checkers5.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart16.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

aspdeco · Janeiro 3, 2007

olá jgarcia....

segue o log após a execução do CCleaner!!!

Logfile of HijackThis v1.99.1

Scan saved at 14:52:41, on 3/1/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\checkers5.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKCU\..\Run: [checkers] C:\WINDOWS\checkers5.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart16.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

jgarcia · Janeiro 3, 2007

fiz como recomendou....e consegui instalar o Spybot e o AVG free.....
você recomenda usar esses dois???

Sim.

Vamos aos próximos passos.

1ª Etapa

1. Execute o Killbox, clique em Delete on Reboot.

2. Copie a lista abaixo em negrito para a área de transferência. Selecione tudo com o auxílio do mouse --> vá até a aba Editar na barra do navegador --> clique em Copiar.

C:\WINDOWS\system32\hldrrr.exe

C:\WINDOWS\9129837.exe

C:\WINDOWS\checkers5.exe

3. Retorne ao Killbox. Clique em File > Paste from clipboard. Clique em All Files.

4. Aperte em "X". Responda "não" à pergunta.

2ª Etapa

Reinicie o computador em Modo Normal.

Execute o HijackThis, clique em Do a system scan only e marque (talvez alguns já não existam mais):

O4 - HKLM\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe

O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe

O4 - HKCU\..\Run: [checkers] C:\WINDOWS\checkers5.exe

Clique em Fix Checked.

3ª Etapa

Reinicie em Modo Normal novamente.

Delete o conteúdo da pasta C:\!Killbox.

Poste um novo log do HijackThis.

Um abraço.

aspdeco · Janeiro 3, 2007

olá jgracia!

segue o novo log....

Logfile of HijackThis v1.99.1

Scan saved at 16:00:12, on 3/1/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll